Merge lp:~james-page/charms/trusty/nova-cloud-controller/service-guard into lp:~openstack-charmers-archive/charms/trusty/nova-cloud-controller/trunk

[James Page]

Add support for service-guard configuration to disable services prior to relations being completely formed.

[lp:~james-page/charms/trusty/nova-cloud-controller/service-guard]

95. By James Page on 2014-07-29

Don't add neutron stuff if related to neutron-api charm

96. By James Page on 2014-07-29

Fixup unit tests

97. By James Page on 2014-07-29

Tidy lint

Unmerged revisions

=== added file '.bzrignore'
--- .bzrignore	1970-01-01 00:00:00 +0000
+++ .bzrignore	2014-07-29 13:07:23 +0000
@@ -0,0 +1,2 @@
+bin
+.coverage
 
=== modified file 'Makefile'
--- Makefile	2014-05-21 10:14:28 +0000
+++ Makefile	2014-07-29 13:07:23 +0000
@@ -2,16 +2,28 @@
 PYTHON := /usr/bin/env python
 
 lint:
-	@flake8 --exclude hooks/charmhelpers hooks unit_tests
+	@flake8 --exclude hooks/charmhelpers hooks unit_tests tests
 	@charm proof
 
+unit_test:
+	@echo Starting unit tests...
+	@$(PYTHON) /usr/bin/nosetests --nologcapture --with-coverage unit_tests
+
+bin/charm_helpers_sync.py:
+	@mkdir -p bin
+	@bzr cat lp:charm-helpers/tools/charm_helpers_sync/charm_helpers_sync.py \
+        > bin/charm_helpers_sync.py
 test:
-	@echo Starting tests...
-	@$(PYTHON) /usr/bin/nosetests --nologcapture --with-coverage  unit_tests
+	@echo Starting Amulet tests...
+	# coreycb note: The -v should only be temporary until Amulet sends
+	# raise_status() messages to stderr:
+	#   https://bugs.launchpad.net/amulet/+bug/1320357
+	@juju test -v -p AMULET_HTTP_PROXY
 
 sync:
-	@charm-helper-sync -c charm-helpers.yaml
+	@$(PYTHON) bin/charm_helpers_sync.py -c charm-helpers-hooks.yaml
+	@$(PYTHON) bin/charm_helpers_sync.py -c charm-helpers-tests.yaml
 
-publish: lint test
+publish: lint unit_test
 	bzr push lp:charms/nova-cloud-controller
 	bzr push lp:charms/trusty/nova-cloud-controller
 
=== modified file 'README.txt'
--- README.txt	2014-03-25 09:11:04 +0000
+++ README.txt	2014-07-29 13:07:23 +0000
@@ -4,6 +4,11 @@
 
 Cloud controller node for Openstack nova. Contains nova-schedule, nova-api, nova-network and nova-objectstore.
 
+The neutron-api interface can be used join this charm with an external neutron-api server. If this is done
+then this charm will shutdown its neutron-api service and the external charm will be registered as the
+neutron-api endpoint in keystone. It will also use the quantum-security-groups setting which is passed to
+it by the api service rather than its own quantum-security-groups setting.
+
 ******************************************************
 Special considerations to be deployed using Postgresql
 ******************************************************
 
=== added file 'charm-helpers-hooks.yaml'
--- charm-helpers-hooks.yaml	1970-01-01 00:00:00 +0000
+++ charm-helpers-hooks.yaml	2014-07-29 13:07:23 +0000
@@ -0,0 +1,11 @@
+branch: lp:charm-helpers
+destination: hooks/charmhelpers
+include:
+    - core
+    - fetch
+    - contrib.openstack|inc=*
+    - contrib.storage
+    - contrib.hahelpers:
+        - apache
+    - payload.execd
+    - contrib.network.ip
 
=== added file 'charm-helpers-tests.yaml'
--- charm-helpers-tests.yaml	1970-01-01 00:00:00 +0000
+++ charm-helpers-tests.yaml	2014-07-29 13:07:23 +0000
@@ -0,0 +1,5 @@
+branch: lp:charm-helpers
+destination: tests/charmhelpers
+include:
+    - contrib.amulet
+    - contrib.openstack.amulet
 
=== removed file 'charm-helpers.yaml'
--- charm-helpers.yaml	2014-04-02 17:04:22 +0000
+++ charm-helpers.yaml	1970-01-01 00:00:00 +0000
@@ -1,10 +0,0 @@
-branch: lp:charm-helpers
-destination: hooks/charmhelpers
-include:
-    - core
-    - fetch
-    - contrib.openstack|inc=*
-    - contrib.storage
-    - contrib.hahelpers:
-        - apache
-    - payload.execd
 
=== modified file 'config.yaml'
--- config.yaml	2014-06-17 10:01:21 +0000
+++ config.yaml	2014-07-29 13:07:23 +0000
@@ -97,15 +97,11 @@
   # HA configuration settings
   vip:
     type: string
-    description: "Virtual IP to use to front API services in ha configuration"
-  vip_iface:
-    type: string
-    default: eth0
-    description: "Network Interface where to place the Virtual IP"
-  vip_cidr:
-    type: int
-    default: 24
-    description: "Netmask that will be used for the Virtual IP"
+    description: |
+      Virtual IP(s) to use to front API services in HA configuration.
+      .
+      If multiple networks are being used, a VIP should be provided for each
+      network, separated by spaces.
   ha-bindiface:
     type: string
     default: eth0
@@ -163,5 +159,52 @@
   nvp-l3-uuid:
     type: string
     description: |
-      This is uuid of the default NVP/NSX L3 Gateway Service.
-  # end of NVP/NSX configuration
+<<<<<<< TREE
+      This is uuid of the default NVP/NSX L3 Gateway Service.
+  # end of NVP/NSX configuration
+=======
+      This is uuid of the default NVP/NSX L3 Gateway Service.
+  # end of NVP/NSX configuration
+  # Network configuration options
+  # by default all access is over 'private-address'
+  os-admin-network:
+    type: string
+    description: |
+      The IP address and netmask of the OpenStack Admin network (e.g.,
+      192.168.0.0/24)
+      .
+      This network will be used for admin endpoints.
+  os-internal-network:
+    type: string
+    description: |
+      The IP address and netmask of the OpenStack Internal network (e.g.,
+      192.168.0.0/24)
+      .
+      This network will be used for internal endpoints.
+  os-public-network:
+    type: string
+    description: |
+      The IP address and netmask of the OpenStack Public network (e.g.,
+      192.168.0.0/24)
+      .
+      This network will be used for public endpoints.
+  service-guard:
+    type: boolean
+    default: false
+    description: |
+      Ensure required relations are made and complete before allowing services
+      to be started
+      .
+      By default, services may be up and accepting API request from install
+      onwards.
+      .
+      Enabling this flag ensures that services will not be started until the
+      minimum 'core relations' have been made between this charm and other
+      charms.
+      .
+      For this charm the following relations must be made:
+      .
+        * shared-db or (pgsql-nova-db, pgsql-neutron-db)
+        * amqp
+        * identity-service
+>>>>>>> MERGE-SOURCE
 
=== modified file 'hooks/charmhelpers/contrib/hahelpers/cluster.py'
--- hooks/charmhelpers/contrib/hahelpers/cluster.py	2014-02-17 12:10:27 +0000
+++ hooks/charmhelpers/contrib/hahelpers/cluster.py	2014-07-29 13:07:23 +0000
@@ -146,12 +146,12 @@
     Obtains all relevant configuration from charm configuration required
     for initiating a relation to hacluster:
 
-        ha-bindiface, ha-mcastport, vip, vip_iface, vip_cidr
+        ha-bindiface, ha-mcastport, vip
 
     returns: dict: A dict containing settings keyed by setting name.
     raises: HAIncompleteConfig if settings are missing.
     '''
-    settings = ['ha-bindiface', 'ha-mcastport', 'vip', 'vip_iface', 'vip_cidr']
+    settings = ['ha-bindiface', 'ha-mcastport', 'vip']
     conf = {}
     for setting in settings:
         conf[setting] = config_get(setting)
@@ -170,6 +170,7 @@
 
     :configs    : OSTemplateRenderer: A config tempating object to inspect for
                                       a complete https context.
+
     :vip_setting:                str: Setting in charm config that specifies
                                       VIP address.
     '''
 
=== added directory 'hooks/charmhelpers/contrib/network'
=== added file 'hooks/charmhelpers/contrib/network/__init__.py'
=== added file 'hooks/charmhelpers/contrib/network/ip.py'
--- hooks/charmhelpers/contrib/network/ip.py	1970-01-01 00:00:00 +0000
+++ hooks/charmhelpers/contrib/network/ip.py	2014-07-29 13:07:23 +0000
@@ -0,0 +1,156 @@
+import sys
+
+from functools import partial
+
+from charmhelpers.fetch import apt_install
+from charmhelpers.core.hookenv import (
+    ERROR, log,
+)
+
+try:
+    import netifaces
+except ImportError:
+    apt_install('python-netifaces')
+    import netifaces
+
+try:
+    import netaddr
+except ImportError:
+    apt_install('python-netaddr')
+    import netaddr
+
+
+def _validate_cidr(network):
+    try:
+        netaddr.IPNetwork(network)
+    except (netaddr.core.AddrFormatError, ValueError):
+        raise ValueError("Network (%s) is not in CIDR presentation format" %
+                         network)
+
+
+def get_address_in_network(network, fallback=None, fatal=False):
+    """
+    Get an IPv4 or IPv6 address within the network from the host.
+
+    :param network (str): CIDR presentation format. For example,
+        '192.168.1.0/24'.
+    :param fallback (str): If no address is found, return fallback.
+    :param fatal (boolean): If no address is found, fallback is not
+        set and fatal is True then exit(1).
+
+    """
+
+    def not_found_error_out():
+        log("No IP address found in network: %s" % network,
+            level=ERROR)
+        sys.exit(1)
+
+    if network is None:
+        if fallback is not None:
+            return fallback
+        else:
+            if fatal:
+                not_found_error_out()
+
+    _validate_cidr(network)
+    network = netaddr.IPNetwork(network)
+    for iface in netifaces.interfaces():
+        addresses = netifaces.ifaddresses(iface)
+        if network.version == 4 and netifaces.AF_INET in addresses:
+            addr = addresses[netifaces.AF_INET][0]['addr']
+            netmask = addresses[netifaces.AF_INET][0]['netmask']
+            cidr = netaddr.IPNetwork("%s/%s" % (addr, netmask))
+            if cidr in network:
+                return str(cidr.ip)
+        if network.version == 6 and netifaces.AF_INET6 in addresses:
+            for addr in addresses[netifaces.AF_INET6]:
+                if not addr['addr'].startswith('fe80'):
+                    cidr = netaddr.IPNetwork("%s/%s" % (addr['addr'],
+                                                        addr['netmask']))
+                    if cidr in network:
+                        return str(cidr.ip)
+
+    if fallback is not None:
+        return fallback
+
+    if fatal:
+        not_found_error_out()
+
+    return None
+
+
+def is_ipv6(address):
+    '''Determine whether provided address is IPv6 or not'''
+    try:
+        address = netaddr.IPAddress(address)
+    except netaddr.AddrFormatError:
+        # probably a hostname - so not an address at all!
+        return False
+    else:
+        return address.version == 6
+
+
+def is_address_in_network(network, address):
+    """
+    Determine whether the provided address is within a network range.
+
+    :param network (str): CIDR presentation format. For example,
+        '192.168.1.0/24'.
+    :param address: An individual IPv4 or IPv6 address without a net
+        mask or subnet prefix. For example, '192.168.1.1'.
+    :returns boolean: Flag indicating whether address is in network.
+    """
+    try:
+        network = netaddr.IPNetwork(network)
+    except (netaddr.core.AddrFormatError, ValueError):
+        raise ValueError("Network (%s) is not in CIDR presentation format" %
+                         network)
+    try:
+        address = netaddr.IPAddress(address)
+    except (netaddr.core.AddrFormatError, ValueError):
+        raise ValueError("Address (%s) is not in correct presentation format" %
+                         address)
+    if address in network:
+        return True
+    else:
+        return False
+
+
+def _get_for_address(address, key):
+    """Retrieve an attribute of or the physical interface that
+    the IP address provided could be bound to.
+
+    :param address (str): An individual IPv4 or IPv6 address without a net
+        mask or subnet prefix. For example, '192.168.1.1'.
+    :param key: 'iface' for the physical interface name or an attribute
+        of the configured interface, for example 'netmask'.
+    :returns str: Requested attribute or None if address is not bindable.
+    """
+    address = netaddr.IPAddress(address)
+    for iface in netifaces.interfaces():
+        addresses = netifaces.ifaddresses(iface)
+        if address.version == 4 and netifaces.AF_INET in addresses:
+            addr = addresses[netifaces.AF_INET][0]['addr']
+            netmask = addresses[netifaces.AF_INET][0]['netmask']
+            cidr = netaddr.IPNetwork("%s/%s" % (addr, netmask))
+            if address in cidr:
+                if key == 'iface':
+                    return iface
+                else:
+                    return addresses[netifaces.AF_INET][0][key]
+        if address.version == 6 and netifaces.AF_INET6 in addresses:
+            for addr in addresses[netifaces.AF_INET6]:
+                if not addr['addr'].startswith('fe80'):
+                    cidr = netaddr.IPNetwork("%s/%s" % (addr['addr'],
+                                                        addr['netmask']))
+                    if address in cidr:
+                        if key == 'iface':
+                            return iface
+                        else:
+                            return addr[key]
+    return None
+
+
+get_iface_for_address = partial(_get_for_address, key='iface')
+
+get_netmask_for_address = partial(_get_for_address, key='netmask')
 
=== added directory 'hooks/charmhelpers/contrib/openstack/amulet'
=== added file 'hooks/charmhelpers/contrib/openstack/amulet/__init__.py'
=== added file 'hooks/charmhelpers/contrib/openstack/amulet/deployment.py'
--- hooks/charmhelpers/contrib/openstack/amulet/deployment.py	1970-01-01 00:00:00 +0000
+++ hooks/charmhelpers/contrib/openstack/amulet/deployment.py	2014-07-29 13:07:23 +0000
@@ -0,0 +1,55 @@
+from charmhelpers.contrib.amulet.deployment import (
+    AmuletDeployment
+)
+
+
+class OpenStackAmuletDeployment(AmuletDeployment):
+    """This class inherits from AmuletDeployment and has additional support
+       that is specifically for use by OpenStack charms."""
+
+    def __init__(self, series=None, openstack=None, source=None):
+        """Initialize the deployment environment."""
+        super(OpenStackAmuletDeployment, self).__init__(series)
+        self.openstack = openstack
+        self.source = source
+
+    def _add_services(self, this_service, other_services):
+        """Add services to the deployment and set openstack-origin."""
+        super(OpenStackAmuletDeployment, self)._add_services(this_service,
+                                                             other_services)
+        name = 0
+        services = other_services
+        services.append(this_service)
+        use_source = ['mysql', 'mongodb', 'rabbitmq-server', 'ceph']
+
+        if self.openstack:
+            for svc in services:
+                if svc[name] not in use_source:
+                    config = {'openstack-origin': self.openstack}
+                    self.d.configure(svc[name], config)
+
+        if self.source:
+            for svc in services:
+                if svc[name] in use_source:
+                    config = {'source': self.source}
+                    self.d.configure(svc[name], config)
+
+    def _configure_services(self, configs):
+        """Configure all of the services."""
+        for service, config in configs.iteritems():
+            self.d.configure(service, config)
+
+    def _get_openstack_release(self):
+        """Return an integer representing the enum value of the openstack
+           release."""
+        self.precise_essex, self.precise_folsom, self.precise_grizzly, \
+            self.precise_havana, self.precise_icehouse, \
+            self.trusty_icehouse = range(6)
+        releases = {
+            ('precise', None): self.precise_essex,
+            ('precise', 'cloud:precise-folsom'): self.precise_folsom,
+            ('precise', 'cloud:precise-grizzly'): self.precise_grizzly,
+            ('precise', 'cloud:precise-havana'): self.precise_havana,
+            ('precise', 'cloud:precise-icehouse'): self.precise_icehouse,
+            ('trusty', None): self.trusty_icehouse}
+        return releases[(self.series, self.openstack)]
 
=== added file 'hooks/charmhelpers/contrib/openstack/amulet/utils.py'
--- hooks/charmhelpers/contrib/openstack/amulet/utils.py	1970-01-01 00:00:00 +0000
+++ hooks/charmhelpers/contrib/openstack/amulet/utils.py	2014-07-29 13:07:23 +0000
@@ -0,0 +1,209 @@
+import logging
+import os
+import time
+import urllib
+
+import glanceclient.v1.client as glance_client
+import keystoneclient.v2_0 as keystone_client
+import novaclient.v1_1.client as nova_client
+
+from charmhelpers.contrib.amulet.utils import (
+    AmuletUtils
+)
+
+DEBUG = logging.DEBUG
+ERROR = logging.ERROR
+
+
+class OpenStackAmuletUtils(AmuletUtils):
+    """This class inherits from AmuletUtils and has additional support
+       that is specifically for use by OpenStack charms."""
+
+    def __init__(self, log_level=ERROR):
+        """Initialize the deployment environment."""
+        super(OpenStackAmuletUtils, self).__init__(log_level)
+
+    def validate_endpoint_data(self, endpoints, admin_port, internal_port,
+                               public_port, expected):
+        """Validate actual endpoint data vs expected endpoint data. The ports
+           are used to find the matching endpoint."""
+        found = False
+        for ep in endpoints:
+            self.log.debug('endpoint: {}'.format(repr(ep)))
+            if admin_port in ep.adminurl and internal_port in ep.internalurl \
+               and public_port in ep.publicurl:
+                found = True
+                actual = {'id': ep.id,
+                          'region': ep.region,
+                          'adminurl': ep.adminurl,
+                          'internalurl': ep.internalurl,
+                          'publicurl': ep.publicurl,
+                          'service_id': ep.service_id}
+                ret = self._validate_dict_data(expected, actual)
+                if ret:
+                    return 'unexpected endpoint data - {}'.format(ret)
+
+        if not found:
+            return 'endpoint not found'
+
+    def validate_svc_catalog_endpoint_data(self, expected, actual):
+        """Validate a list of actual service catalog endpoints vs a list of
+           expected service catalog endpoints."""
+        self.log.debug('actual: {}'.format(repr(actual)))
+        for k, v in expected.iteritems():
+            if k in actual:
+                ret = self._validate_dict_data(expected[k][0], actual[k][0])
+                if ret:
+                    return self.endpoint_error(k, ret)
+            else:
+                return "endpoint {} does not exist".format(k)
+        return ret
+
+    def validate_tenant_data(self, expected, actual):
+        """Validate a list of actual tenant data vs list of expected tenant
+           data."""
+        self.log.debug('actual: {}'.format(repr(actual)))
+        for e in expected:
+            found = False
+            for act in actual:
+                a = {'enabled': act.enabled, 'description': act.description,
+                     'name': act.name, 'id': act.id}
+                if e['name'] == a['name']:
+                    found = True
+                    ret = self._validate_dict_data(e, a)
+                    if ret:
+                        return "unexpected tenant data - {}".format(ret)
+            if not found:
+                return "tenant {} does not exist".format(e['name'])
+        return ret
+
+    def validate_role_data(self, expected, actual):
+        """Validate a list of actual role data vs a list of expected role
+           data."""
+        self.log.debug('actual: {}'.format(repr(actual)))
+        for e in expected:
+            found = False
+            for act in actual:
+                a = {'name': act.name, 'id': act.id}
+                if e['name'] == a['name']:
+                    found = True
+                    ret = self._validate_dict_data(e, a)
+                    if ret:
+                        return "unexpected role data - {}".format(ret)
+            if not found:
+                return "role {} does not exist".format(e['name'])
+        return ret
+
+    def validate_user_data(self, expected, actual):
+        """Validate a list of actual user data vs a list of expected user
+           data."""
+        self.log.debug('actual: {}'.format(repr(actual)))
+        for e in expected:
+            found = False
+            for act in actual:
+                a = {'enabled': act.enabled, 'name': act.name,
+                     'email': act.email, 'tenantId': act.tenantId,
+                     'id': act.id}
+                if e['name'] == a['name']:
+                    found = True
+                    ret = self._validate_dict_data(e, a)
+                    if ret:
+                        return "unexpected user data - {}".format(ret)
+            if not found:
+                return "user {} does not exist".format(e['name'])
+        return ret
+
+    def validate_flavor_data(self, expected, actual):
+        """Validate a list of actual flavors vs a list of expected flavors."""
+        self.log.debug('actual: {}'.format(repr(actual)))
+        act = [a.name for a in actual]
+        return self._validate_list_data(expected, act)
+
+    def tenant_exists(self, keystone, tenant):
+        """Return True if tenant exists"""
+        return tenant in [t.name for t in keystone.tenants.list()]
+
+    def authenticate_keystone_admin(self, keystone_sentry, user, password,
+                                    tenant):
+        """Authenticates admin user with the keystone admin endpoint."""
+        service_ip = \
+            keystone_sentry.relation('shared-db',
+                                     'mysql:shared-db')['private-address']
+        ep = "http://{}:35357/v2.0".format(service_ip.strip().decode('utf-8'))
+        return keystone_client.Client(username=user, password=password,
+                                      tenant_name=tenant, auth_url=ep)
+
+    def authenticate_keystone_user(self, keystone, user, password, tenant):
+        """Authenticates a regular user with the keystone public endpoint."""
+        ep = keystone.service_catalog.url_for(service_type='identity',
+                                              endpoint_type='publicURL')
+        return keystone_client.Client(username=user, password=password,
+                                      tenant_name=tenant, auth_url=ep)
+
+    def authenticate_glance_admin(self, keystone):
+        """Authenticates admin user with glance."""
+        ep = keystone.service_catalog.url_for(service_type='image',
+                                              endpoint_type='adminURL')
+        return glance_client.Client(ep, token=keystone.auth_token)
+
+    def authenticate_nova_user(self, keystone, user, password, tenant):
+        """Authenticates a regular user with nova-api."""
+        ep = keystone.service_catalog.url_for(service_type='identity',
+                                              endpoint_type='publicURL')
+        return nova_client.Client(username=user, api_key=password,
+                                  project_id=tenant, auth_url=ep)
+
+    def create_cirros_image(self, glance, image_name):
+        """Download the latest cirros image and upload it to glance."""
+        http_proxy = os.getenv('AMULET_HTTP_PROXY')
+        self.log.debug('AMULET_HTTP_PROXY: {}'.format(http_proxy))
+        if http_proxy:
+            proxies = {'http': http_proxy}
+            opener = urllib.FancyURLopener(proxies)
+        else:
+            opener = urllib.FancyURLopener()
+
+        f = opener.open("http://download.cirros-cloud.net/version/released")
+        version = f.read().strip()
+        cirros_img = "tests/cirros-{}-x86_64-disk.img".format(version)
+
+        if not os.path.exists(cirros_img):
+            cirros_url = "http://{}/{}/{}".format("download.cirros-cloud.net",
+                                                  version, cirros_img)
+            opener.retrieve(cirros_url, cirros_img)
+        f.close()
+
+        with open(cirros_img) as f:
+            image = glance.images.create(name=image_name, is_public=True,
+                                         disk_format='qcow2',
+                                         container_format='bare', data=f)
+        return image
+
+    def delete_image(self, glance, image):
+        """Delete the specified image."""
+        glance.images.delete(image)
+
+    def create_instance(self, nova, image_name, instance_name, flavor):
+        """Create the specified instance."""
+        image = nova.images.find(name=image_name)
+        flavor = nova.flavors.find(name=flavor)
+        instance = nova.servers.create(name=instance_name, image=image,
+                                       flavor=flavor)
+
+        count = 1
+        status = instance.status
+        while status != 'ACTIVE' and count < 60:
+            time.sleep(3)
+            instance = nova.servers.get(instance.id)
+            status = instance.status
+            self.log.debug('instance status: {}'.format(status))
+            count += 1
+
+        if status == 'BUILD':
+            return None
+
+        return instance
+
+    def delete_instance(self, nova, instance):
+        """Delete the specified instance."""
+        nova.servers.delete(instance)
 
=== modified file 'hooks/charmhelpers/contrib/openstack/context.py'
--- hooks/charmhelpers/contrib/openstack/context.py	2014-05-19 11:38:09 +0000
+++ hooks/charmhelpers/contrib/openstack/context.py	2014-07-29 13:07:23 +0000
@@ -21,9 +21,11 @@
     relation_get,
     relation_ids,
     related_units,
+    relation_set,
     unit_get,
     unit_private_ip,
     ERROR,
+    INFO
 )
 
 from charmhelpers.contrib.hahelpers.cluster import (
@@ -42,6 +44,8 @@
     neutron_plugin_attribute,
 )
 
+from charmhelpers.contrib.network.ip import get_address_in_network
+
 CA_CERT_PATH = '/usr/local/share/ca-certificates/keystone_juju_ca_cert.crt'
 
 
@@ -134,8 +138,26 @@
                 'Missing required charm config options. '
                 '(database name and user)')
             raise OSContextError
+
         ctxt = {}
 
+        # NOTE(jamespage) if mysql charm provides a network upon which
+        # access to the database should be made, reconfigure relation
+        # with the service units local address and defer execution
+        access_network = relation_get('access-network')
+        if access_network is not None:
+            if self.relation_prefix is not None:
+                hostname_key = "{}_hostname".format(self.relation_prefix)
+            else:
+                hostname_key = "hostname"
+            access_hostname = get_address_in_network(access_network,
+                                                     unit_get('private-address'))
+            set_hostname = relation_get(attribute=hostname_key,
+                                        unit=local_unit())
+            if set_hostname != access_hostname:
+                relation_set(relation_settings={hostname_key: access_hostname})
+                return ctxt  # Defer any further hook execution for now....
+
         password_setting = 'password'
         if self.relation_prefix:
             password_setting = self.relation_prefix + '_password'
@@ -243,23 +265,31 @@
 
 
 class AMQPContext(OSContextGenerator):
-    interfaces = ['amqp']
 
-    def __init__(self, ssl_dir=None):
+    def __init__(self, ssl_dir=None, rel_name='amqp', relation_prefix=None):
         self.ssl_dir = ssl_dir
+        self.rel_name = rel_name
+        self.relation_prefix = relation_prefix
+        self.interfaces = [rel_name]
 
     def __call__(self):
         log('Generating template context for amqp')
         conf = config()
+        user_setting = 'rabbit-user'
+        vhost_setting = 'rabbit-vhost'
+        if self.relation_prefix:
+            user_setting = self.relation_prefix + '-rabbit-user'
+            vhost_setting = self.relation_prefix + '-rabbit-vhost'
+
         try:
-            username = conf['rabbit-user']
-            vhost = conf['rabbit-vhost']
+            username = conf[user_setting]
+            vhost = conf[vhost_setting]
         except KeyError as e:
             log('Could not generate shared_db context. '
                 'Missing required charm config options: %s.' % e)
             raise OSContextError
         ctxt = {}
-        for rid in relation_ids('amqp'):
+        for rid in relation_ids(self.rel_name):
             ha_vip_only = False
             for unit in related_units(rid):
                 if relation_get('clustered', rid=rid, unit=unit):
@@ -332,10 +362,12 @@
         use_syslog = str(config('use-syslog')).lower()
         for rid in relation_ids('ceph'):
             for unit in related_units(rid):
-                mon_hosts.append(relation_get('private-address', rid=rid,
-                                              unit=unit))
                 auth = relation_get('auth', rid=rid, unit=unit)
                 key = relation_get('key', rid=rid, unit=unit)
+                ceph_addr = \
+                    relation_get('ceph-public-address', rid=rid, unit=unit) or \
+                    relation_get('private-address', rid=rid, unit=unit)
+                mon_hosts.append(ceph_addr)
 
         ctxt = {
             'mon_hosts': ' '.join(mon_hosts),
@@ -369,7 +401,9 @@
 
         cluster_hosts = {}
         l_unit = local_unit().replace('/', '-')
-        cluster_hosts[l_unit] = unit_get('private-address')
+        cluster_hosts[l_unit] = \
+            get_address_in_network(config('os-internal-network'),
+                                   unit_get('private-address'))
 
         for rid in relation_ids('cluster'):
             for unit in related_units(rid):
@@ -418,12 +452,13 @@
     """
     Generates a context for an apache vhost configuration that configures
     HTTPS reverse proxying for one or many endpoints.  Generated context
-    looks something like:
-    {
-        'namespace': 'cinder',
-        'private_address': 'iscsi.mycinderhost.com',
-        'endpoints': [(8776, 8766), (8777, 8767)]
-    }
+    looks something like::
+
+        {
+            'namespace': 'cinder',
+            'private_address': 'iscsi.mycinderhost.com',
+            'endpoints': [(8776, 8766), (8777, 8767)]
+        }
 
     The endpoints list consists of a tuples mapping external ports
     to internal ports.
@@ -541,6 +576,26 @@
 
         return nvp_ctxt
 
+    def n1kv_ctxt(self):
+        driver = neutron_plugin_attribute(self.plugin, 'driver',
+                                          self.network_manager)
+        n1kv_config = neutron_plugin_attribute(self.plugin, 'config',
+                                               self.network_manager)
+        n1kv_ctxt = {
+            'core_plugin': driver,
+            'neutron_plugin': 'n1kv',
+            'neutron_security_groups': self.neutron_security_groups,
+            'local_ip': unit_private_ip(),
+            'config': n1kv_config,
+            'vsm_ip': config('n1kv-vsm-ip'),
+            'vsm_username': config('n1kv-vsm-username'),
+            'vsm_password': config('n1kv-vsm-password'),
+            'restrict_policy_profiles': config(
+                'n1kv_restrict_policy_profiles'),
+        }
+
+        return n1kv_ctxt
+
     def neutron_ctxt(self):
         if https():
             proto = 'https'
@@ -572,6 +627,8 @@
             ctxt.update(self.ovs_ctxt())
         elif self.plugin in ['nvp', 'nsx']:
             ctxt.update(self.nvp_ctxt())
+        elif self.plugin == 'n1kv':
+            ctxt.update(self.n1kv_ctxt())
 
         alchemy_flags = config('neutron-alchemy-flags')
         if alchemy_flags:
@@ -611,7 +668,7 @@
     The subordinate interface allows subordinates to export their
     configuration requirements to the principle for multiple config
     files and multiple serivces.  Ie, a subordinate that has interfaces
-    to both glance and nova may export to following yaml blob as json:
+    to both glance and nova may export to following yaml blob as json::
 
         glance:
             /etc/glance/glance-api.conf:
@@ -630,7 +687,8 @@
 
     It is then up to the principle charms to subscribe this context to
     the service+config file it is interestd in.  Configuration data will
-    be available in the template context, in glance's case, as:
+    be available in the template context, in glance's case, as::
+
         ctxt = {
             ... other context ...
             'subordinate_config': {
@@ -657,7 +715,7 @@
         self.interface = interface
 
     def __call__(self):
-        ctxt = {}
+        ctxt = {'sections': {}}
         for rid in relation_ids(self.interface):
             for unit in related_units(rid):
                 sub_config = relation_get('subordinate_configuration',
@@ -683,11 +741,26 @@
 
                     sub_config = sub_config[self.config_file]
                     for k, v in sub_config.iteritems():
-                        ctxt[k] = v
-
-        if not ctxt:
-            ctxt['sections'] = {}
-
+                        if k == 'sections':
+                            for section, config_dict in v.iteritems():
+                                log("adding section '%s'" % (section))
+                                ctxt[k][section] = config_dict
+                        else:
+                            ctxt[k] = v
+
+        log("%d section(s) found" % (len(ctxt['sections'])), level=INFO)
+
+        return ctxt
+
+
+class LogLevelContext(OSContextGenerator):
+
+    def __call__(self):
+        ctxt = {}
+        ctxt['debug'] = \
+            False if config('debug') is None else config('debug')
+        ctxt['verbose'] = \
+            False if config('verbose') is None else config('verbose')
         return ctxt
 
 
 
=== added file 'hooks/charmhelpers/contrib/openstack/ip.py'
--- hooks/charmhelpers/contrib/openstack/ip.py	1970-01-01 00:00:00 +0000
+++ hooks/charmhelpers/contrib/openstack/ip.py	2014-07-29 13:07:23 +0000
@@ -0,0 +1,75 @@
+from charmhelpers.core.hookenv import (
+    config,
+    unit_get,
+)
+
+from charmhelpers.contrib.network.ip import (
+    get_address_in_network,
+    is_address_in_network,
+    is_ipv6,
+)
+
+from charmhelpers.contrib.hahelpers.cluster import is_clustered
+
+PUBLIC = 'public'
+INTERNAL = 'int'
+ADMIN = 'admin'
+
+_address_map = {
+    PUBLIC: {
+        'config': 'os-public-network',
+        'fallback': 'public-address'
+    },
+    INTERNAL: {
+        'config': 'os-internal-network',
+        'fallback': 'private-address'
+    },
+    ADMIN: {
+        'config': 'os-admin-network',
+        'fallback': 'private-address'
+    }
+}
+
+
+def canonical_url(configs, endpoint_type=PUBLIC):
+    '''
+    Returns the correct HTTP URL to this host given the state of HTTPS
+    configuration, hacluster and charm configuration.
+
+    :configs OSTemplateRenderer: A config tempating object to inspect for
+        a complete https context.
+    :endpoint_type str: The endpoint type to resolve.
+
+    :returns str: Base URL for services on the current service unit.
+    '''
+    scheme = 'http'
+    if 'https' in configs.complete_contexts():
+        scheme = 'https'
+    address = resolve_address(endpoint_type)
+    if is_ipv6(address):
+        address = "[{}]".format(address)
+    return '%s://%s' % (scheme, address)
+
+
+def resolve_address(endpoint_type=PUBLIC):
+    resolved_address = None
+    if is_clustered():
+        if config(_address_map[endpoint_type]['config']) is None:
+            # Assume vip is simple and pass back directly
+            resolved_address = config('vip')
+        else:
+            for vip in config('vip').split():
+                if is_address_in_network(
+                        config(_address_map[endpoint_type]['config']),
+                        vip):
+                    resolved_address = vip
+    else:
+        resolved_address = get_address_in_network(
+            config(_address_map[endpoint_type]['config']),
+            unit_get(_address_map[endpoint_type]['fallback'])
+        )
+    if resolved_address is None:
+        raise ValueError('Unable to resolve a suitable IP address'
+                         ' based on charm state and configuration')
+    else:
+        return resolved_address
 
=== modified file 'hooks/charmhelpers/contrib/openstack/neutron.py'
--- hooks/charmhelpers/contrib/openstack/neutron.py	2014-05-19 11:38:09 +0000
+++ hooks/charmhelpers/contrib/openstack/neutron.py	2014-07-29 13:07:23 +0000
@@ -128,6 +128,20 @@
             'server_packages': ['neutron-server',
                                 'neutron-plugin-vmware'],
             'server_services': ['neutron-server']
+        },
+        'n1kv': {
+            'config': '/etc/neutron/plugins/cisco/cisco_plugins.ini',
+            'driver': 'neutron.plugins.cisco.network_plugin.PluginV2',
+            'contexts': [
+                context.SharedDBContext(user=config('neutron-database-user'),
+                                        database=config('neutron-database'),
+                                        relation_prefix='neutron',
+                                        ssl_dir=NEUTRON_CONF_DIR)],
+            'services': [],
+            'packages': [['neutron-plugin-cisco']],
+            'server_packages': ['neutron-server',
+                                'neutron-plugin-cisco'],
+            'server_services': ['neutron-server']
         }
     }
     if release >= 'icehouse':
 
=== modified file 'hooks/charmhelpers/contrib/openstack/templates/haproxy.cfg'
--- hooks/charmhelpers/contrib/openstack/templates/haproxy.cfg	2014-02-27 09:26:38 +0000
+++ hooks/charmhelpers/contrib/openstack/templates/haproxy.cfg	2014-07-29 13:07:23 +0000
@@ -27,7 +27,12 @@
 
 {% if units -%}
 {% for service, ports in service_ports.iteritems() -%}
-listen {{ service }} 0.0.0.0:{{ ports[0] }}
+listen {{ service }}_ipv4 0.0.0.0:{{ ports[0] }}
+    balance roundrobin
+    {% for unit, address in units.iteritems() -%}
+    server {{ unit }} {{ address }}:{{ ports[1] }} check
+    {% endfor %}
+listen {{ service }}_ipv6 :::{{ ports[0] }}
     balance roundrobin
     {% for unit, address in units.iteritems() -%}
     server {{ unit }} {{ address }}:{{ ports[1] }} check
 
=== modified file 'hooks/charmhelpers/contrib/openstack/templating.py'
--- hooks/charmhelpers/contrib/openstack/templating.py	2014-02-24 19:31:57 +0000
+++ hooks/charmhelpers/contrib/openstack/templating.py	2014-07-29 13:07:23 +0000
@@ -30,17 +30,17 @@
     loading dir.
 
     A charm may also ship a templates dir with this module
-    and it will be appended to the bottom of the search list, eg:
-    hooks/charmhelpers/contrib/openstack/templates.
-
-    :param templates_dir: str: Base template directory containing release
-                               sub-directories.
-    :param os_release   : str: OpenStack release codename to construct template
-                               loader.
-
-    :returns            : jinja2.ChoiceLoader constructed with a list of
-                          jinja2.FilesystemLoaders, ordered in descending
-                          order by OpenStack release.
+    and it will be appended to the bottom of the search list, eg::
+
+        hooks/charmhelpers/contrib/openstack/templates
+
+    :param templates_dir (str): Base template directory containing release
+        sub-directories.
+    :param os_release (str): OpenStack release codename to construct template
+        loader.
+    :returns: jinja2.ChoiceLoader constructed with a list of
+        jinja2.FilesystemLoaders, ordered in descending
+        order by OpenStack release.
     """
     tmpl_dirs = [(rel, os.path.join(templates_dir, rel))
                  for rel in OPENSTACK_CODENAMES.itervalues()]
@@ -111,7 +111,8 @@
     and ease the burden of managing config templates across multiple OpenStack
     releases.
 
-    Basic usage:
+    Basic usage::
+
         # import some common context generates from charmhelpers
         from charmhelpers.contrib.openstack import context
 
@@ -131,21 +132,19 @@
         # write out all registered configs
         configs.write_all()
 
-    Details:
+    **OpenStack Releases and template loading**
 
-    OpenStack Releases and template loading
-    ---------------------------------------
     When the object is instantiated, it is associated with a specific OS
     release.  This dictates how the template loader will be constructed.
 
     The constructed loader attempts to load the template from several places
     in the following order:
-        - from the most recent OS release-specific template dir (if one exists)
-        - the base templates_dir
-        - a template directory shipped in the charm with this helper file.
-
-
-    For the example above, '/tmp/templates' contains the following structure:
+    - from the most recent OS release-specific template dir (if one exists)
+    - the base templates_dir
+    - a template directory shipped in the charm with this helper file.
+
+    For the example above, '/tmp/templates' contains the following structure::
+
         /tmp/templates/nova.conf
         /tmp/templates/api-paste.ini
         /tmp/templates/grizzly/api-paste.ini
@@ -169,8 +168,8 @@
     $CHARM/hooks/charmhelpers/contrib/openstack/templates.  This allows
     us to ship common templates (haproxy, apache) with the helpers.
 
-    Context generators
-    ---------------------------------------
+    **Context generators**
+
     Context generators are used to generate template contexts during hook
     execution.  Doing so may require inspecting service relations, charm
     config, etc.  When registered, a config file is associated with a list
 
=== modified file 'hooks/charmhelpers/contrib/openstack/utils.py'
--- hooks/charmhelpers/contrib/openstack/utils.py	2014-05-19 11:38:09 +0000
+++ hooks/charmhelpers/contrib/openstack/utils.py	2014-07-29 13:07:23 +0000
@@ -3,7 +3,6 @@
 # Common python helper functions used for OpenStack charms.
 from collections import OrderedDict
 
-import apt_pkg as apt
 import subprocess
 import os
 import socket
@@ -41,7 +40,8 @@
     ('quantal', 'folsom'),
     ('raring', 'grizzly'),
     ('saucy', 'havana'),
-    ('trusty', 'icehouse')
+    ('trusty', 'icehouse'),
+    ('utopic', 'juno'),
 ])
 
 
@@ -52,6 +52,7 @@
     ('2013.1', 'grizzly'),
     ('2013.2', 'havana'),
     ('2014.1', 'icehouse'),
+    ('2014.2', 'juno'),
 ])
 
 # The ugly duckling
@@ -83,6 +84,8 @@
     '''Derive OpenStack release codename from a given installation source.'''
     ubuntu_rel = lsb_release()['DISTRIB_CODENAME']
     rel = ''
+    if src is None:
+        return rel
     if src in ['distro', 'distro-proposed']:
         try:
             rel = UBUNTU_OPENSTACK_RELEASE[ubuntu_rel]
@@ -130,6 +133,7 @@
 
 def get_os_codename_package(package, fatal=True):
     '''Derive OpenStack release codename from an installed package.'''
+    import apt_pkg as apt
     apt.init()
 
     # Tell apt to build an in-memory cache to prevent race conditions (if
@@ -187,7 +191,7 @@
     for version, cname in vers_map.iteritems():
         if cname == codename:
             return version
-    #e = "Could not determine OpenStack version for package: %s" % pkg
+    # e = "Could not determine OpenStack version for package: %s" % pkg
     # error_out(e)
 
 
@@ -273,6 +277,9 @@
             'icehouse': 'precise-updates/icehouse',
             'icehouse/updates': 'precise-updates/icehouse',
             'icehouse/proposed': 'precise-proposed/icehouse',
+            'juno': 'trusty-updates/juno',
+            'juno/updates': 'trusty-updates/juno',
+            'juno/proposed': 'trusty-proposed/juno',
         }
 
         try:
@@ -320,6 +327,7 @@
 
     """
 
+    import apt_pkg as apt
     src = config('openstack-origin')
     cur_vers = get_os_version_package(package)
     available_vers = get_os_version_install_source(src)
 
=== modified file 'hooks/charmhelpers/contrib/storage/linux/ceph.py'
--- hooks/charmhelpers/contrib/storage/linux/ceph.py	2014-03-27 11:02:24 +0000
+++ hooks/charmhelpers/contrib/storage/linux/ceph.py	2014-07-29 13:07:23 +0000
@@ -303,7 +303,7 @@
                         blk_device, fstype, system_services=[]):
     """
     NOTE: This function must only be called from a single service unit for
-          the same rbd_img otherwise data loss will occur.
+    the same rbd_img otherwise data loss will occur.
 
     Ensures given pool and RBD image exists, is mapped to a block device,
     and the device is formatted and mounted at the given mount_point.
 
=== modified file 'hooks/charmhelpers/contrib/storage/linux/utils.py'
--- hooks/charmhelpers/contrib/storage/linux/utils.py	2014-05-19 11:38:09 +0000
+++ hooks/charmhelpers/contrib/storage/linux/utils.py	2014-07-29 13:07:23 +0000
@@ -37,6 +37,7 @@
     check_call(['dd', 'if=/dev/zero', 'of=%s' % (block_device),
                 'bs=512', 'count=100', 'seek=%s' % (gpt_end)])
 
+
 def is_device_mounted(device):
     '''Given a device path, return True if that device is mounted, and False
     if it isn't.
 
=== added file 'hooks/charmhelpers/core/fstab.py'
--- hooks/charmhelpers/core/fstab.py	1970-01-01 00:00:00 +0000
+++ hooks/charmhelpers/core/fstab.py	2014-07-29 13:07:23 +0000
@@ -0,0 +1,116 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+
+__author__ = 'Jorge Niedbalski R. <[e-mail]>'
+
+import os
+
+
+class Fstab(file):
+    """This class extends file in order to implement a file reader/writer
+    for file `/etc/fstab`
+    """
+
+    class Entry(object):
+        """Entry class represents a non-comment line on the `/etc/fstab` file
+        """
+        def __init__(self, device, mountpoint, filesystem,
+                     options, d=0, p=0):
+            self.device = device
+            self.mountpoint = mountpoint
+            self.filesystem = filesystem
+
+            if not options:
+                options = "defaults"
+
+            self.options = options
+            self.d = d
+            self.p = p
+
+        def __eq__(self, o):
+            return str(self) == str(o)
+
+        def __str__(self):
+            return "{} {} {} {} {} {}".format(self.device,
+                                              self.mountpoint,
+                                              self.filesystem,
+                                              self.options,
+                                              self.d,
+                                              self.p)
+
+    DEFAULT_PATH = os.path.join(os.path.sep, 'etc', 'fstab')
+
+    def __init__(self, path=None):
+        if path:
+            self._path = path
+        else:
+            self._path = self.DEFAULT_PATH
+        file.__init__(self, self._path, 'r+')
+
+    def _hydrate_entry(self, line):
+        # NOTE: use split with no arguments to split on any
+        #       whitespace including tabs
+        return Fstab.Entry(*filter(
+            lambda x: x not in ('', None),
+            line.strip("\n").split()))
+
+    @property
+    def entries(self):
+        self.seek(0)
+        for line in self.readlines():
+            try:
+                if not line.startswith("#"):
+                    yield self._hydrate_entry(line)
+            except ValueError:
+                pass
+
+    def get_entry_by_attr(self, attr, value):
+        for entry in self.entries:
+            e_attr = getattr(entry, attr)
+            if e_attr == value:
+                return entry
+        return None
+
+    def add_entry(self, entry):
+        if self.get_entry_by_attr('device', entry.device):
+            return False
+
+        self.write(str(entry) + '\n')
+        self.truncate()
+        return entry
+
+    def remove_entry(self, entry):
+        self.seek(0)
+
+        lines = self.readlines()
+
+        found = False
+        for index, line in enumerate(lines):
+            if not line.startswith("#"):
+                if self._hydrate_entry(line) == entry:
+                    found = True
+                    break
+
+        if not found:
+            return False
+
+        lines.remove(line)
+
+        self.seek(0)
+        self.write(''.join(lines))
+        self.truncate()
+        return True
+
+    @classmethod
+    def remove_by_mountpoint(cls, mountpoint, path=None):
+        fstab = cls(path=path)
+        entry = fstab.get_entry_by_attr('mountpoint', mountpoint)
+        if entry:
+            return fstab.remove_entry(entry)
+        return False
+
+    @classmethod
+    def add(cls, device, mountpoint, filesystem, options=None, path=None):
+        return cls(path=path).add_entry(Fstab.Entry(device,
+                                                    mountpoint, filesystem,
+                                                    options=options))
 
=== modified file 'hooks/charmhelpers/core/hookenv.py'
--- hooks/charmhelpers/core/hookenv.py	2014-05-19 11:38:09 +0000
+++ hooks/charmhelpers/core/hookenv.py	2014-07-29 13:07:23 +0000
@@ -25,7 +25,7 @@
 def cached(func):
     """Cache return values for multiple executions of func + args
 
-    For example:
+    For example::
 
         @cached
         def unit_get(attribute):
@@ -445,18 +445,19 @@
 class Hooks(object):
     """A convenient handler for hook functions.
 
-    Example:
+    Example::
+
         hooks = Hooks()
 
         # register a hook, taking its name from the function name
         @hooks.hook()
         def install():
-            ...
+            pass  # your code here
 
         # register a hook, providing a custom hook name
         @hooks.hook("config-changed")
         def config_changed():
-            ...
+            pass  # your code here
 
         if __name__ == "__main__":
             # execute a hook based on the name the program is called by
 
=== modified file 'hooks/charmhelpers/core/host.py'
--- hooks/charmhelpers/core/host.py	2014-05-19 11:38:09 +0000
+++ hooks/charmhelpers/core/host.py	2014-07-29 13:07:23 +0000
@@ -12,11 +12,11 @@
 import string
 import subprocess
 import hashlib
-import apt_pkg
 
 from collections import OrderedDict
 
 from hookenv import log
+from fstab import Fstab
 
 
 def service_start(service_name):
@@ -35,7 +35,8 @@
 
 
 def service_reload(service_name, restart_on_failure=False):
-    """Reload a system service, optionally falling back to restart if reload fails"""
+    """Reload a system service, optionally falling back to restart if
+    reload fails"""
     service_result = service('reload', service_name)
     if not service_result and restart_on_failure:
         service_result = service('restart', service_name)
@@ -144,7 +145,19 @@
         target.write(content)
 
 
-def mount(device, mountpoint, options=None, persist=False):
+def fstab_remove(mp):
+    """Remove the given mountpoint entry from /etc/fstab
+    """
+    return Fstab.remove_by_mountpoint(mp)
+
+
+def fstab_add(dev, mp, fs, options=None):
+    """Adds the given device entry to the /etc/fstab file
+    """
+    return Fstab.add(dev, mp, fs, options=options)
+
+
+def mount(device, mountpoint, options=None, persist=False, filesystem="ext3"):
     """Mount a filesystem at a particular mountpoint"""
     cmd_args = ['mount']
     if options is not None:
@@ -155,9 +168,9 @@
     except subprocess.CalledProcessError, e:
         log('Error mounting {} at {}\n{}'.format(device, mountpoint, e.output))
         return False
+
     if persist:
-        # TODO: update fstab
-        pass
+        return fstab_add(device, mountpoint, filesystem, options=options)
     return True
 
 
@@ -169,9 +182,9 @@
     except subprocess.CalledProcessError, e:
         log('Error unmounting {}\n{}'.format(mountpoint, e.output))
         return False
+
     if persist:
-        # TODO: update fstab
-        pass
+        return fstab_remove(mountpoint)
     return True
 
 
@@ -198,13 +211,13 @@
 def restart_on_change(restart_map, stopstart=False):
     """Restart services based on configuration files changing
 
-    This function is used a decorator, for example
+    This function is used a decorator, for example::
 
         @restart_on_change({
             '/etc/ceph/ceph.conf': [ 'cinder-api', 'cinder-volume' ]
             })
         def ceph_client_changed():
-            ...
+            pass  # your code here
 
     In this example, the cinder-api and cinder-volume services
     would be restarted if /etc/ceph/ceph.conf is changed by the
@@ -300,12 +313,19 @@
 
 def cmp_pkgrevno(package, revno, pkgcache=None):
     '''Compare supplied revno with the revno of the installed package
-       1 => Installed revno is greater than supplied arg
-       0 => Installed revno is the same as supplied arg
-      -1 => Installed revno is less than supplied arg
+
+    *  1 => Installed revno is greater than supplied arg
+    *  0 => Installed revno is the same as supplied arg
+    * -1 => Installed revno is less than supplied arg
+
     '''
+    import apt_pkg
     if not pkgcache:
         apt_pkg.init()
+        # Force Apt to build its cache in memory. That way we avoid race
+        # conditions with other applications building the cache in the same
+        # place.
+        apt_pkg.config.set("Dir::Cache::pkgcache", "")
         pkgcache = apt_pkg.Cache()
     pkg = pkgcache[package]
     return apt_pkg.version_compare(pkg.current_ver.ver_str, revno)
 
=== modified file 'hooks/charmhelpers/fetch/__init__.py'
--- hooks/charmhelpers/fetch/__init__.py	2014-05-19 11:38:09 +0000
+++ hooks/charmhelpers/fetch/__init__.py	2014-07-29 13:07:23 +0000
@@ -13,7 +13,6 @@
     config,
     log,
 )
-import apt_pkg
 import os
 
 
@@ -56,6 +55,15 @@
     'icehouse/proposed': 'precise-proposed/icehouse',
     'precise-icehouse/proposed': 'precise-proposed/icehouse',
     'precise-proposed/icehouse': 'precise-proposed/icehouse',
+    # Juno
+    'juno': 'trusty-updates/juno',
+    'trusty-juno': 'trusty-updates/juno',
+    'trusty-juno/updates': 'trusty-updates/juno',
+    'trusty-updates/juno': 'trusty-updates/juno',
+    'juno/proposed': 'trusty-proposed/juno',
+    'juno/proposed': 'trusty-proposed/juno',
+    'trusty-juno/proposed': 'trusty-proposed/juno',
+    'trusty-proposed/juno': 'trusty-proposed/juno',
 }
 
 # The order of this list is very important. Handlers should be listed in from
@@ -108,6 +116,7 @@
 
 def filter_installed_packages(packages):
     """Returns a list of packages that require installation"""
+    import apt_pkg
     apt_pkg.init()
 
     # Tell apt to build an in-memory cache to prevent race conditions (if
@@ -226,31 +235,39 @@
                       sources_var='install_sources',
                       keys_var='install_keys'):
     """
-    Configure multiple sources from charm configuration
+    Configure multiple sources from charm configuration.
+
+    The lists are encoded as yaml fragments in the configuration.
+    The frament needs to be included as a string.
 
     Example config:
-        install_sources:
+        install_sources: |
           - "ppa:foo"
           - "http://example.com/repo precise main"
-        install_keys:
+        install_keys: |
           - null
           - "a1b2c3d4"
 
     Note that 'null' (a.k.a. None) should not be quoted.
     """
-    sources = safe_load(config(sources_var))
-    keys = config(keys_var)
-    if keys is not None:
-        keys = safe_load(keys)
-    if isinstance(sources, basestring) and (
-            keys is None or isinstance(keys, basestring)):
-        add_source(sources, keys)
+    sources = safe_load((config(sources_var) or '').strip()) or []
+    keys = safe_load((config(keys_var) or '').strip()) or None
+
+    if isinstance(sources, basestring):
+        sources = [sources]
+
+    if keys is None:
+        for source in sources:
+            add_source(source, None)
     else:
-        if not len(sources) == len(keys):
-            msg = 'Install sources and keys lists are different lengths'
-            raise SourceConfigError(msg)
-        for src_num in range(len(sources)):
-            add_source(sources[src_num], keys[src_num])
+        if isinstance(keys, basestring):
+            keys = [keys]
+
+        if len(sources) != len(keys):
+            raise SourceConfigError(
+                'Install sources and keys lists are different lengths')
+        for source, key in zip(sources, keys):
+            add_source(source, key)
     if update:
         apt_update(fatal=True)
 
 
=== modified file 'hooks/charmhelpers/fetch/bzrurl.py'
--- hooks/charmhelpers/fetch/bzrurl.py	2013-11-06 03:48:26 +0000
+++ hooks/charmhelpers/fetch/bzrurl.py	2014-07-29 13:07:23 +0000
@@ -39,7 +39,8 @@
     def install(self, source):
         url_parts = self.parse_url(source)
         branch_name = url_parts.path.strip("/").split("/")[-1]
-        dest_dir = os.path.join(os.environ.get('CHARM_DIR'), "fetched", branch_name)
+        dest_dir = os.path.join(os.environ.get('CHARM_DIR'), "fetched",
+                                branch_name)
         if not os.path.exists(dest_dir):
             mkdir(dest_dir, perms=0755)
         try:
 
=== added symlink 'hooks/neutron-api-relation-broken'
=== target is u'nova_cc_hooks.py'
=== added symlink 'hooks/neutron-api-relation-changed'
=== target is u'nova_cc_hooks.py'
=== added symlink 'hooks/neutron-api-relation-departed'
=== target is u'nova_cc_hooks.py'
=== added symlink 'hooks/neutron-api-relation-joined'
=== target is u'nova_cc_hooks.py'
=== modified file 'hooks/nova_cc_context.py'
--- hooks/nova_cc_context.py	2014-06-17 10:01:21 +0000
+++ hooks/nova_cc_context.py	2014-07-29 13:07:23 +0000
@@ -1,7 +1,7 @@
 
 from charmhelpers.core.hookenv import (
     config, relation_ids, relation_set, log, ERROR,
-    unit_get)
+    unit_get, related_units, relation_get)
 
 from charmhelpers.fetch import apt_install, filter_installed_packages
 from charmhelpers.contrib.openstack import context, neutron, utils
@@ -14,6 +14,17 @@
 )
 
 
+def context_complete(ctxt):
+    _missing = []
+    for k, v in ctxt.iteritems():
+        if v is None or v == '':
+            _missing.append(k)
+    if _missing:
+        log('Missing required data: %s' % ' '.join(_missing), level='INFO')
+        return False
+    return True
+
+
 class ApacheSSLContext(context.ApacheSSLContext):
 
     interfaces = ['https']
@@ -27,6 +38,26 @@
         return super(ApacheSSLContext, self).__call__()
 
 
+class NeutronAPIContext(context.OSContextGenerator):
+
+    def __call__(self):
+        log('Generating template context from neutron api relation')
+        ctxt = {}
+        for rid in relation_ids('neutron-api'):
+            for unit in related_units(rid):
+                rdata = relation_get(rid=rid, unit=unit)
+                ctxt = {
+                    'neutron_url': rdata.get('neutron-url'),
+                    'neutron_plugin': rdata.get('neutron-plugin'),
+                    'neutron_security_groups':
+                    rdata.get('neutron-security-groups'),
+                    'network_manager': 'neutron',
+                }
+                if context_complete(ctxt):
+                    return ctxt
+        return {}
+
+
 class VolumeServiceContext(context.OSContextGenerator):
     interfaces = []
 
 
=== modified file 'hooks/nova_cc_hooks.py'
--- hooks/nova_cc_hooks.py	2014-04-11 16:41:42 +0000
+++ hooks/nova_cc_hooks.py	2014-07-29 13:07:23 +0000
@@ -19,12 +19,15 @@
     relation_get,
     relation_ids,
     relation_set,
+    related_units,
     open_port,
     unit_get,
 )
 
 from charmhelpers.core.host import (
-    restart_on_change
+    restart_on_change,
+    service_running,
+    service_stop,
 )
 
 from charmhelpers.fetch import (
@@ -41,6 +44,10 @@
     neutron_plugin_attribute,
 )
 
+from nova_cc_context import (
+    NeutronAPIContext
+)
+
 from nova_cc_utils import (
     api_port,
     auth_token_config,
@@ -54,8 +61,8 @@
     save_script_rc,
     ssh_compute_add,
     ssh_compute_remove,
-    ssh_known_hosts_b64,
-    ssh_authorized_keys_b64,
+    ssh_known_hosts_lines,
+    ssh_authorized_keys_lines,
     register_configs,
     restart_map,
     volume_service,
@@ -63,11 +70,12 @@
     NOVA_CONF,
     QUANTUM_CONF,
     NEUTRON_CONF,
-    QUANTUM_API_PASTE
+    QUANTUM_API_PASTE,
+    service_guard,
+    guard_map,
 )
 
 from charmhelpers.contrib.hahelpers.cluster import (
-    canonical_url,
     eligible_leader,
     get_hacluster_config,
     is_leader,
@@ -75,6 +83,16 @@
 
 from charmhelpers.payload.execd import execd_preinstall
 
+from charmhelpers.contrib.openstack.ip import (
+    canonical_url,
+    PUBLIC, INTERNAL, ADMIN
+)
+
+from charmhelpers.contrib.network.ip import (
+    get_iface_for_address,
+    get_netmask_for_address
+)
+
 hooks = Hooks()
 CONFIGS = register_configs()
 
@@ -96,6 +114,8 @@
 
 
 @hooks.hook('config-changed')
+@service_guard(guard_map(), CONFIGS,
+               active=config('service-guard'))
 @restart_on_change(restart_map(), stopstart=True)
 def config_changed():
     global CONFIGS
@@ -104,6 +124,8 @@
     save_script_rc()
     configure_https()
     CONFIGS.write_all()
+    for r_id in relation_ids('identity-service'):
+        identity_joined(rid=r_id)
 
 
 @hooks.hook('amqp-relation-joined')
@@ -114,16 +136,19 @@
 
 @hooks.hook('amqp-relation-changed')
 @hooks.hook('amqp-relation-departed')
+@service_guard(guard_map(), CONFIGS,
+               active=config('service-guard'))
 @restart_on_change(restart_map())
 def amqp_changed():
     if 'amqp' not in CONFIGS.complete_contexts():
         log('amqp relation incomplete. Peer not ready?')
         return
     CONFIGS.write(NOVA_CONF)
-    if network_manager() == 'quantum':
-        CONFIGS.write(QUANTUM_CONF)
-    if network_manager() == 'neutron':
-        CONFIGS.write(NEUTRON_CONF)
+    if not is_relation_made('neutron-api'):
+        if network_manager() == 'quantum':
+            CONFIGS.write(QUANTUM_CONF)
+        if network_manager() == 'neutron':
+            CONFIGS.write(NEUTRON_CONF)
 
 
 @hooks.hook('shared-db-relation-joined')
@@ -171,6 +196,8 @@
 
 
 @hooks.hook('shared-db-relation-changed')
+@service_guard(guard_map(), CONFIGS,
+               active=config('service-guard'))
 @restart_on_change(restart_map())
 def db_changed():
     if 'shared-db' not in CONFIGS.complete_contexts():
@@ -186,6 +213,8 @@
 
 
 @hooks.hook('pgsql-nova-db-relation-changed')
+@service_guard(guard_map(), CONFIGS,
+               active=config('service-guard'))
 @restart_on_change(restart_map())
 def postgresql_nova_db_changed():
     if 'pgsql-nova-db' not in CONFIGS.complete_contexts():
@@ -201,6 +230,8 @@
 
 
 @hooks.hook('pgsql-neutron-db-relation-changed')
+@service_guard(guard_map(), CONFIGS,
+               active=config('service-guard'))
 @restart_on_change(restart_map())
 def postgresql_neutron_db_changed():
     if network_manager() in ['neutron', 'quantum']:
@@ -210,6 +241,8 @@
 
 
 @hooks.hook('image-service-relation-changed')
+@service_guard(guard_map(), CONFIGS,
+               active=config('service-guard'))
 @restart_on_change(restart_map())
 def image_service_changed():
     if 'image-service' not in CONFIGS.complete_contexts():
@@ -223,11 +256,17 @@
 def identity_joined(rid=None):
     if not eligible_leader(CLUSTER_RES):
         return
-    base_url = canonical_url(CONFIGS)
-    relation_set(relation_id=rid, **determine_endpoints(base_url))
+    public_url = canonical_url(CONFIGS, PUBLIC)
+    internal_url = canonical_url(CONFIGS, INTERNAL)
+    admin_url = canonical_url(CONFIGS, ADMIN)
+    relation_set(relation_id=rid, **determine_endpoints(public_url,
+                                                        internal_url,
+                                                        admin_url))
 
 
 @hooks.hook('identity-service-relation-changed')
+@service_guard(guard_map(), CONFIGS,
+               active=config('service-guard'))
 @restart_on_change(restart_map())
 def identity_changed():
     if 'identity-service' not in CONFIGS.complete_contexts():
@@ -235,20 +274,24 @@
         return
     CONFIGS.write('/etc/nova/api-paste.ini')
     CONFIGS.write(NOVA_CONF)
-    if network_manager() == 'quantum':
-        CONFIGS.write(QUANTUM_API_PASTE)
-        CONFIGS.write(QUANTUM_CONF)
-        save_novarc()
-    if network_manager() == 'neutron':
-        CONFIGS.write(NEUTRON_CONF)
+    if not is_relation_made('neutron-api'):
+        if network_manager() == 'quantum':
+            CONFIGS.write(QUANTUM_API_PASTE)
+            CONFIGS.write(QUANTUM_CONF)
+            save_novarc()
+        if network_manager() == 'neutron':
+            CONFIGS.write(NEUTRON_CONF)
     [compute_joined(rid) for rid in relation_ids('cloud-compute')]
     [quantum_joined(rid) for rid in relation_ids('quantum-network-service')]
     [nova_vmware_relation_joined(rid) for rid in relation_ids('nova-vmware')]
+    [neutron_api_relation_joined(rid) for rid in relation_ids('neutron-api')]
     configure_https()
 
 
 @hooks.hook('nova-volume-service-relation-joined',
             'cinder-volume-service-relation-joined')
+@service_guard(guard_map(), CONFIGS,
+               active=config('service-guard'))
 @restart_on_change(restart_map())
 def volume_joined():
     CONFIGS.write(NOVA_CONF)
@@ -293,6 +336,33 @@
         out.write('export OS_REGION_NAME=%s\n' % config('region'))
 
 
+def neutron_settings():
+    neutron_settings = {}
+    if is_relation_made('neutron-api', 'neutron-plugin'):
+        neutron_api_info = NeutronAPIContext()()
+        neutron_settings.update({
+            # XXX: Rename these relations settings?
+            'quantum_plugin': neutron_api_info['neutron_plugin'],
+            'region': config('region'),
+            'quantum_security_groups':
+            neutron_api_info['neutron_security_groups'],
+            'quantum_url': neutron_api_info['neutron_url'],
+        })
+    else:
+        neutron_settings.update({
+            # XXX: Rename these relations settings?
+            'quantum_plugin': neutron_plugin(),
+            'region': config('region'),
+            'quantum_security_groups': config('quantum-security-groups'),
+            'quantum_url': "{}:{}".format(canonical_url(CONFIGS, INTERNAL),
+                                          str(api_port('neutron-server'))),
+        })
+    neutron_url = urlparse(neutron_settings['quantum_url'])
+    neutron_settings['quantum_host'] = neutron_url.hostname
+    neutron_settings['quantum_port'] = neutron_url.port
+    return neutron_settings
+
+
 def keystone_compute_settings():
     ks_auth_config = _auth_config()
     rel_settings = {}
@@ -300,20 +370,10 @@
     if network_manager() in ['quantum', 'neutron']:
         if ks_auth_config:
             rel_settings.update(ks_auth_config)
-
-        rel_settings.update({
-            # XXX: Rename these relations settings?
-            'quantum_plugin': neutron_plugin(),
-            'region': config('region'),
-            'quantum_security_groups': config('quantum-security-groups'),
-            'quantum_url': (canonical_url(CONFIGS) + ':' +
-                            str(api_port('neutron-server'))),
-        })
-
+        rel_settings.update(neutron_settings())
     ks_ca = keystone_ca_cert_b64()
     if ks_auth_config and ks_ca:
         rel_settings['ca_cert'] = ks_ca
-
     return rel_settings
 
 
@@ -328,7 +388,6 @@
         # this may not even be needed.
         'ec2_host': unit_get('private-address'),
     }
-
     # update relation setting if we're attempting to restart remote
     # services
     if remote_restart:
@@ -339,21 +398,63 @@
 
 
 @hooks.hook('cloud-compute-relation-changed')
-def compute_changed():
-    migration_auth = relation_get('migration_auth_type')
-    if migration_auth == 'ssh':
-        key = relation_get('ssh_public_key')
+def compute_changed(rid=None, unit=None):
+    rel_settings = relation_get(rid=rid, unit=unit)
+    if 'migration_auth_type' not in rel_settings:
+        return
+    if rel_settings['migration_auth_type'] == 'ssh':
+        key = rel_settings.get('ssh_public_key')
         if not key:
             log('SSH migration set but peer did not publish key.')
             return
-        ssh_compute_add(key)
-        relation_set(known_hosts=ssh_known_hosts_b64(),
-                     authorized_keys=ssh_authorized_keys_b64())
-    if relation_get('nova_ssh_public_key'):
-        key = relation_get('nova_ssh_public_key')
-        ssh_compute_add(key, user='nova')
-        relation_set(nova_known_hosts=ssh_known_hosts_b64(user='nova'),
-                     nova_authorized_keys=ssh_authorized_keys_b64(user='nova'))
+        ssh_compute_add(key, rid=rid, unit=unit)
+        index = 0
+        for line in ssh_known_hosts_lines(unit=unit):
+            relation_set(
+                relation_id=rid,
+                relation_settings={
+                    'known_hosts_{}'.format(index): line})
+            index += 1
+        relation_set(relation_id=rid, known_hosts_max_index=index)
+        index = 0
+        for line in ssh_authorized_keys_lines(unit=unit):
+            relation_set(
+                relation_id=rid,
+                relation_settings={
+                    'authorized_keys_{}'.format(index): line})
+            index += 1
+        relation_set(relation_id=rid, authorized_keys_max_index=index)
+    if 'nova_ssh_public_key' not in rel_settings:
+        return
+    if rel_settings['nova_ssh_public_key']:
+        ssh_compute_add(rel_settings['nova_ssh_public_key'],
+                        rid=rid, unit=unit, user='nova')
+        index = 0
+        for line in ssh_known_hosts_lines(unit=unit, user='nova'):
+            relation_set(
+                relation_id=rid,
+                relation_settings={
+                    '{}_known_hosts_{}'.format(
+                        'nova',
+                        index): line})
+            index += 1
+        relation_set(
+            relation_id=rid,
+            relation_settings={
+                '{}_known_hosts_max_index'.format('nova'): index})
+        index = 0
+        for line in ssh_authorized_keys_lines(unit=unit, user='nova'):
+            relation_set(
+                relation_id=rid,
+                relation_settings={
+                    '{}_authorized_keys_{}'.format(
+                        'nova',
+                        index): line})
+            index += 1
+        relation_set(
+            relation_id=rid,
+            relation_settings={
+                '{}_authorized_keys_max_index'.format('nova'): index})
 
 
 @hooks.hook('cloud-compute-relation-departed')
@@ -367,15 +468,7 @@
     if not eligible_leader(CLUSTER_RES):
         return
 
-    url = canonical_url(CONFIGS) + ':9696'
-    # XXX: Can we rename to neutron_*?
-    rel_settings = {
-        'quantum_host': urlparse(url).hostname,
-        'quantum_url': url,
-        'quantum_port': 9696,
-        'quantum_plugin': neutron_plugin(),
-        'region': config('region')
-    }
+    rel_settings = neutron_settings()
 
     # inform quantum about local keystone auth config
     ks_auth_config = _auth_config()
@@ -385,12 +478,13 @@
     ks_ca = keystone_ca_cert_b64()
     if ks_auth_config and ks_ca:
         rel_settings['ca_cert'] = ks_ca
-
     relation_set(relation_id=rid, **rel_settings)
 
 
 @hooks.hook('cluster-relation-changed',
             'cluster-relation-departed')
+@service_guard(guard_map(), CONFIGS,
+               active=config('service-guard'))
 @restart_on_change(restart_map(), stopstart=True)
 def cluster_changed():
     CONFIGS.write_all()
@@ -400,15 +494,28 @@
 def ha_joined():
     config = get_hacluster_config()
     resources = {
-        'res_nova_vip': 'ocf:heartbeat:IPaddr2',
         'res_nova_haproxy': 'lsb:haproxy',
     }
-    vip_params = 'params ip="%s" cidr_netmask="%s" nic="%s"' % \
-                 (config['vip'], config['vip_cidr'], config['vip_iface'])
     resource_params = {
-        'res_nova_vip': vip_params,
         'res_nova_haproxy': 'op monitor interval="5s"'
     }
+    vip_group = []
+    for vip in config['vip'].split():
+        iface = get_iface_for_address(vip)
+        if iface is not None:
+            vip_key = 'res_nova_{}_vip'.format(iface)
+            resources[vip_key] = 'ocf:heartbeat:IPaddr2'
+            resource_params[vip_key] = (
+                'params ip="{vip}" cidr_netmask="{netmask}"'
+                ' nic="{iface}"'.format(vip=vip,
+                                        iface=iface,
+                                        netmask=get_netmask_for_address(vip))
+            )
+            vip_group.append(vip_key)
+
+    if len(vip_group) > 1:
+        relation_set(groups={'grp_nova_vips': ' '.join(vip_group)})
+
     init_services = {
         'res_nova_haproxy': 'haproxy'
     }
@@ -447,6 +554,8 @@
             'pgsql-nova-db-relation-broken',
             'pgsql-neutron-db-relation-broken',
             'quantum-network-service-relation-broken')
+@service_guard(guard_map(), CONFIGS,
+               active=config('service-guard'))
 def relation_broken():
     CONFIGS.write_all()
 
@@ -480,13 +589,15 @@
         rel_settings.update({
             'quantum_plugin': neutron_plugin(),
             'quantum_security_groups': config('quantum-security-groups'),
-            'quantum_url': (canonical_url(CONFIGS) + ':' +
-                            str(api_port('neutron-server')))})
+            'quantum_url': "{}:{}".format(canonical_url(CONFIGS, INTERNAL),
+                                          str(api_port('neutron-server')))})
 
     relation_set(relation_id=rid, **rel_settings)
 
 
 @hooks.hook('nova-vmware-relation-changed')
+@service_guard(guard_map(), CONFIGS,
+               active=config('service-guard'))
 @restart_on_change(restart_map())
 def nova_vmware_relation_changed():
     CONFIGS.write('/etc/nova/nova.conf')
@@ -498,6 +609,49 @@
         amqp_joined(relation_id=r_id)
     for r_id in relation_ids('identity-service'):
         identity_joined(rid=r_id)
+    for r_id in relation_ids('cloud-compute'):
+        for unit in related_units(r_id):
+            compute_changed(r_id, unit)
+
+
[e-mail]('neutron-api-relation-joined')
+def neutron_api_relation_joined(rid=None):
+    with open('/etc/init/neutron-server.override', 'wb') as out:
+        out.write('manual\n')
+    if os.path.isfile(NEUTRON_CONF):
+        os.rename(NEUTRON_CONF, NEUTRON_CONF + '_unused')
+    if service_running('neutron-server'):
+        service_stop('neutron-server')
+    for id_rid in relation_ids('identity-service'):
+        identity_joined(rid=id_rid)
+    nova_url = canonical_url(CONFIGS, INTERNAL) + ":8774/v2"
+    relation_set(relation_id=rid, nova_url=nova_url)
+
+
[e-mail]('neutron-api-relation-changed')
+@service_guard(guard_map(), CONFIGS,
+               active=config('service-guard'))
+@restart_on_change(restart_map())
+def neutron_api_relation_changed():
+    CONFIGS.write(NOVA_CONF)
+    for rid in relation_ids('cloud-compute'):
+        compute_joined(rid=rid)
+    for rid in relation_ids('quantum-network-service'):
+        quantum_joined(rid=rid)
+
+
[e-mail]('neutron-api-relation-broken')
+@service_guard(guard_map(), CONFIGS,
+               active=config('service-guard'))
+@restart_on_change(restart_map())
+def neutron_api_relation_broken():
+    if os.path.isfile('/etc/init/neutron-server.override'):
+        os.remove('/etc/init/neutron-server.override')
+    CONFIGS.write_all()
+    for rid in relation_ids('cloud-compute'):
+        compute_joined(rid=rid)
+    for rid in relation_ids('quantum-network-service'):
+        quantum_joined(rid=rid)
 
 
 def main():
 
=== modified file 'hooks/nova_cc_utils.py'
--- hooks/nova_cc_utils.py	2014-05-21 10:03:01 +0000
+++ hooks/nova_cc_utils.py	2014-07-29 13:07:23 +0000
@@ -33,20 +33,22 @@
     relation_get,
     relation_ids,
     remote_unit,
+    is_relation_made,
     INFO,
     ERROR,
 )
 
 from charmhelpers.core.host import (
-    service_start
+    service_start,
+    service_stop,
+    service_running
 )
 
-
 import nova_cc_context
 
 TEMPLATES = 'templates/'
 
-CLUSTER_RES = 'res_nova_vip'
+CLUSTER_RES = 'grp_nova_vips'
 
 # removed from original: charm-helper-sh
 BASE_PACKAGES = [
@@ -106,8 +108,7 @@
                      context.SyslogContext(),
                      nova_cc_context.HAProxyContext(),
                      nova_cc_context.IdentityServiceContext(),
-                     nova_cc_context.VolumeServiceContext(),
-                     nova_cc_context.NeutronCCContext()],
+                     nova_cc_context.VolumeServiceContext()],
     }),
     (NOVA_API_PASTE, {
         'services': [s for s in BASE_SERVICES if 'api' in s],
@@ -188,39 +189,47 @@
 
     net_manager = network_manager()
 
-    # pop out irrelevant resources from the OrderedDict (easier than adding
-    # them late)
-    if net_manager != 'quantum':
-        [resource_map.pop(k) for k in list(resource_map.iterkeys())
-         if 'quantum' in k]
-    if net_manager != 'neutron':
-        [resource_map.pop(k) for k in list(resource_map.iterkeys())
-         if 'neutron' in k]
-
     if os.path.exists('/etc/apache2/conf-available'):
         resource_map.pop(APACHE_CONF)
     else:
         resource_map.pop(APACHE_24_CONF)
 
-    # add neutron plugin requirements. nova-c-c only needs the neutron-server
-    # associated with configs, not the plugin agent.
-    if net_manager in ['quantum', 'neutron']:
-        plugin = neutron_plugin()
-        if plugin:
-            conf = neutron_plugin_attribute(plugin, 'config', net_manager)
-            ctxts = (neutron_plugin_attribute(plugin, 'contexts', net_manager)
-                     or [])
-            services = neutron_plugin_attribute(plugin, 'server_services',
-                                                net_manager)
-            resource_map[conf] = {}
-            resource_map[conf]['services'] = services
-            resource_map[conf]['contexts'] = ctxts
-            resource_map[conf]['contexts'].append(
-                nova_cc_context.NeutronCCContext())
+    if is_relation_made('neutron-api'):
+        [resource_map.pop(k) for k in list(resource_map.iterkeys())
+         if 'quantum' in k or 'neutron' in k]
+        resource_map[NOVA_CONF]['contexts'].append(
+            nova_cc_context.NeutronAPIContext())
+    else:
+        resource_map[NOVA_CONF]['contexts'].append(
+            nova_cc_context.NeutronCCContext())
+        # pop out irrelevant resources from the OrderedDict (easier than adding
+        # them late)
+        if net_manager != 'quantum':
+            [resource_map.pop(k) for k in list(resource_map.iterkeys())
+             if 'quantum' in k]
+        if net_manager != 'neutron':
+            [resource_map.pop(k) for k in list(resource_map.iterkeys())
+             if 'neutron' in k]
+        # add neutron plugin requirements. nova-c-c only needs the
+        # neutron-server associated with configs, not the plugin agent.
+        if net_manager in ['quantum', 'neutron']:
+            plugin = neutron_plugin()
+            if plugin:
+                conf = neutron_plugin_attribute(plugin, 'config', net_manager)
+                ctxts = (neutron_plugin_attribute(plugin, 'contexts',
+                                                  net_manager)
+                         or [])
+                services = neutron_plugin_attribute(plugin, 'server_services',
+                                                    net_manager)
+                resource_map[conf] = {}
+                resource_map[conf]['services'] = services
+                resource_map[conf]['contexts'] = ctxts
+                resource_map[conf]['contexts'].append(
+                    nova_cc_context.NeutronCCContext())
 
-            # update for postgres
-            resource_map[conf]['contexts'].append(
-                nova_cc_context.NeutronPostgresqlDBContext())
+                # update for postgres
+                resource_map[conf]['contexts'].append(
+                    nova_cc_context.NeutronPostgresqlDBContext())
 
     # nova-conductor for releases >= G.
     if os_release('nova-common') not in ['essex', 'folsom']:
@@ -235,6 +244,7 @@
         for s in vmware_ctxt['services']:
             if s not in resource_map[NOVA_CONF]['services']:
                 resource_map[NOVA_CONF]['services'].append(s)
+
     return resource_map
 
 
@@ -509,8 +519,11 @@
         return b64encode(_in.read())
 
 
-def ssh_directory_for_unit(user=None):
-    remote_service = remote_unit().split('/')[0]
+def ssh_directory_for_unit(unit=None, user=None):
+    if unit:
+        remote_service = unit.split('/')[0]
+    else:
+        remote_service = remote_unit().split('/')[0]
     if user:
         remote_service = "{}_{}".format(remote_service, user)
     _dir = os.path.join(NOVA_SSH_DIR, remote_service)
@@ -524,29 +537,29 @@
     return _dir
 
 
-def known_hosts(user=None):
-    return os.path.join(ssh_directory_for_unit(user), 'known_hosts')
-
-
-def authorized_keys(user=None):
-    return os.path.join(ssh_directory_for_unit(user), 'authorized_keys')
-
-
-def ssh_known_host_key(host, user=None):
-    cmd = ['ssh-keygen', '-f', known_hosts(user), '-H', '-F', host]
+def known_hosts(unit=None, user=None):
+    return os.path.join(ssh_directory_for_unit(unit, user), 'known_hosts')
+
+
+def authorized_keys(unit=None, user=None):
+    return os.path.join(ssh_directory_for_unit(unit, user), 'authorized_keys')
+
+
+def ssh_known_host_key(host, unit=None, user=None):
+    cmd = ['ssh-keygen', '-f', known_hosts(unit, user), '-H', '-F', host]
     try:
         return subprocess.check_output(cmd).strip()
     except subprocess.CalledProcessError:
         return None
 
 
-def remove_known_host(host, user=None):
+def remove_known_host(host, unit=None, user=None):
     log('Removing SSH known host entry for compute host at %s' % host)
-    cmd = ['ssh-keygen', '-f', known_hosts(user), '-R', host]
+    cmd = ['ssh-keygen', '-f', known_hosts(unit, user), '-R', host]
     subprocess.check_call(cmd)
 
 
-def add_known_host(host, user=None):
+def add_known_host(host, unit=None, user=None):
     '''Add variations of host to a known hosts file.'''
     cmd = ['ssh-keyscan', '-H', '-t', 'rsa', host]
     try:
@@ -555,34 +568,37 @@
         log('Could not obtain SSH host key from %s' % host, level=ERROR)
         raise e
 
-    current_key = ssh_known_host_key(host, user)
+    current_key = ssh_known_host_key(host, unit, user)
     if current_key:
         if remote_key == current_key:
             log('Known host key for compute host %s up to date.' % host)
             return
         else:
-            remove_known_host(host, user)
+            remove_known_host(host, unit, user)
 
     log('Adding SSH host key to known hosts for compute node at %s.' % host)
-    with open(known_hosts(user), 'a') as out:
+    with open(known_hosts(unit, user), 'a') as out:
         out.write(remote_key + '\n')
 
 
-def ssh_authorized_key_exists(public_key, user=None):
-    with open(authorized_keys(user)) as keys:
+def ssh_authorized_key_exists(public_key, unit=None, user=None):
+    with open(authorized_keys(unit, user)) as keys:
         return (' %s ' % public_key) in keys.read()
 
 
-def add_authorized_key(public_key, user=None):
-    with open(authorized_keys(user), 'a') as keys:
+def add_authorized_key(public_key, unit=None, user=None):
+    with open(authorized_keys(unit, user), 'a') as keys:
         keys.write(public_key + '\n')
 
 
-def ssh_compute_add(public_key, user=None):
+def ssh_compute_add(public_key, rid=None, unit=None, user=None):
     # If remote compute node hands us a hostname, ensure we have a
     # known hosts entry for its IP, hostname and FQDN.
-    private_address = relation_get('private-address')
+    private_address = relation_get(rid=rid, unit=unit,
+                                   attribute='private-address')
     hosts = [private_address]
+    if relation_get('hostname'):
+        hosts.append(relation_get('hostname'))
 
     if not is_ip(private_address):
         hosts.append(get_host_ip(private_address))
@@ -593,31 +609,41 @@
         hosts.append(hn.split('.')[0])
 
     for host in list(set(hosts)):
-        if not ssh_known_host_key(host, user):
-            add_known_host(host, user)
+        if not ssh_known_host_key(host, unit, user):
+            add_known_host(host, unit, user)
 
-    if not ssh_authorized_key_exists(public_key, user):
+    if not ssh_authorized_key_exists(public_key, unit, user):
         log('Saving SSH authorized key for compute host at %s.' %
             private_address)
-        add_authorized_key(public_key, user)
-
-
-def ssh_known_hosts_b64(user=None):
-    with open(known_hosts(user)) as hosts:
-        return b64encode(hosts.read())
-
-
-def ssh_authorized_keys_b64(user=None):
-    with open(authorized_keys(user)) as keys:
-        return b64encode(keys.read())
-
-
-def ssh_compute_remove(public_key, user=None):
-    if not (os.path.isfile(authorized_keys(user)) or
-            os.path.isfile(known_hosts(user))):
+        add_authorized_key(public_key, unit, user)
+
+
+def ssh_known_hosts_lines(unit=None, user=None):
+    known_hosts_list = []
+
+    with open(known_hosts(unit, user)) as hosts:
+        for hosts_line in hosts:
+            if hosts_line.rstrip():
+                known_hosts_list.append(hosts_line.rstrip())
+    return(known_hosts_list)
+
+
+def ssh_authorized_keys_lines(unit=None, user=None):
+    authorized_keys_list = []
+
+    with open(authorized_keys(unit, user)) as keys:
+        for authkey_line in keys:
+            if authkey_line.rstrip():
+                authorized_keys_list.append(authkey_line.rstrip())
+    return(authorized_keys_list)
+
+
+def ssh_compute_remove(public_key, unit=None, user=None):
+    if not (os.path.isfile(authorized_keys(unit, user)) or
+            os.path.isfile(known_hosts(unit, user))):
         return
 
-    with open(authorized_keys(user)) as _keys:
+    with open(authorized_keys(unit, user)) as _keys:
         keys = [k.strip() for k in _keys.readlines()]
 
     if public_key not in keys:
@@ -625,67 +651,101 @@
 
     [keys.remove(key) for key in keys if key == public_key]
 
-    with open(authorized_keys(user), 'w') as _keys:
+    with open(authorized_keys(unit, user), 'w') as _keys:
         keys = '\n'.join(keys)
         if not keys.endswith('\n'):
             keys += '\n'
         _keys.write(keys)
 
 
-def determine_endpoints(url):
+def determine_endpoints(public_url, internal_url, admin_url):
     '''Generates a dictionary containing all relevant endpoints to be
     passed to keystone as relation settings.'''
     region = config('region')
     os_rel = os_release('nova-common')
 
     if os_rel >= 'grizzly':
-        nova_url = ('%s:%s/v2/$(tenant_id)s' %
-                    (url, api_port('nova-api-os-compute')))
+        nova_public_url = ('%s:%s/v2/$(tenant_id)s' %
+                           (public_url, api_port('nova-api-os-compute')))
+        nova_internal_url = ('%s:%s/v2/$(tenant_id)s' %
+                             (internal_url, api_port('nova-api-os-compute')))
+        nova_admin_url = ('%s:%s/v2/$(tenant_id)s' %
+                          (admin_url, api_port('nova-api-os-compute')))
     else:
-        nova_url = ('%s:%s/v1.1/$(tenant_id)s' %
-                    (url, api_port('nova-api-os-compute')))
-    ec2_url = '%s:%s/services/Cloud' % (url, api_port('nova-api-ec2'))
-    nova_volume_url = ('%s:%s/v1/$(tenant_id)s' %
-                       (url, api_port('nova-api-os-compute')))
-    neutron_url = '%s:%s' % (url, api_port('neutron-server'))
-    s3_url = '%s:%s' % (url, api_port('nova-objectstore'))
+        nova_public_url = ('%s:%s/v1.1/$(tenant_id)s' %
+                           (public_url, api_port('nova-api-os-compute')))
+        nova_internal_url = ('%s:%s/v1.1/$(tenant_id)s' %
+                             (internal_url, api_port('nova-api-os-compute')))
+        nova_admin_url = ('%s:%s/v1.1/$(tenant_id)s' %
+                          (admin_url, api_port('nova-api-os-compute')))
+
+    ec2_public_url = '%s:%s/services/Cloud' % (
+        public_url, api_port('nova-api-ec2'))
+    ec2_internal_url = '%s:%s/services/Cloud' % (
+        internal_url, api_port('nova-api-ec2'))
+    ec2_admin_url = '%s:%s/services/Cloud' % (admin_url,
+                                              api_port('nova-api-ec2'))
+
+    nova_volume_public_url = ('%s:%s/v1/$(tenant_id)s' %
+                              (public_url, api_port('nova-api-os-compute')))
+    nova_volume_internal_url = ('%s:%s/v1/$(tenant_id)s' %
+                                (internal_url,
+                                 api_port('nova-api-os-compute')))
+    nova_volume_admin_url = ('%s:%s/v1/$(tenant_id)s' %
+                             (admin_url, api_port('nova-api-os-compute')))
+
+    neutron_public_url = '%s:%s' % (public_url, api_port('neutron-server'))
+    neutron_internal_url = '%s:%s' % (internal_url, api_port('neutron-server'))
+    neutron_admin_url = '%s:%s' % (admin_url, api_port('neutron-server'))
+
+    s3_public_url = '%s:%s' % (public_url, api_port('nova-objectstore'))
+    s3_internal_url = '%s:%s' % (internal_url, api_port('nova-objectstore'))
+    s3_admin_url = '%s:%s' % (admin_url, api_port('nova-objectstore'))
 
     # the base endpoints
     endpoints = {
         'nova_service': 'nova',
         'nova_region': region,
-        'nova_public_url': nova_url,
-        'nova_admin_url': nova_url,
-        'nova_internal_url': nova_url,
+        'nova_public_url': nova_public_url,
+        'nova_admin_url': nova_admin_url,
+        'nova_internal_url': nova_internal_url,
         'ec2_service': 'ec2',
         'ec2_region': region,
-        'ec2_public_url': ec2_url,
-        'ec2_admin_url': ec2_url,
-        'ec2_internal_url': ec2_url,
+        'ec2_public_url': ec2_public_url,
+        'ec2_admin_url': ec2_admin_url,
+        'ec2_internal_url': ec2_internal_url,
         's3_service': 's3',
         's3_region': region,
-        's3_public_url': s3_url,
-        's3_admin_url': s3_url,
-        's3_internal_url': s3_url,
+        's3_public_url': s3_public_url,
+        's3_admin_url': s3_admin_url,
+        's3_internal_url': s3_internal_url,
     }
 
     if relation_ids('nova-volume-service'):
         endpoints.update({
             'nova-volume_service': 'nova-volume',
             'nova-volume_region': region,
-            'nova-volume_public_url': nova_volume_url,
-            'nova-volume_admin_url': nova_volume_url,
-            'nova-volume_internal_url': nova_volume_url,
+            'nova-volume_public_url': nova_volume_public_url,
+            'nova-volume_admin_url': nova_volume_admin_url,
+            'nova-volume_internal_url': nova_volume_internal_url,
         })
 
     # XXX: Keep these relations named quantum_*??
-    if network_manager() in ['quantum', 'neutron']:
+    if is_relation_made('neutron-api'):
+        endpoints.update({
+            'quantum_service': None,
+            'quantum_region': None,
+            'quantum_public_url': None,
+            'quantum_admin_url': None,
+            'quantum_internal_url': None,
+        })
+    elif network_manager() in ['quantum', 'neutron']:
         endpoints.update({
             'quantum_service': 'quantum',
             'quantum_region': region,
-            'quantum_public_url': neutron_url,
-            'quantum_admin_url': neutron_url,
-            'quantum_internal_url': neutron_url,
+            'quantum_public_url': neutron_public_url,
+            'quantum_admin_url': neutron_admin_url,
+            'quantum_internal_url': neutron_internal_url,
         })
 
     return endpoints
@@ -695,3 +755,58 @@
     # quantum-plugin config setting can be safely overriden
     # as we only supported OVS in G/neutron
     return config('neutron-plugin') or config('quantum-plugin')
+
+
+def guard_map():
+    '''Map of services and required interfaces that must be present before
+    the service should be allowed to start'''
+    gmap = {}
+    nova_services = deepcopy(BASE_SERVICES)
+    if os_release('nova-common') not in ['essex', 'folsom']:
+        nova_services.append('nova-conductor')
+
+    nova_interfaces = ['identity-service', 'amqp']
+    if relation_ids('pgsql-nova-db'):
+        nova_interfaces.append('pgsql-nova-db')
+    else:
+        nova_interfaces.append('shared-db')
+
+    for svc in nova_services:
+        gmap[svc] = nova_interfaces
+
+    net_manager = network_manager()
+    if net_manager in ['neutron', 'quantum']:
+        neutron_interfaces = ['identity-service', 'amqp']
+        if relation_ids('pgsql-neutron-db'):
+            neutron_interfaces.append('pgsql-neutron-db')
+        else:
+            neutron_interfaces.append('shared-db')
+        if network_manager() == 'quantum':
+            gmap['quantum-server'] = neutron_interfaces
+        else:
+            gmap['neutron-server'] = neutron_interfaces
+
+    return gmap
+
+
+def service_guard(guard_map, contexts, active=False):
+    '''Inhibit services in guard_map from running unless
+    required interfaces are found complete in contexts.'''
+    def wrap(f):
+        def wrapped_f(*args):
+            if active is True:
+                incomplete_services = []
+                for svc in guard_map:
+                    for interface in guard_map[svc]:
+                        if interface not in contexts.complete_contexts():
+                            incomplete_services.append(svc)
+                f(*args)
+                for svc in incomplete_services:
+                    if service_running(svc):
+                        log('Service {} has unfulfilled '
+                            'interface requirements, stopping.'.format(svc))
+                        service_stop(svc)
+            else:
+                f(*args)
+        return wrapped_f
+    return wrap
 
=== modified file 'metadata.yaml'
--- metadata.yaml	2014-03-31 11:56:09 +0000
+++ metadata.yaml	2014-07-29 13:07:23 +0000
@@ -30,6 +30,8 @@
     interface: nova-volume
   quantum-network-service:
     interface: quantum
+  neutron-api:
+    interface: neutron-api
   ha:
     interface: hacluster
     scope: container
 
=== modified file 'revision'
--- revision	2014-04-16 08:25:14 +0000
+++ revision	2014-07-29 13:07:23 +0000
@@ -1,1 +1,1 @@
-315
+500
 
=== added directory 'tests'
=== added file 'tests/00-setup'
--- tests/00-setup	1970-01-01 00:00:00 +0000
+++ tests/00-setup	2014-07-29 13:07:23 +0000
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+set -ex
+
+sudo add-apt-repository --yes ppa:juju/stable
+sudo apt-get update --yes
+sudo apt-get install --yes python-amulet
+sudo apt-get install --yes python-glanceclient
+sudo apt-get install --yes python-keystoneclient
+sudo apt-get install --yes python-novaclient
 
=== added file 'tests/10-basic-precise-essex'
--- tests/10-basic-precise-essex	1970-01-01 00:00:00 +0000
+++ tests/10-basic-precise-essex	2014-07-29 13:07:23 +0000
@@ -0,0 +1,10 @@
+#!/usr/bin/python
+
+"""Amulet tests on a basic nova cloud controller deployment on
+   precise-essex."""
+
+from basic_deployment import NovaCCBasicDeployment
+
+if __name__ == '__main__':
+    deployment = NovaCCBasicDeployment(series='precise')
+    deployment.run_tests()
 
=== added file 'tests/11-basic-precise-folsom'
--- tests/11-basic-precise-folsom	1970-01-01 00:00:00 +0000
+++ tests/11-basic-precise-folsom	2014-07-29 13:07:23 +0000
@@ -0,0 +1,18 @@
+#!/usr/bin/python
+
+"""Amulet tests on a basic nova cloud controller deployment on
+   precise-folsom."""
+
+import amulet
+from basic_deployment import NovaCCBasicDeployment
+
+if __name__ == '__main__':
+    # NOTE(coreycb): Skipping failing test until resolved. 'nova-manage db sync'
+    #                fails in shared-db-relation-changed (only fails on folsom)
+    message = "Skipping failing test until resolved"
+    amulet.raise_status(amulet.SKIP, msg=message)
+
+    deployment = NovaCCBasicDeployment(series='precise',
+                                       openstack='cloud:precise-folsom',
+                                       source='cloud:precise-updates/folsom')
+    deployment.run_tests()
 
=== added file 'tests/12-basic-precise-grizzly'
--- tests/12-basic-precise-grizzly	1970-01-01 00:00:00 +0000
+++ tests/12-basic-precise-grizzly	2014-07-29 13:07:23 +0000
@@ -0,0 +1,12 @@
+#!/usr/bin/python
+
+"""Amulet tests on a basic nova cloud controller deployment on
+   precise-grizzly."""
+
+from basic_deployment import NovaCCBasicDeployment
+
+if __name__ == '__main__':
+    deployment = NovaCCBasicDeployment(series='precise',
+                                       openstack='cloud:precise-grizzly',
+                                       source='cloud:precise-updates/grizzly')
+    deployment.run_tests()
 
=== added file 'tests/13-basic-precise-havana'
--- tests/13-basic-precise-havana	1970-01-01 00:00:00 +0000
+++ tests/13-basic-precise-havana	2014-07-29 13:07:23 +0000
@@ -0,0 +1,12 @@
+#!/usr/bin/python
+
+"""Amulet tests on a basic nova cloud controller deployment on
+   precise-havana."""
+
+from basic_deployment import NovaCCBasicDeployment
+
+if __name__ == '__main__':
+    deployment = NovaCCBasicDeployment(series='precise',
+                                       openstack='cloud:precise-havana',
+                                       source='cloud:precise-updates/havana')
+    deployment.run_tests()
 
=== added file 'tests/14-basic-precise-icehouse'
--- tests/14-basic-precise-icehouse	1970-01-01 00:00:00 +0000
+++ tests/14-basic-precise-icehouse	2014-07-29 13:07:23 +0000
@@ -0,0 +1,12 @@
+#!/usr/bin/python
+
+"""Amulet tests on a basic nova cloud controller deployment on
+   precise-icehouse."""
+
+from basic_deployment import NovaCCBasicDeployment
+
+if __name__ == '__main__':
+    deployment = NovaCCBasicDeployment(series='precise',
+                                       openstack='cloud:precise-icehouse',
+                                       source='cloud:precise-updates/icehouse')
+    deployment.run_tests()
 
=== added file 'tests/15-basic-trusty-icehouse'
--- tests/15-basic-trusty-icehouse	1970-01-01 00:00:00 +0000
+++ tests/15-basic-trusty-icehouse	2014-07-29 13:07:23 +0000
@@ -0,0 +1,10 @@
+#!/usr/bin/python
+
+"""Amulet tests on a basic nova cloud controller deployment on
+   trusty-icehouse."""
+
+from basic_deployment import NovaCCBasicDeployment
+
+if __name__ == '__main__':
+    deployment = NovaCCBasicDeployment(series='trusty')
+    deployment.run_tests()
 
=== added file 'tests/README'
--- tests/README	1970-01-01 00:00:00 +0000
+++ tests/README	2014-07-29 13:07:23 +0000
@@ -0,0 +1,47 @@
+This directory provides Amulet tests that focus on verification of Nova Cloud
+Controller deployments.
+
+If you use a web proxy server to access the web, you'll need to set the
+AMULET_HTTP_PROXY environment variable to the http URL of the proxy server.
+
+The following examples demonstrate different ways that tests can be executed.
+All examples are run from the charm's root directory.
+
+  * To run all tests (starting with 00-setup):
+
+      make test
+
+  * To run a specific test module (or modules):
+
+      juju test -v -p AMULET_HTTP_PROXY 15-basic-trusty-icehouse
+
+  * To run a specific test module (or modules), and keep the environment
+    deployed after a failure:
+
+      juju test --set-e -v -p AMULET_HTTP_PROXY 15-basic-trusty-icehouse
+
+  * To re-run a test module against an already deployed environment (one
+    that was deployed by a previous call to 'juju test --set-e'):
+
+      ./tests/15-basic-trusty-icehouse
+
+For debugging and test development purposes, all code should be idempotent.
+In other words, the code should have the ability to be re-run without changing
+the results beyond the initial run.  This enables editing and re-running of a
+test module against an already deployed environment, as described above.
+
+Manual debugging tips:
+
+  * Set the following env vars before using the OpenStack CLI as admin:
+      export OS_AUTH_URL=http://`juju-deployer -f keystone 2>&1 | tail -n 1`:5000/v2.0
+      export OS_TENANT_NAME=admin
+      export OS_USERNAME=admin
+      export OS_PASSWORD=openstack
+      export OS_REGION_NAME=RegionOne
+
+  * Set the following env vars before using the OpenStack CLI as demoUser:
+      export OS_AUTH_URL=http://`juju-deployer -f keystone 2>&1 | tail -n 1`:5000/v2.0
+      export OS_TENANT_NAME=demoTenant
+      export OS_USERNAME=demoUser
+      export OS_PASSWORD=password
+      export OS_REGION_NAME=RegionOne
 
=== added file 'tests/basic_deployment.py'
--- tests/basic_deployment.py	1970-01-01 00:00:00 +0000
+++ tests/basic_deployment.py	2014-07-29 13:07:23 +0000
@@ -0,0 +1,520 @@
+#!/usr/bin/python
+
+import amulet
+
+from charmhelpers.contrib.openstack.amulet.deployment import (
+    OpenStackAmuletDeployment
+)
+
+from charmhelpers.contrib.openstack.amulet.utils import (
+    OpenStackAmuletUtils,
+    DEBUG, # flake8: noqa
+    ERROR
+)
+
+# Use DEBUG to turn on debug logging
+u = OpenStackAmuletUtils(ERROR)
+
+
+class NovaCCBasicDeployment(OpenStackAmuletDeployment):
+    """Amulet tests on a basic nova cloud controller deployment."""
+
+    def __init__(self, series=None, openstack=None, source=None):
+        """Deploy the entire test environment."""
+        super(NovaCCBasicDeployment, self).__init__(series, openstack, source)
+        self._add_services()
+        self._add_relations()
+        self._configure_services()
+        self._deploy()
+        self._initialize_tests()
+
+    def _add_services(self):
+        """Add the service that we're testing, including the number of units,
+           where nova-cloud-controller is local, and the other charms are from
+           the charm store."""
+        this_service = ('nova-cloud-controller', 1)
+        other_services = [('mysql', 1), ('rabbitmq-server', 1),
+                          ('nova-compute', 2), ('keystone', 1), ('glance', 1)]
+        super(NovaCCBasicDeployment, self)._add_services(this_service,
+                                                         other_services)
+
+    def _add_relations(self):
+        """Add all of the relations for the services."""
+        relations = {
+          'nova-cloud-controller:shared-db': 'mysql:shared-db',
+          'nova-cloud-controller:identity-service': 'keystone:identity-service',
+          'nova-cloud-controller:amqp': 'rabbitmq-server:amqp',
+          'nova-cloud-controller:cloud-compute': 'nova-compute:cloud-compute',
+          'nova-cloud-controller:image-service': 'glance:image-service',
+          'nova-compute:image-service': 'glance:image-service',
+          'nova-compute:shared-db': 'mysql:shared-db',
+          'nova-compute:amqp': 'rabbitmq-server:amqp',
+          'keystone:shared-db': 'mysql:shared-db',
+          'glance:identity-service': 'keystone:identity-service',
+          'glance:shared-db': 'mysql:shared-db',
+          'glance:amqp': 'rabbitmq-server:amqp'
+        }
+        super(NovaCCBasicDeployment, self)._add_relations(relations)
+
+    def _configure_services(self):
+        """Configure all of the services."""
+        keystone_config = {'admin-password': 'openstack',
+                           'admin-token': 'ubuntutesting'}
+        configs = {'keystone': keystone_config}
+        super(NovaCCBasicDeployment, self)._configure_services(configs)
+
+    def _initialize_tests(self):
+        """Perform final initialization before tests get run."""
+        # Access the sentries for inspecting service units
+        self.mysql_sentry = self.d.sentry.unit['mysql/0']
+        self.keystone_sentry = self.d.sentry.unit['keystone/0']
+        self.rabbitmq_sentry = self.d.sentry.unit['rabbitmq-server/0']
+        self.nova_cc_sentry = self.d.sentry.unit['nova-cloud-controller/0']
+        self.nova_compute_sentry = self.d.sentry.unit['nova-compute/0']
+        self.glance_sentry = self.d.sentry.unit['glance/0']
+
+        # Authenticate admin with keystone
+        self.keystone = u.authenticate_keystone_admin(self.keystone_sentry,
+                                                      user='admin',
+                                                      password='openstack',
+                                                      tenant='admin')
+
+        # Authenticate admin with glance endpoint
+        self.glance = u.authenticate_glance_admin(self.keystone)
+
+        # Create a demo tenant/role/user
+        self.demo_tenant = 'demoTenant'
+        self.demo_role = 'demoRole'
+        self.demo_user = 'demoUser'
+        if not u.tenant_exists(self.keystone, self.demo_tenant):
+            tenant = self.keystone.tenants.create(tenant_name=self.demo_tenant,
+                                                  description='demo tenant',
+                                                  enabled=True)
+            self.keystone.roles.create(name=self.demo_role)
+            self.keystone.users.create(name=self.demo_user,
+                                       password='password',
+                                       tenant_id=tenant.id,
+                                       email='[e-mail]')
+
+        # Authenticate demo user with keystone
+        self.keystone_demo = \
+            u.authenticate_keystone_user(self.keystone, user=self.demo_user,
+                                         password='password',
+                                         tenant=self.demo_tenant)
+
+        # Authenticate demo user with nova-api
+        self.nova_demo = u.authenticate_nova_user(self.keystone,
+                                                  user=self.demo_user,
+                                                  password='password',
+                                                  tenant=self.demo_tenant)
+
+    def test_services(self):
+        """Verify the expected services are running on the corresponding
+           service units."""
+        commands = {
+            self.mysql_sentry: ['status mysql'],
+            self.rabbitmq_sentry: ['sudo service rabbitmq-server status'],
+            self.nova_cc_sentry: ['status nova-api-ec2',
+                                  'status nova-api-os-compute',
+                                  'status nova-objectstore',
+                                  'status nova-cert',
+                                  'status nova-scheduler'],
+            self.nova_compute_sentry: ['status nova-compute',
+                                       'status nova-network',
+                                       'status nova-api'],
+            self.keystone_sentry: ['status keystone'],
+            self.glance_sentry: ['status glance-registry', 'status glance-api']
+        }
+        if self._get_openstack_release() >= self.precise_grizzly:
+            commands[self.nova_cc_sentry] = ['status nova-conductor']
+
+        ret = u.validate_services(commands)
+        if ret:
+            amulet.raise_status(amulet.FAIL, msg=ret)
+
+    def test_service_catalog(self):
+        """Verify that the service catalog endpoint data is valid."""
+        endpoint_vol = {'adminURL': u.valid_url,
+                        'region': 'RegionOne',
+                        'publicURL': u.valid_url,
+                        'internalURL': u.valid_url}
+        endpoint_id = {'adminURL': u.valid_url,
+                       'region': 'RegionOne',
+                       'publicURL': u.valid_url,
+                       'internalURL': u.valid_url}
+        if self._get_openstack_release() >= self.precise_folsom:
+            endpoint_vol['id'] = u.not_null
+            endpoint_id['id'] = u.not_null
+        expected = {'s3': [endpoint_vol], 'compute': [endpoint_vol],
+                    'ec2': [endpoint_vol], 'identity': [endpoint_id]}
+        actual = self.keystone_demo.service_catalog.get_endpoints()
+
+        ret = u.validate_svc_catalog_endpoint_data(expected, actual)
+        if ret:
+            amulet.raise_status(amulet.FAIL, msg=ret)
+
+    def test_openstack_compute_api_endpoint(self):
+        """Verify the openstack compute api (osapi) endpoint data."""
+        endpoints = self.keystone.endpoints.list()
+        admin_port = internal_port = public_port = '8774'
+        expected = {'id': u.not_null,
+                    'region': 'RegionOne',
+                    'adminurl': u.valid_url,
+                    'internalurl': u.valid_url,
+                    'publicurl': u.valid_url,
+                    'service_id': u.not_null}
+
+        ret = u.validate_endpoint_data(endpoints, admin_port, internal_port,
+                                       public_port, expected)
+        if ret:
+            message = 'osapi endpoint: {}'.format(ret)
+            amulet.raise_status(amulet.FAIL, msg=message)
+
+    def test_ec2_api_endpoint(self):
+        """Verify the EC2 api endpoint data."""
+        endpoints = self.keystone.endpoints.list()
+        admin_port = internal_port = public_port = '8773'
+        expected = {'id': u.not_null,
+                    'region': 'RegionOne',
+                    'adminurl': u.valid_url,
+                    'internalurl': u.valid_url,
+                    'publicurl': u.valid_url,
+                    'service_id': u.not_null}
+
+        ret = u.validate_endpoint_data(endpoints, admin_port, internal_port,
+                                       public_port, expected)
+        if ret:
+            message = 'EC2 endpoint: {}'.format(ret)
+            amulet.raise_status(amulet.FAIL, msg=message)
+
+    def test_s3_api_endpoint(self):
+        """Verify the S3 api endpoint data."""
+        endpoints = self.keystone.endpoints.list()
+        admin_port = internal_port = public_port = '3333'
+        expected = {'id': u.not_null,
+                    'region': 'RegionOne',
+                    'adminurl': u.valid_url,
+                    'internalurl': u.valid_url,
+                    'publicurl': u.valid_url,
+                    'service_id': u.not_null}
+
+        ret = u.validate_endpoint_data(endpoints, admin_port, internal_port,
+                                       public_port, expected)
+        if ret:
+            message = 'S3 endpoint: {}'.format(ret)
+            amulet.raise_status(amulet.FAIL, msg=message)
+
+    def test_nova_cc_shared_db_relation(self):
+        """Verify the nova-cc to mysql shared-db relation data"""
+        unit = self.nova_cc_sentry
+        relation = ['shared-db', 'mysql:shared-db']
+        expected = {
+            'private-address': u.valid_ip,
+            'nova_database': 'nova',
+            'nova_username': 'nova',
+            'nova_hostname': u.valid_ip
+        }
+
+        ret = u.validate_relation_data(unit, relation, expected)
+        if ret:
+            message = u.relation_error('nova-cc shared-db', ret)
+            amulet.raise_status(amulet.FAIL, msg=message)
+
+    def test_mysql_shared_db_relation(self):
+        """Verify the mysql to nova-cc shared-db relation data"""
+        unit = self.mysql_sentry
+        relation = ['shared-db', 'nova-cloud-controller:shared-db']
+        expected = {
+            'private-address': u.valid_ip,
+            'nova_password': u.not_null,
+            'db_host': u.valid_ip
+        }
+
+        ret = u.validate_relation_data(unit, relation, expected)
+        if ret:
+            message = u.relation_error('mysql shared-db', ret)
+            amulet.raise_status(amulet.FAIL, msg=message)
+
+    def test_nova_cc_identity_service_relation(self):
+        """Verify the nova-cc to keystone identity-service relation data"""
+        unit = self.nova_cc_sentry
+        relation = ['identity-service', 'keystone:identity-service']
+        expected = {
+            'nova_internal_url': u.valid_url,
+            'nova_public_url': u.valid_url,
+            's3_public_url': u.valid_url,
+            's3_service': 's3',
+            'ec2_admin_url': u.valid_url,
+            'ec2_internal_url': u.valid_url,
+            'nova_service': 'nova',
+            's3_region': 'RegionOne',
+            'private-address': u.valid_ip,
+            'nova_region': 'RegionOne',
+            'ec2_public_url': u.valid_url,
+            'ec2_region': 'RegionOne',
+            's3_internal_url': u.valid_url,
+            's3_admin_url': u.valid_url,
+            'nova_admin_url': u.valid_url,
+            'ec2_service': 'ec2'
+        }
+
+        ret = u.validate_relation_data(unit, relation, expected)
+        if ret:
+            message = u.relation_error('nova-cc identity-service', ret)
+            amulet.raise_status(amulet.FAIL, msg=message)
+
+    def test_keystone_identity_service_relation(self):
+        """Verify the keystone to nova-cc identity-service relation data"""
+        unit = self.keystone_sentry
+        relation = ['identity-service',
+                    'nova-cloud-controller:identity-service']
+        expected = {
+            'service_protocol': 'http',
+            'service_tenant': 'services',
+            'admin_token': 'ubuntutesting',
+            'service_password': u.not_null,
+            'service_port': '5000',
+            'auth_port': '35357',
+            'auth_protocol': 'http',
+            'private-address': u.valid_ip,
+            'https_keystone': 'False',
+            'auth_host': u.valid_ip,
+            'service_username': 's3_ec2_nova',
+            'service_tenant_id': u.not_null,
+            'service_host': u.valid_ip
+        }
+
+        ret = u.validate_relation_data(unit, relation, expected)
+        if ret:
+            message = u.relation_error('keystone identity-service', ret)
+            amulet.raise_status(amulet.FAIL, msg=message)
+
+    def test_nova_cc_amqp_relation(self):
+        """Verify the nova-cc to rabbitmq-server amqp relation data"""
+        unit = self.nova_cc_sentry
+        relation = ['amqp', 'rabbitmq-server:amqp']
+        expected = {
+            'username': 'nova',
+            'private-address': u.valid_ip,
+            'vhost': 'openstack'
+        }
+
+        ret = u.validate_relation_data(unit, relation, expected)
+        if ret:
+            message = u.relation_error('nova-cc amqp', ret)
+            amulet.raise_status(amulet.FAIL, msg=message)
+
+    def test_rabbitmq_amqp_relation(self):
+        """Verify the rabbitmq-server to nova-cc amqp relation data"""
+        unit = self.rabbitmq_sentry
+        relation = ['amqp', 'nova-cloud-controller:amqp']
+        expected = {
+            'private-address': u.valid_ip,
+            'password': u.not_null,
+            'hostname': u.valid_ip
+        }
+
+        ret = u.validate_relation_data(unit, relation, expected)
+        if ret:
+            message = u.relation_error('rabbitmq amqp', ret)
+            amulet.raise_status(amulet.FAIL, msg=message)
+
+    def test_nova_cc_cloud_compute_relation(self):
+        """Verify the nova-cc to nova-compute cloud-compute relation data"""
+        unit = self.nova_cc_sentry
+        relation = ['cloud-compute', 'nova-compute:cloud-compute']
+        expected = {
+            'volume_service': 'cinder',
+            'network_manager': 'flatdhcpmanager',
+            'ec2_host': u.valid_ip,
+            'private-address': u.valid_ip,
+            'restart_trigger': u.not_null
+        }
+        if self._get_openstack_release() == self.precise_essex:
+            expected['volume_service'] = 'nova-volume'
+
+        ret = u.validate_relation_data(unit, relation, expected)
+        if ret:
+            message = u.relation_error('nova-cc cloud-compute', ret)
+            amulet.raise_status(amulet.FAIL, msg=message)
+
+    def test_nova_cloud_compute_relation(self):
+        """Verify the nova-compute to nova-cc cloud-compute relation data"""
+        unit = self.nova_compute_sentry
+        relation = ['cloud-compute', 'nova-cloud-controller:cloud-compute']
+        expected = {
+            'private-address': u.valid_ip,
+        }
+
+        ret = u.validate_relation_data(unit, relation, expected)
+        if ret:
+            message = u.relation_error('nova-compute cloud-compute', ret)
+            amulet.raise_status(amulet.FAIL, msg=message)
+
+    def test_nova_cc_image_service_relation(self):
+        """Verify the nova-cc to glance image-service relation data"""
+        unit = self.nova_cc_sentry
+        relation = ['image-service', 'glance:image-service']
+        expected = {
+            'private-address': u.valid_ip,
+        }
+
+        ret = u.validate_relation_data(unit, relation, expected)
+        if ret:
+            message = u.relation_error('nova-cc image-service', ret)
+            amulet.raise_status(amulet.FAIL, msg=message)
+
+    def test_glance_image_service_relation(self):
+        """Verify the glance to nova-cc image-service relation data"""
+        unit = self.glance_sentry
+        relation = ['image-service', 'nova-cloud-controller:image-service']
+        expected = {
+            'private-address': u.valid_ip,
+            'glance-api-server': u.valid_url
+        }
+
+        ret = u.validate_relation_data(unit, relation, expected)
+        if ret:
+            message = u.relation_error('glance image-service', ret)
+            amulet.raise_status(amulet.FAIL, msg=message)
+
+    def test_restart_on_config_change(self):
+        """Verify that the specified services are restarted when the config
+           is changed."""
+        # NOTE(coreycb): Skipping failing test on essex until resolved.
+        #                config-flags don't take effect on essex.
+        if self._get_openstack_release() == self.precise_essex:
+            u.log.error("Skipping failing test until resolved")
+            return
+
+        services = ['nova-api-ec2', 'nova-api-os-compute', 'nova-objectstore',
+                    'nova-cert', 'nova-scheduler', 'nova-conductor']
+        self.d.configure('nova-cloud-controller',
+         {'config-flags': 'quota_cores=20,quota_instances=40,quota_ram=102400'})
+        pgrep_full = True
+
+        time = 20
+        conf = '/etc/nova/nova.conf'
+        for s in services:
+            if not u.service_restarted(self.nova_cc_sentry, s, conf,
+                                       pgrep_full=True, sleep_time=time):
+                msg = "service {} didn't restart after config change".format(s)
+                amulet.raise_status(amulet.FAIL, msg=msg)
+            time = 0
+
+    def test_nova_default_config(self):
+        """Verify the data in the nova config file's default section."""
+        # NOTE(coreycb): Currently no way to test on essex because config file
+        #                has no section headers.
+        if self._get_openstack_release() == self.precise_essex:
+            return
+
+        unit = self.nova_cc_sentry
+        conf = '/etc/nova/nova.conf'
+        rabbitmq_relation = self.rabbitmq_sentry.relation('amqp',
+                                                   'nova-cloud-controller:amqp')
+        glance_relation = self.glance_sentry.relation('image-service',
+                                          'nova-cloud-controller:image-service')
+        mysql_relation = self.mysql_sentry.relation('shared-db',
+                                              'nova-cloud-controller:shared-db')
+        db_uri = "mysql://{}:{}@{}/{}".format('nova',
+                                              mysql_relation['nova_password'],
+                                              mysql_relation['db_host'],
+                                              'nova')
+        keystone_ep = self.keystone_demo.service_catalog.url_for(\
+                                                      service_type='identity',
+                                                      endpoint_type='publicURL')
+        keystone_ec2 = "{}/ec2tokens".format(keystone_ep)
+
+        expected = {'dhcpbridge_flagfile': '/etc/nova/nova.conf',
+                    'dhcpbridge': '/usr/bin/nova-dhcpbridge',
+                    'logdir': '/var/log/nova',
+                    'state_path': '/var/lib/nova',
+                    'lock_path': '/var/lock/nova',
+                    'force_dhcp_release': 'True',
+                    'iscsi_helper': 'tgtadm',
+                    'libvirt_use_virtio_for_bridges': 'True',
+                    'connection_type': 'libvirt',
+                    'root_helper': 'sudo nova-rootwrap /etc/nova/rootwrap.conf',
+                    'verbose': 'True',
+                    'ec2_private_dns_show_ip': 'True',
+                    'api_paste_config': '/etc/nova/api-paste.ini',
+                    'volumes_path': '/var/lib/nova/volumes',
+                    'enabled_apis': 'ec2,osapi_compute,metadata',
+                    'auth_strategy': 'keystone',
+                    'compute_driver': 'libvirt.LibvirtDriver',
+                    'keystone_ec2_url': keystone_ec2,
+                    'sql_connection': db_uri,
+                    'rabbit_userid': 'nova',
+                    'rabbit_virtual_host': 'openstack',
+                    'rabbit_password': rabbitmq_relation['password'],
+                    'rabbit_host': rabbitmq_relation['hostname'],
+                    'glance_api_servers': glance_relation['glance-api-server'],
+                    'network_manager': 'nova.network.manager.FlatDHCPManager',
+                    's3_listen_port': '3333',
+                    'osapi_compute_listen_port': '8774',
+                    'ec2_listen_port': '8773'}
+
+        ret = u.validate_config_data(unit, conf, 'DEFAULT', expected)
+        if ret:
+            message = "nova config error: {}".format(ret)
+            amulet.raise_status(amulet.FAIL, msg=message)
+
+
+    def test_nova_keystone_authtoken_config(self):
+        """Verify the data in the nova config file's keystone_authtoken
+           section. This data only exists since icehouse."""
+        if self._get_openstack_release() < self.precise_icehouse:
+            return
+
+        unit = self.nova_cc_sentry
+        conf = '/etc/nova/nova.conf'
+        keystone_relation = self.keystone_sentry.relation('identity-service',
+                                       'nova-cloud-controller:identity-service')
+        keystone_uri = "http://{}:{}/".format(keystone_relation['service_host'],
+                                              keystone_relation['service_port'])
+        expected = {'auth_uri': keystone_uri,
+                    'auth_host': keystone_relation['service_host'],
+                    'auth_port': keystone_relation['auth_port'],
+                    'auth_protocol': keystone_relation['auth_protocol'],
+                    'admin_tenant_name': keystone_relation['service_tenant'],
+                    'admin_user': keystone_relation['service_username'],
+                    'admin_password': keystone_relation['service_password']}
+
+        ret = u.validate_config_data(unit, conf, 'keystone_authtoken', expected)
+        if ret:
+            message = "nova config error: {}".format(ret)
+            amulet.raise_status(amulet.FAIL, msg=message)
+
+    def test_image_instance_create(self):
+        """Create an image/instance, verify they exist, and delete them."""
+        # NOTE(coreycb): Skipping failing test on essex until resolved. essex
+        #                nova API calls are getting "Malformed request url (HTTP
+        #                400)".
+        if self._get_openstack_release() == self.precise_essex:
+            u.log.error("Skipping failing test until resolved")
+            return
+
+        image = u.create_cirros_image(self.glance, "cirros-image")
+        if not image:
+            amulet.raise_status(amulet.FAIL, msg="Image create failed")
+
+        instance = u.create_instance(self.nova_demo, "cirros-image", "cirros",
+                                     "m1.tiny")
+        if not instance:
+            amulet.raise_status(amulet.FAIL, msg="Instance create failed")
+
+        found = False
+        for instance in self.nova_demo.servers.list():
+            if instance.name == 'cirros':
+                found = True
+                if instance.status != 'ACTIVE':
+                    msg = "cirros instance is not active"
+                    amulet.raise_status(amulet.FAIL, msg=message)
+
+        if not found:
+            message = "nova cirros instance does not exist"
+            amulet.raise_status(amulet.FAIL, msg=message)
+
+        u.delete_image(self.glance, image)
+        u.delete_instance(self.nova_demo, instance)
 
=== added directory 'tests/charmhelpers'
=== added file 'tests/charmhelpers/__init__.py'
=== added directory 'tests/charmhelpers/contrib'
=== added file 'tests/charmhelpers/contrib/__init__.py'
=== added directory 'tests/charmhelpers/contrib/amulet'
=== added file 'tests/charmhelpers/contrib/amulet/__init__.py'
=== added file 'tests/charmhelpers/contrib/amulet/deployment.py'
--- tests/charmhelpers/contrib/amulet/deployment.py	1970-01-01 00:00:00 +0000
+++ tests/charmhelpers/contrib/amulet/deployment.py	2014-07-29 13:07:23 +0000
@@ -0,0 +1,58 @@
+import amulet
+
+
+class AmuletDeployment(object):
+    """This class provides generic Amulet deployment and test runner
+       methods."""
+
+    def __init__(self, series=None):
+        """Initialize the deployment environment."""
+        self.series = None
+
+        if series:
+            self.series = series
+            self.d = amulet.Deployment(series=self.series)
+        else:
+            self.d = amulet.Deployment()
+
+    def _add_services(self, this_service, other_services):
+        """Add services to the deployment where this_service is the local charm
+           that we're focused on testing and other_services are the other
+           charms that come from the charm store."""
+        name, units = range(2)
+        self.this_service = this_service[name]
+        self.d.add(this_service[name], units=this_service[units])
+
+        for svc in other_services:
+            if self.series:
+                self.d.add(svc[name],
+                           charm='cs:{}/{}'.format(self.series, svc[name]),
+                           units=svc[units])
+            else:
+                self.d.add(svc[name], units=svc[units])
+
+    def _add_relations(self, relations):
+        """Add all of the relations for the services."""
+        for k, v in relations.iteritems():
+            self.d.relate(k, v)
+
+    def _configure_services(self, configs):
+        """Configure all of the services."""
+        for service, config in configs.iteritems():
+            self.d.configure(service, config)
+
+    def _deploy(self):
+        """Deploy environment and wait for all hooks to finish executing."""
+        try:
+            self.d.setup()
+            self.d.sentry.wait()
+        except amulet.helpers.TimeoutError:
+            amulet.raise_status(amulet.FAIL, msg="Deployment timed out")
+        except:
+            raise
+
+    def run_tests(self):
+        """Run all of the methods that are prefixed with 'test_'."""
+        for test in dir(self):
+            if test.startswith('test_'):
+                getattr(self, test)()
 
=== added file 'tests/charmhelpers/contrib/amulet/utils.py'
--- tests/charmhelpers/contrib/amulet/utils.py	1970-01-01 00:00:00 +0000
+++ tests/charmhelpers/contrib/amulet/utils.py	2014-07-29 13:07:23 +0000
@@ -0,0 +1,157 @@
+import ConfigParser
+import io
+import logging
+import re
+import sys
+from time import sleep
+
+
+class AmuletUtils(object):
+    """This class provides common utility functions that are used by Amulet
+       tests."""
+
+    def __init__(self, log_level=logging.ERROR):
+        self.log = self.get_logger(level=log_level)
+
+    def get_logger(self, name="amulet-logger", level=logging.DEBUG):
+        """Get a logger object that will log to stdout."""
+        log = logging
+        logger = log.getLogger(name)
+        fmt = \
+            log.Formatter("%(asctime)s %(funcName)s %(levelname)s: %(message)s")
+
+        handler = log.StreamHandler(stream=sys.stdout)
+        handler.setLevel(level)
+        handler.setFormatter(fmt)
+
+        logger.addHandler(handler)
+        logger.setLevel(level)
+
+        return logger
+
+    def valid_ip(self, ip):
+        if re.match(r"^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$", ip):
+            return True
+        else:
+            return False
+
+    def valid_url(self, url):
+        p = re.compile(
+            r'^(?:http|ftp)s?://'
+            r'(?:(?:[A-Z0-9](?:[A-Z0-9-]{0,61}[A-Z0-9])?\.)+(?:[A-Z]{2,6}\.?|[A-Z0-9-]{2,}\.?)|' # flake8: noqa
+            r'localhost|'
+            r'\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})'
+            r'(?::\d+)?'
+            r'(?:/?|[/?]\S+)$',
+            re.IGNORECASE)
+        if p.match(url):
+            return True
+        else:
+            return False
+
+    def validate_services(self, commands):
+        """Verify the specified services are running on the corresponding
+           service units."""
+        for k, v in commands.iteritems():
+            for cmd in v:
+                output, code = k.run(cmd)
+                if code != 0:
+                    return "command `{}` returned {}".format(cmd, str(code))
+        return None
+
+    def _get_config(self, unit, filename):
+        """Get a ConfigParser object for parsing a unit's config file."""
+        file_contents = unit.file_contents(filename)
+        config = ConfigParser.ConfigParser()
+        config.readfp(io.StringIO(file_contents))
+        return config
+
+    def validate_config_data(self, sentry_unit, config_file, section, expected):
+        """Verify that the specified section of the config file contains
+           the expected option key:value pairs."""
+        config = self._get_config(sentry_unit, config_file)
+
+        if section != 'DEFAULT' and not config.has_section(section):
+            return "section [{}] does not exist".format(section)
+
+        for k in expected.keys():
+            if not config.has_option(section, k):
+                return "section [{}] is missing option {}".format(section, k)
+            if config.get(section, k) != expected[k]:
+                return "section [{}] {}:{} != expected {}:{}".format(section,
+                       k, config.get(section, k), k, expected[k])
+        return None
+
+    def _validate_dict_data(self, expected, actual):
+        """Compare expected dictionary data vs actual dictionary data.
+           The values in the 'expected' dictionary can be strings, bools, ints,
+           longs, or can be a function that evaluate a variable and returns a
+           bool."""
+        for k, v in expected.iteritems():
+            if k in actual:
+                if isinstance(v, basestring) or \
+                   isinstance(v, bool) or \
+                   isinstance(v, (int, long)):
+                    if v != actual[k]:
+                        return "{}:{}".format(k, actual[k])
+                elif not v(actual[k]):
+                    return "{}:{}".format(k, actual[k])
+            else:
+                return "key '{}' does not exist".format(k)
+        return None
+
+    def validate_relation_data(self, sentry_unit, relation, expected):
+        """Validate actual relation data based on expected relation data."""
+        actual = sentry_unit.relation(relation[0], relation[1])
+        self.log.debug('actual: {}'.format(repr(actual)))
+        return self._validate_dict_data(expected, actual)
+
+    def _validate_list_data(self, expected, actual):
+        """Compare expected list vs actual list data."""
+        for e in expected:
+            if e not in actual:
+                return "expected item {} not found in actual list".format(e)
+        return None
+
+    def not_null(self, string):
+        if string != None:
+            return True
+        else:
+            return False
+
+    def _get_file_mtime(self, sentry_unit, filename):
+        """Get last modification time of file."""
+        return sentry_unit.file_stat(filename)['mtime']
+
+    def _get_dir_mtime(self, sentry_unit, directory):
+        """Get last modification time of directory."""
+        return sentry_unit.directory_stat(directory)['mtime']
+
+    def _get_proc_start_time(self, sentry_unit, service, pgrep_full=False):
+        """Determine start time of the process based on the last modification
+           time of the /proc/pid directory. If pgrep_full is True, the process
+           name is matched against the full command line."""
+        if pgrep_full:
+            cmd = 'pgrep -o -f {}'.format(service)
+        else:
+            cmd = 'pgrep -o {}'.format(service)
+        proc_dir = '/proc/{}'.format(sentry_unit.run(cmd)[0].strip())
+        return self._get_dir_mtime(sentry_unit, proc_dir)
+
+    def service_restarted(self, sentry_unit, service, filename,
+                          pgrep_full=False):
+        """Compare a service's start time vs a file's last modification time
+           (such as a config file for that service) to determine if the service
+           has been restarted."""
+        sleep(10)
+        if self._get_proc_start_time(sentry_unit, service, pgrep_full) >= \
+           self._get_file_mtime(sentry_unit, filename):
+            return True
+        else:
+            return False
+
+    def relation_error(self, name, data):
+        return 'unexpected relation data in {} - {}'.format(name, data)
+
+    def endpoint_error(self, name, data):
+        return 'unexpected endpoint data in {} - {}'.format(name, data)
 
=== added directory 'tests/charmhelpers/contrib/openstack'
=== added file 'tests/charmhelpers/contrib/openstack/__init__.py'
=== added directory 'tests/charmhelpers/contrib/openstack/amulet'
=== added file 'tests/charmhelpers/contrib/openstack/amulet/__init__.py'
=== added file 'tests/charmhelpers/contrib/openstack/amulet/deployment.py'
--- tests/charmhelpers/contrib/openstack/amulet/deployment.py	1970-01-01 00:00:00 +0000
+++ tests/charmhelpers/contrib/openstack/amulet/deployment.py	2014-07-29 13:07:23 +0000
@@ -0,0 +1,55 @@
+from charmhelpers.contrib.amulet.deployment import (
+    AmuletDeployment
+)
+
+
+class OpenStackAmuletDeployment(AmuletDeployment):
+    """This class inherits from AmuletDeployment and has additional support
+       that is specifically for use by OpenStack charms."""
+
+    def __init__(self, series=None, openstack=None, source=None):
+        """Initialize the deployment environment."""
+        super(OpenStackAmuletDeployment, self).__init__(series)
+        self.openstack = openstack
+        self.source = source
+
+    def _add_services(self, this_service, other_services):
+        """Add services to the deployment and set openstack-origin."""
+        super(OpenStackAmuletDeployment, self)._add_services(this_service,
+                                                             other_services)
+        name = 0
+        services = other_services
+        services.append(this_service)
+        use_source = ['mysql', 'mongodb', 'rabbitmq-server', 'ceph']
+
+        if self.openstack:
+            for svc in services:
+                if svc[name] not in use_source:
+                    config = {'openstack-origin': self.openstack}
+                    self.d.configure(svc[name], config)
+
+        if self.source:
+            for svc in services:
+                if svc[name] in use_source:
+                    config = {'source': self.source}
+                    self.d.configure(svc[name], config)
+
+    def _configure_services(self, configs):
+        """Configure all of the services."""
+        for service, config in configs.iteritems():
+            self.d.configure(service, config)
+
+    def _get_openstack_release(self):
+        """Return an integer representing the enum value of the openstack
+           release."""
+        self.precise_essex, self.precise_folsom, self.precise_grizzly, \
+            self.precise_havana, self.precise_icehouse, \
+            self.trusty_icehouse = range(6)
+        releases = {
+            ('precise', None): self.precise_essex,
+            ('precise', 'cloud:precise-folsom'): self.precise_folsom,
+            ('precise', 'cloud:precise-grizzly'): self.precise_grizzly,
+            ('precise', 'cloud:precise-havana'): self.precise_havana,
+            ('precise', 'cloud:precise-icehouse'): self.precise_icehouse,
+            ('trusty', None): self.trusty_icehouse}
+        return releases[(self.series, self.openstack)]
 
=== added file 'tests/charmhelpers/contrib/openstack/amulet/utils.py'
--- tests/charmhelpers/contrib/openstack/amulet/utils.py	1970-01-01 00:00:00 +0000
+++ tests/charmhelpers/contrib/openstack/amulet/utils.py	2014-07-29 13:07:23 +0000
@@ -0,0 +1,209 @@
+import logging
+import os
+import time
+import urllib
+
+import glanceclient.v1.client as glance_client
+import keystoneclient.v2_0 as keystone_client
+import novaclient.v1_1.client as nova_client
+
+from charmhelpers.contrib.amulet.utils import (
+    AmuletUtils
+)
+
+DEBUG = logging.DEBUG
+ERROR = logging.ERROR
+
+
+class OpenStackAmuletUtils(AmuletUtils):
+    """This class inherits from AmuletUtils and has additional support
+       that is specifically for use by OpenStack charms."""
+
+    def __init__(self, log_level=ERROR):
+        """Initialize the deployment environment."""
+        super(OpenStackAmuletUtils, self).__init__(log_level)
+
+    def validate_endpoint_data(self, endpoints, admin_port, internal_port,
+                               public_port, expected):
+        """Validate actual endpoint data vs expected endpoint data. The ports
+           are used to find the matching endpoint."""
+        found = False
+        for ep in endpoints:
+            self.log.debug('endpoint: {}'.format(repr(ep)))
+            if admin_port in ep.adminurl and internal_port in ep.internalurl \
+               and public_port in ep.publicurl:
+                found = True
+                actual = {'id': ep.id,
+                          'region': ep.region,
+                          'adminurl': ep.adminurl,
+                          'internalurl': ep.internalurl,
+                          'publicurl': ep.publicurl,
+                          'service_id': ep.service_id}
+                ret = self._validate_dict_data(expected, actual)
+                if ret:
+                    return 'unexpected endpoint data - {}'.format(ret)
+
+        if not found:
+            return 'endpoint not found'
+
+    def validate_svc_catalog_endpoint_data(self, expected, actual):
+        """Validate a list of actual service catalog endpoints vs a list of
+           expected service catalog endpoints."""
+        self.log.debug('actual: {}'.format(repr(actual)))
+        for k, v in expected.iteritems():
+            if k in actual:
+                ret = self._validate_dict_data(expected[k][0], actual[k][0])
+                if ret:
+                    return self.endpoint_error(k, ret)
+            else:
+                return "endpoint {} does not exist".format(k)
+        return ret
+
+    def validate_tenant_data(self, expected, actual):
+        """Validate a list of actual tenant data vs list of expected tenant
+           data."""
+        self.log.debug('actual: {}'.format(repr(actual)))
+        for e in expected:
+            found = False
+            for act in actual:
+                a = {'enabled': act.enabled, 'description': act.description,
+                     'name': act.name, 'id': act.id}
+                if e['name'] == a['name']:
+                    found = True
+                    ret = self._validate_dict_data(e, a)
+                    if ret:
+                        return "unexpected tenant data - {}".format(ret)
+            if not found:
+                return "tenant {} does not exist".format(e['name'])
+        return ret
+
+    def validate_role_data(self, expected, actual):
+        """Validate a list of actual role data vs a list of expected role
+           data."""
+        self.log.debug('actual: {}'.format(repr(actual)))
+        for e in expected:
+            found = False
+            for act in actual:
+                a = {'name': act.name, 'id': act.id}
+                if e['name'] == a['name']:
+                    found = True
+                    ret = self._validate_dict_data(e, a)
+                    if ret:
+                        return "unexpected role data - {}".format(ret)
+            if not found:
+                return "role {} does not exist".format(e['name'])
+        return ret
+
+    def validate_user_data(self, expected, actual):
+        """Validate a list of actual user data vs a list of expected user
+           data."""
+        self.log.debug('actual: {}'.format(repr(actual)))
+        for e in expected:
+            found = False
+            for act in actual:
+                a = {'enabled': act.enabled, 'name': act.name,
+                     'email': act.email, 'tenantId': act.tenantId,
+                     'id': act.id}
+                if e['name'] == a['name']:
+                    found = True
+                    ret = self._validate_dict_data(e, a)
+                    if ret:
+                        return "unexpected user data - {}".format(ret)
+            if not found:
+                return "user {} does not exist".format(e['name'])
+        return ret
+
+    def validate_flavor_data(self, expected, actual):
+        """Validate a list of actual flavors vs a list of expected flavors."""
+        self.log.debug('actual: {}'.format(repr(actual)))
+        act = [a.name for a in actual]
+        return self._validate_list_data(expected, act)
+
+    def tenant_exists(self, keystone, tenant):
+        """Return True if tenant exists"""
+        return tenant in [t.name for t in keystone.tenants.list()]
+
+    def authenticate_keystone_admin(self, keystone_sentry, user, password,
+                                    tenant):
+        """Authenticates admin user with the keystone admin endpoint."""
+        service_ip = \
+            keystone_sentry.relation('shared-db',
+                                     'mysql:shared-db')['private-address']
+        ep = "http://{}:35357/v2.0".format(service_ip.strip().decode('utf-8'))
+        return keystone_client.Client(username=user, password=password,
+                                      tenant_name=tenant, auth_url=ep)
+
+    def authenticate_keystone_user(self, keystone, user, password, tenant):
+        """Authenticates a regular user with the keystone public endpoint."""
+        ep = keystone.service_catalog.url_for(service_type='identity',
+                                              endpoint_type='publicURL')
+        return keystone_client.Client(username=user, password=password,
+                                      tenant_name=tenant, auth_url=ep)
+
+    def authenticate_glance_admin(self, keystone):
+        """Authenticates admin user with glance."""
+        ep = keystone.service_catalog.url_for(service_type='image',
+                                              endpoint_type='adminURL')
+        return glance_client.Client(ep, token=keystone.auth_token)
+
+    def authenticate_nova_user(self, keystone, user, password, tenant):
+        """Authenticates a regular user with nova-api."""
+        ep = keystone.service_catalog.url_for(service_type='identity',
+                                              endpoint_type='publicURL')
+        return nova_client.Client(username=user, api_key=password,
+                                  project_id=tenant, auth_url=ep)
+
+    def create_cirros_image(self, glance, image_name):
+        """Download the latest cirros image and upload it to glance."""
+        http_proxy = os.getenv('AMULET_HTTP_PROXY')
+        self.log.debug('AMULET_HTTP_PROXY: {}'.format(http_proxy))
+        if http_proxy:
+            proxies = {'http': http_proxy}
+            opener = urllib.FancyURLopener(proxies)
+        else:
+            opener = urllib.FancyURLopener()
+
+        f = opener.open("http://download.cirros-cloud.net/version/released")
+        version = f.read().strip()
+        cirros_img = "tests/cirros-{}-x86_64-disk.img".format(version)
+
+        if not os.path.exists(cirros_img):
+            cirros_url = "http://{}/{}/{}".format("download.cirros-cloud.net",
+                                                  version, cirros_img)
+            opener.retrieve(cirros_url, cirros_img)
+        f.close()
+
+        with open(cirros_img) as f:
+            image = glance.images.create(name=image_name, is_public=True,
+                                         disk_format='qcow2',
+                                         container_format='bare', data=f)
+        return image
+
+    def delete_image(self, glance, image):
+        """Delete the specified image."""
+        glance.images.delete(image)
+
+    def create_instance(self, nova, image_name, instance_name, flavor):
+        """Create the specified instance."""
+        image = nova.images.find(name=image_name)
+        flavor = nova.flavors.find(name=flavor)
+        instance = nova.servers.create(name=instance_name, image=image,
+                                       flavor=flavor)
+
+        count = 1
+        status = instance.status
+        while status != 'ACTIVE' and count < 60:
+            time.sleep(3)
+            instance = nova.servers.get(instance.id)
+            status = instance.status
+            self.log.debug('instance status: {}'.format(status))
+            count += 1
+
+        if status == 'BUILD':
+            return None
+
+        return instance
+
+    def delete_instance(self, nova, instance):
+        """Delete the specified instance."""
+        nova.servers.delete(instance)
 
=== modified file 'unit_tests/test_nova_cc_hooks.py'
--- unit_tests/test_nova_cc_hooks.py	2014-05-21 10:03:01 +0000
+++ unit_tests/test_nova_cc_hooks.py	2014-07-29 13:07:23 +0000
@@ -1,6 +1,6 @@
-from mock import MagicMock, patch
-from test_utils import CharmTestCase
-
+from mock import MagicMock, patch, call
+from test_utils import CharmTestCase, patch_open
+import os
 with patch('charmhelpers.core.hookenv.config') as config:
     config.return_value = 'neutron'
     import nova_cc_utils as utils
@@ -11,7 +11,11 @@
 utils.register_configs = MagicMock()
 utils.restart_map = MagicMock()
 
-import nova_cc_hooks as hooks
+with patch('nova_cc_utils.guard_map') as gmap:
+    with patch('charmhelpers.core.hookenv.config') as config:
+        config.return_value = False
+        gmap.return_value = {}
+        import nova_cc_hooks as hooks
 
 utils.register_configs = _reg
 utils.restart_map = _map
@@ -35,9 +39,11 @@
     'relation_set',
     'relation_ids',
     'ssh_compute_add',
-    'ssh_known_hosts_b64',
-    'ssh_authorized_keys_b64',
+    'ssh_known_hosts_lines',
+    'ssh_authorized_keys_lines',
     'save_script_rc',
+    'service_running',
+    'service_stop',
     'execd_preinstall',
     'network_manager',
     'volume_service',
@@ -98,15 +104,64 @@
         self.test_relation.set({
             'migration_auth_type': 'ssh', 'ssh_public_key': 'fookey',
             'private-address': '10.0.0.1'})
-        self.ssh_known_hosts_b64.return_value = 'hosts'
-        self.ssh_authorized_keys_b64.return_value = 'keys'
-        hooks.compute_changed()
-        self.ssh_compute_add.assert_called_with('fookey')
-        self.relation_set.assert_called_with(known_hosts='hosts',
-                                             authorized_keys='keys')
+        self.ssh_known_hosts_lines.return_value = [
+            'k_h_0', 'k_h_1', 'k_h_2']
+        self.ssh_authorized_keys_lines.return_value = [
+            'auth_0', 'auth_1', 'auth_2']
+        hooks.compute_changed()
+        self.ssh_compute_add.assert_called_with('fookey', rid=None, unit=None)
+        expected_relations = [
+            call(relation_settings={'authorized_keys_0': 'auth_0'},
+                 relation_id=None),
+            call(relation_settings={'authorized_keys_1': 'auth_1'},
+                 relation_id=None),
+            call(relation_settings={'authorized_keys_2': 'auth_2'},
+                 relation_id=None),
+            call(relation_settings={'known_hosts_0': 'k_h_0'},
+                 relation_id=None),
+            call(relation_settings={'known_hosts_1': 'k_h_1'},
+                 relation_id=None),
+            call(relation_settings={'known_hosts_2': 'k_h_2'},
+                 relation_id=None),
+            call(authorized_keys_max_index=3, relation_id=None),
+            call(known_hosts_max_index=3, relation_id=None)]
+        self.assertEquals(sorted(self.relation_set.call_args_list),
+                          sorted(expected_relations))
+
+    def test_compute_changed_nova_public_key(self):
+        self.test_relation.set({
+            'migration_auth_type': 'sasl', 'nova_ssh_public_key': 'fookey',
+            'private-address': '10.0.0.1'})
+        self.ssh_known_hosts_lines.return_value = [
+            'k_h_0', 'k_h_1', 'k_h_2']
+        self.ssh_authorized_keys_lines.return_value = [
+            'auth_0', 'auth_1', 'auth_2']
+        hooks.compute_changed()
+        self.ssh_compute_add.assert_called_with('fookey', user='nova',
+                                                rid=None, unit=None)
+        expected_relations = [
+            call(relation_settings={'nova_authorized_keys_0': 'auth_0'},
+                 relation_id=None),
+            call(relation_settings={'nova_authorized_keys_1': 'auth_1'},
+                 relation_id=None),
+            call(relation_settings={'nova_authorized_keys_2': 'auth_2'},
+                 relation_id=None),
+            call(relation_settings={'nova_known_hosts_0': 'k_h_0'},
+                 relation_id=None),
+            call(relation_settings={'nova_known_hosts_1': 'k_h_1'},
+                 relation_id=None),
+            call(relation_settings={'nova_known_hosts_2': 'k_h_2'},
+                 relation_id=None),
+            call(relation_settings={'nova_known_hosts_max_index': 3},
+                 relation_id=None),
+            call(relation_settings={'nova_authorized_keys_max_index': 3},
+                 relation_id=None)]
+        self.assertEquals(sorted(self.relation_set.call_args_list),
+                          sorted(expected_relations))
 
     @patch.object(hooks, '_auth_config')
     def test_compute_joined_neutron(self, auth_config):
+        self.is_relation_made.return_value = False
         self.network_manager.return_value = 'neutron'
         self.eligible_leader = True
         self.keystone_ca_cert_b64.return_value = 'foocert64'
@@ -122,6 +177,8 @@
             relation_id=None,
             quantum_url='http://nova-cc-host1:9696',
             ca_cert='foocert64',
+            quantum_port=9696,
+            quantum_host='nova-cc-host1',
             quantum_security_groups='no',
             region='RegionOne',
             volume_service='cinder',
@@ -129,6 +186,40 @@
             quantum_plugin='nvp',
             network_manager='neutron', **FAKE_KS_AUTH_CFG)
 
+    @patch.object(hooks, 'NeutronAPIContext')
+    @patch.object(hooks, '_auth_config')
+    def test_compute_joined_neutron_api_rel(self, auth_config, napi):
+        def mock_NeutronAPIContext():
+            return {
+                'neutron_plugin': 'bob',
+                'neutron_security_groups': 'yes',
+                'neutron_url': 'http://nova-cc-host1:9696',
+            }
+        napi.return_value = mock_NeutronAPIContext
+        self.is_relation_made.return_value = True
+        self.network_manager.return_value = 'neutron'
+        self.eligible_leader = True
+        self.keystone_ca_cert_b64.return_value = 'foocert64'
+        self.volume_service.return_value = 'cinder'
+        self.unit_get.return_value = 'nova-cc-host1'
+        self.canonical_url.return_value = 'http://nova-cc-host1'
+        self.api_port.return_value = '9696'
+        self.neutron_plugin.return_value = 'nvp'
+        auth_config.return_value = FAKE_KS_AUTH_CFG
+        hooks.compute_joined()
+        self.relation_set.assert_called_with(
+            relation_id=None,
+            quantum_url='http://nova-cc-host1:9696',
+            ca_cert='foocert64',
+            quantum_port=9696,
+            quantum_host='nova-cc-host1',
+            quantum_security_groups='yes',
+            region='RegionOne',
+            volume_service='cinder',
+            ec2_host='nova-cc-host1',
+            quantum_plugin='bob',
+            network_manager='neutron', **FAKE_KS_AUTH_CFG)
+
     @patch.object(hooks, '_auth_config')
     def test_nova_vmware_joined(self, auth_config):
         auth_config.return_value = FAKE_KS_AUTH_CFG
@@ -231,3 +322,46 @@
         self._postgresql_db_test(configs)
         self.assertTrue(configs.write_all.called)
         self.migrate_database.assert_called_with()
+
+    @patch.object(os, 'rename')
+    @patch.object(os.path, 'isfile')
+    @patch.object(hooks, 'CONFIGS')
+    def test_neutron_api_relation_joined(self, configs, isfile, rename):
+        neutron_conf = '/etc/neutron/neutron.conf'
+        nova_url = 'http://novaurl:8774/v2'
+        isfile.return_value = True
+        self.service_running.return_value = True
+        _identity_joined = self.patch('identity_joined')
+        self.relation_ids.side_effect = ['relid']
+        self.canonical_url.return_value = 'http://novaurl'
+        with patch_open() as (_open, _file):
+            hooks.neutron_api_relation_joined()
+            self.service_stop.assert_called_with('neutron-server')
+            rename.assert_called_with(neutron_conf, neutron_conf + '_unused')
+            self.assertTrue(_identity_joined.called)
+            self.relation_set.assert_called_with(relation_id=None,
+                                                 nova_url=nova_url)
+
+    @patch.object(hooks, 'CONFIGS')
+    def test_neutron_api_relation_changed(self, configs):
+        self.relation_ids.return_value = ['relid']
+        _compute_joined = self.patch('compute_joined')
+        _quantum_joined = self.patch('quantum_joined')
+        hooks.neutron_api_relation_changed()
+        self.assertTrue(configs.write.called_with('/etc/nova/nova.conf'))
+        self.assertTrue(_compute_joined.called)
+        self.assertTrue(_quantum_joined.called)
+
+    @patch.object(os, 'remove')
+    @patch.object(os.path, 'isfile')
+    @patch.object(hooks, 'CONFIGS')
+    def test_neutron_api_relation_broken(self, configs, isfile, remove):
+        isfile.return_value = True
+        self.relation_ids.return_value = ['relid']
+        _compute_joined = self.patch('compute_joined')
+        _quantum_joined = self.patch('quantum_joined')
+        hooks.neutron_api_relation_broken()
+        remove.assert_called_with('/etc/init/neutron-server.override')
+        self.assertTrue(configs.write_all.called)
+        self.assertTrue(_compute_joined.called)
+        self.assertTrue(_quantum_joined.called)
 
=== modified file 'unit_tests/test_nova_cc_utils.py'
--- unit_tests/test_nova_cc_utils.py	2014-05-02 10:06:23 +0000
+++ unit_tests/test_nova_cc_utils.py	2014-07-29 13:07:23 +0000
@@ -22,6 +22,7 @@
     'eligible_leader',
     'enable_policy_rcd',
     'get_os_codename_install_source',
+    'is_relation_made',
     'log',
     'ml2_migration',
     'network_manager',
@@ -34,7 +35,9 @@
     'remote_unit',
     '_save_script_rc',
     'service_start',
-    'services'
+    'services',
+    'service_running',
+    'service_stop'
 ]
 
 SCRIPTRC_ENV_VARS = {
@@ -151,6 +154,7 @@
 
     @patch('charmhelpers.contrib.openstack.context.SubordinateConfigContext')
     def test_resource_map_quantum(self, subcontext):
+        self.is_relation_made.return_value = False
         self._resource_map(network_manager='quantum')
         _map = utils.resource_map()
         confs = [
@@ -162,6 +166,7 @@
 
     @patch('charmhelpers.contrib.openstack.context.SubordinateConfigContext')
     def test_resource_map_neutron(self, subcontext):
+        self.is_relation_made.return_value = False
         self._resource_map(network_manager='neutron')
         _map = utils.resource_map()
         confs = [
@@ -170,6 +175,17 @@
         [self.assertIn(q_conf, _map.keys()) for q_conf in confs]
 
     @patch('charmhelpers.contrib.openstack.context.SubordinateConfigContext')
+    def test_resource_map_neutron_api_rel(self, subcontext):
+        self.is_relation_made.return_value = True
+        self._resource_map(network_manager='neutron')
+        _map = utils.resource_map()
+        confs = [
+            '/etc/neutron/neutron.conf',
+        ]
+        for q_conf in confs:
+            self.assertFalse(q_conf in _map.keys())
+
+    @patch('charmhelpers.contrib.openstack.context.SubordinateConfigContext')
     def test_resource_map_vmware(self, subcontext):
         fake_context = MagicMock()
         fake_context.return_value = {
@@ -201,6 +217,7 @@
     @patch('os.path.exists')
     @patch('charmhelpers.contrib.openstack.context.SubordinateConfigContext')
     def test_restart_map_api_before_frontends(self, subcontext, _exists):
+        self.is_relation_made.return_value = False
         _exists.return_value = False
         self._resource_map(network_manager='neutron')
         _map = utils.restart_map()
@@ -226,6 +243,7 @@
 
     @patch('charmhelpers.contrib.openstack.context.SubordinateConfigContext')
     def test_determine_packages_neutron(self, subcontext):
+        self.is_relation_made.return_value = False
         self._resource_map(network_manager='neutron')
         pkgs = utils.determine_packages()
         self.assertIn('neutron-server', pkgs)
@@ -321,8 +339,8 @@
         check_output.return_value = 'fookey'
         host_key.return_value = 'fookey_old'
         with patch_open() as (_open, _file):
-            utils.add_known_host('foohost')
-            rm.assert_called_with('foohost', None)
+            utils.add_known_host('foohost', None, None)
+            rm.assert_called_with('foohost', None, None)
 
     @patch.object(utils, 'known_hosts')
     @patch.object(utils, 'remove_known_host')
@@ -355,19 +373,19 @@
     def test_known_hosts(self, ssh_dir):
         ssh_dir.return_value = '/tmp/foo'
         self.assertEquals(utils.known_hosts(), '/tmp/foo/known_hosts')
-        ssh_dir.assert_called_with(None)
+        ssh_dir.assert_called_with(None, None)
         self.assertEquals(utils.known_hosts('bar'), '/tmp/foo/known_hosts')
-        ssh_dir.assert_called_with('bar')
+        ssh_dir.assert_called_with('bar', None)
 
     @patch.object(utils, 'ssh_directory_for_unit')
     def test_authorized_keys(self, ssh_dir):
         ssh_dir.return_value = '/tmp/foo'
         self.assertEquals(utils.authorized_keys(), '/tmp/foo/authorized_keys')
-        ssh_dir.assert_called_with(None)
+        ssh_dir.assert_called_with(None, None)
         self.assertEquals(
             utils.authorized_keys('bar'),
             '/tmp/foo/authorized_keys')
-        ssh_dir.assert_called_with('bar')
+        ssh_dir.assert_called_with('bar', None)
 
     @patch.object(utils, 'known_hosts')
     @patch('subprocess.check_call')
@@ -421,11 +439,15 @@
         self.os_release.return_value = 'folsom'
 
     def test_determine_endpoints_base(self):
+        self.is_relation_made.return_value = False
         self.relation_ids.return_value = []
         self.assertEquals(
-            BASE_ENDPOINTS, utils.determine_endpoints('http://foohost.com'))
+            BASE_ENDPOINTS, utils.determine_endpoints('http://foohost.com',
+                                                      'http://foohost.com',
+                                                      'http://foohost.com'))
 
     def test_determine_endpoints_nova_volume(self):
+        self.is_relation_made.return_value = False
         self.relation_ids.return_value = ['nova-volume-service/0']
         endpoints = deepcopy(BASE_ENDPOINTS)
         endpoints.update({
@@ -438,9 +460,12 @@
             'nova-volume_region': 'RegionOne',
             'nova-volume_service': 'nova-volume'})
         self.assertEquals(
-            endpoints, utils.determine_endpoints('http://foohost.com'))
+            endpoints, utils.determine_endpoints('http://foohost.com',
+                                                 'http://foohost.com',
+                                                 'http://foohost.com'))
 
     def test_determine_endpoints_quantum_neutron(self):
+        self.is_relation_made.return_value = False
         self.relation_ids.return_value = []
         self.network_manager.return_value = 'quantum'
         endpoints = deepcopy(BASE_ENDPOINTS)
@@ -451,7 +476,25 @@
             'quantum_region': 'RegionOne',
             'quantum_service': 'quantum'})
         self.assertEquals(
-            endpoints, utils.determine_endpoints('http://foohost.com'))
+            endpoints, utils.determine_endpoints('http://foohost.com',
+                                                 'http://foohost.com',
+                                                 'http://foohost.com'))
+
+    def test_determine_endpoints_neutron_api_rel(self):
+        self.is_relation_made.return_value = True
+        self.relation_ids.return_value = []
+        self.network_manager.return_value = 'quantum'
+        endpoints = deepcopy(BASE_ENDPOINTS)
+        endpoints.update({
+            'quantum_admin_url': None,
+            'quantum_internal_url': None,
+            'quantum_public_url': None,
+            'quantum_region': None,
+            'quantum_service': None})
+        self.assertEquals(
+            endpoints, utils.determine_endpoints('http://foohost.com',
+                                                 'http://foohost.com',
+                                                 'http://foohost.com'))
 
     @patch.object(utils, 'known_hosts')
     @patch('subprocess.check_output')
@@ -461,9 +504,9 @@
         _check_output.assert_called_with(
             ['ssh-keygen', '-f', '/foo/known_hosts',
              '-H', '-F', 'test'])
-        _known_hosts.assert_called_with(None)
+        _known_hosts.assert_called_with(None, None)
         utils.ssh_known_host_key('test', 'bar')
-        _known_hosts.assert_called_with('bar')
+        _known_hosts.assert_called_with('bar', None)
 
     @patch.object(utils, 'known_hosts')
     @patch('subprocess.check_call')
@@ -473,9 +516,9 @@
         _check_call.assert_called_with(
             ['ssh-keygen', '-f', '/foo/known_hosts',
              '-R', 'test'])
-        _known_hosts.assert_called_with(None)
+        _known_hosts.assert_called_with(None, None)
         utils.remove_known_host('test', 'bar')
-        _known_hosts.assert_called_with('bar')
+        _known_hosts.assert_called_with('bar', None)
 
     @patch('subprocess.check_output')
     def test_migrate_database(self, check_output):
@@ -555,3 +598,113 @@
             utils.do_openstack_upgrade()
             expected = [call('cloud:precise-icehouse')]
             self.assertEquals(_do_openstack_upgrade.call_args_list, expected)
+
+    def test_guard_map_nova(self):
+        self.relation_ids.return_value = []
+        self.os_release.return_value = 'havana'
+        self.assertEqual(
+            {'nova-api-ec2': ['identity-service', 'amqp', 'shared-db'],
+             'nova-api-os-compute': ['identity-service', 'amqp', 'shared-db'],
+             'nova-cert': ['identity-service', 'amqp', 'shared-db'],
+             'nova-conductor': ['identity-service', 'amqp', 'shared-db'],
+             'nova-objectstore': ['identity-service', 'amqp', 'shared-db'],
+             'nova-scheduler': ['identity-service', 'amqp', 'shared-db']},
+            utils.guard_map()
+        )
+        self.os_release.return_value = 'essex'
+        self.assertEqual(
+            {'nova-api-ec2': ['identity-service', 'amqp', 'shared-db'],
+             'nova-api-os-compute': ['identity-service', 'amqp', 'shared-db'],
+             'nova-cert': ['identity-service', 'amqp', 'shared-db'],
+             'nova-objectstore': ['identity-service', 'amqp', 'shared-db'],
+             'nova-scheduler': ['identity-service', 'amqp', 'shared-db']},
+            utils.guard_map()
+        )
+
+    def test_guard_map_neutron(self):
+        self.relation_ids.return_value = []
+        self.network_manager.return_value = 'neutron'
+        self.os_release.return_value = 'icehouse'
+        self.assertEqual(
+            {'neutron-server': ['identity-service', 'amqp', 'shared-db'],
+             'nova-api-ec2': ['identity-service', 'amqp', 'shared-db'],
+             'nova-api-os-compute': ['identity-service', 'amqp', 'shared-db'],
+             'nova-cert': ['identity-service', 'amqp', 'shared-db'],
+             'nova-conductor': ['identity-service', 'amqp', 'shared-db'],
+             'nova-objectstore': ['identity-service', 'amqp', 'shared-db'],
+             'nova-scheduler': ['identity-service', 'amqp', 'shared-db'], },
+            utils.guard_map()
+        )
+        self.network_manager.return_value = 'quantum'
+        self.os_release.return_value = 'grizzly'
+        self.assertEqual(
+            {'quantum-server': ['identity-service', 'amqp', 'shared-db'],
+             'nova-api-ec2': ['identity-service', 'amqp', 'shared-db'],
+             'nova-api-os-compute': ['identity-service', 'amqp', 'shared-db'],
+             'nova-cert': ['identity-service', 'amqp', 'shared-db'],
+             'nova-conductor': ['identity-service', 'amqp', 'shared-db'],
+             'nova-objectstore': ['identity-service', 'amqp', 'shared-db'],
+             'nova-scheduler': ['identity-service', 'amqp', 'shared-db'], },
+            utils.guard_map()
+        )
+
+    def test_guard_map_pgsql(self):
+        self.relation_ids.return_value = ['pgsql:1']
+        self.network_manager.return_value = 'neutron'
+        self.os_release.return_value = 'icehouse'
+        self.assertEqual(
+            {'neutron-server': ['identity-service', 'amqp',
+                                'pgsql-neutron-db'],
+             'nova-api-ec2': ['identity-service', 'amqp', 'pgsql-nova-db'],
+             'nova-api-os-compute': ['identity-service', 'amqp',
+                                     'pgsql-nova-db'],
+             'nova-cert': ['identity-service', 'amqp', 'pgsql-nova-db'],
+             'nova-conductor': ['identity-service', 'amqp', 'pgsql-nova-db'],
+             'nova-objectstore': ['identity-service', 'amqp',
+                                  'pgsql-nova-db'],
+             'nova-scheduler': ['identity-service', 'amqp',
+                                'pgsql-nova-db'], },
+            utils.guard_map()
+        )
+
+    def test_service_guard_inactive(self):
+        '''Ensure that if disabled, service guards nothing'''
+        contexts = MagicMock()
+
+        @utils.service_guard({'test': ['interfacea', 'interfaceb']},
+                             contexts, False)
+        def dummy_func():
+            pass
+        dummy_func()
+        self.assertFalse(self.service_running.called)
+        self.assertFalse(contexts.complete_contexts.called)
+
+    def test_service_guard_active_guard(self):
+        '''Ensure services with incomplete interfaces are stopped'''
+        contexts = MagicMock()
+        contexts.complete_contexts.return_value = ['interfacea']
+        self.service_running.return_value = True
+
+        @utils.service_guard({'test': ['interfacea', 'interfaceb']},
+                             contexts, True)
+        def dummy_func():
+            pass
+        dummy_func()
+        self.service_running.assert_called_with('test')
+        self.service_stop.assert_called_with('test')
+        self.assertTrue(contexts.complete_contexts.called)
+
+    def test_service_guard_active_release(self):
+        '''Ensure services with complete interfaces are not stopped'''
+        contexts = MagicMock()
+        contexts.complete_contexts.return_value = ['interfacea',
+                                                   'interfaceb']
+
+        @utils.service_guard({'test': ['interfacea', 'interfaceb']},
+                             contexts, True)
+        def dummy_func():
+            pass
+        dummy_func()
+        self.assertFalse(self.service_running.called)
+        self.assertFalse(self.service_stop.called)
+        self.assertTrue(contexts.complete_contexts.called)
 
=== modified file 'unit_tests/test_utils.py'
--- unit_tests/test_utils.py	2013-11-08 05:41:39 +0000
+++ unit_tests/test_utils.py	2014-07-29 13:07:23 +0000
@@ -82,9 +82,9 @@
         return self.config
 
     def set(self, attr, value):
-            if attr not in self.config:
-                raise KeyError
-            self.config[attr] = value
+        if attr not in self.config:
+            raise KeyError
+        self.config[attr] = value
 
 
 class TestRelation(object):