Merge lp:~jjo/charms/trusty/swift-proxy/swift_hash-from-JUJU_ENV_UUID-and-service_name into lp:~openstack-charmers-archive/charms/trusty/swift-proxy/trunk

[JuanJo Ciarlante]

Unmerged revisions

=== added file '.bzrignore'
--- .bzrignore	1970-01-01 00:00:00 +0000
+++ .bzrignore	2014-10-06 15:38:41 +0000
@@ -0,0 +1,2 @@
+.coverage
+bin
 
=== renamed file '.bzrignore' => '.bzrignore.moved'
=== modified file 'Makefile'
--- Makefile	2014-08-13 15:57:07 +0000
+++ Makefile	2014-10-06 15:38:41 +0000
@@ -3,10 +3,15 @@
 
 lint:
 	@flake8 --exclude hooks/charmhelpers --ignore=E125 hooks
-	@flake8 --exclude hooks/charmhelpers --ignore=E125 unit_tests
+	@flake8 --exclude hooks/charmhelpers --ignore=E125 unit_tests tests
 	@charm proof
 
+unit_test:
+	@echo Starting unit tests...
+	@$(PYTHON) /usr/bin/nosetests --nologcapture --with-coverage unit_tests
+
 test:
+<<<<<<< TREE
 	@echo Starting tests...
 	@$(PYTHON) /usr/bin/nosetests --nologcapture --with-coverage unit_tests
 
@@ -19,5 +24,23 @@
 	@$(PYTHON) bin/charm_helpers_sync.py -c charm-helpers.yaml
 
 publish: lint test
+=======
+	@echo Starting Amulet tests...
+	# coreycb note: The -v should only be temporary until Amulet sends
+	# raise_status() messages to stderr:
+	#   https://bugs.launchpad.net/amulet/+bug/1320357
+	@juju test -v -p AMULET_HTTP_PROXY
+
+bin/charm_helpers_sync.py:
+	@mkdir -p bin
+	@bzr cat lp:charm-helpers/tools/charm_helpers_sync/charm_helpers_sync.py \
+	> bin/charm_helpers_sync.py
+
+sync: bin/charm_helpers_sync.py
+	@$(PYTHON) bin/charm_helpers_sync.py -c charm-helpers-hooks.yaml
+	@$(PYTHON) bin/charm_helpers_sync.py -c charm-helpers-tests.yaml
+
+publish: lint unit_test
+>>>>>>> MERGE-SOURCE
 	bzr push lp:charms/swift-proxy
 	bzr push lp:charms/trusty/swift-proxy
 
=== added file 'charm-helpers-hooks.yaml'
--- charm-helpers-hooks.yaml	1970-01-01 00:00:00 +0000
+++ charm-helpers-hooks.yaml	2014-10-06 15:38:41 +0000
@@ -0,0 +1,13 @@
+branch: lp:charm-helpers
+destination: hooks/charmhelpers
+include:
+    - core
+    - fetch
+    - contrib.openstack|inc=*
+    - contrib.storage.linux
+    - contrib.hahelpers:
+        - apache
+        - cluster
+    - payload.execd
+    - contrib.network.ip
+    - contrib.peerstorage
 
=== added file 'charm-helpers-tests.yaml'
--- charm-helpers-tests.yaml	1970-01-01 00:00:00 +0000
+++ charm-helpers-tests.yaml	2014-10-06 15:38:41 +0000
@@ -0,0 +1,5 @@
+branch: lp:charm-helpers
+destination: tests/charmhelpers
+include:
+    - contrib.amulet
+    - contrib.openstack.amulet
 
=== renamed file 'charm-helpers.yaml' => 'charm-helpers.yaml.THIS'
=== modified file 'config.yaml'
--- config.yaml	2013-04-15 19:41:45 +0000
+++ config.yaml	2014-10-06 15:38:41 +0000
@@ -106,6 +106,19 @@
     default: true
     type: boolean
     description: Delay authentication to downstream WSGI services.
+  node-timeout:
+    default: 60
+    type: int
+    description: How long the proxy server will wait on responses from the a/c/o servers.
+  recoverable-node-timeout:
+    default: 30
+    type: int
+    description: |
+      How long the proxy server will wait for an initial response and to read a
+      chunk of data from the object servers while serving GET / HEAD requests.
+      Timeouts from these requests can be recovered from so setting this to
+      something lower than node-timeout would provide quicker error recovery
+      while allowing for a longer timeout for non-recoverable requests (PUTs).
   # Manual Keystone configuration.
   keystone-auth-host:
     type: string
@@ -134,15 +147,11 @@
     description: Hash to use across all swift-proxy servers - don't loose
   vip:
     type: string
-    description: "Virtual IP to use to front swift-proxy in ha configuration"
-  vip_iface:
-    type: string
-    default: eth0
-    description: "Network Interface where to place the Virtual IP"
-  vip_cidr:
-    type: int
-    default: 24
-    description: "Netmask that will be used for the Virtual IP"
+    description: |
+      Virtual IP(s) to use to front API services in HA configuration.
+      .
+      If multiple networks are being used, a VIP should be provided for each
+      network, separated by spaces.
   ha-bindiface:
     type: string
     default: eth0
@@ -155,3 +164,38 @@
     description: |
       Default multicast port number that will be used to communicate between
       HA Cluster nodes.
+  # Network configuration options
+  # by default all access is over 'private-address'
+  os-admin-network:
+    type: string
+    description: |
+      The IP address and netmask of the OpenStack Admin network (e.g.,
+      192.168.0.0/24)
+      .
+      This network will be used for admin endpoints.
+  os-internal-network:
+    type: string
+    description: |
+      The IP address and netmask of the OpenStack Internal network (e.g.,
+      192.168.0.0/24)
+      .
+      This network will be used for internal endpoints.
+  os-public-network:
+    type: string
+    description: |
+      The IP address and netmask of the OpenStack Public network (e.g.,
+      192.168.0.0/24)
+      .
+      This network will be used for public endpoints.
+  prefer-ipv6:
+    type: boolean
+    default: False
+    description: |
+      If True enables IPv6 support. The charm will expect network interfaces
+      to be configured with an IPv6 address. If set to False (default) IPv4
+      is expected.
+      .
+      NOTE: these charms do not currently support IPv6 privacy extension. In
+      order for this charm to function correctly, the privacy extension must be
+      disabled and a non-temporary address must be configured/available on
+      your network interface.
 
=== modified file 'hooks/charmhelpers/contrib/hahelpers/apache.py'
--- hooks/charmhelpers/contrib/hahelpers/apache.py	2014-03-27 11:23:24 +0000
+++ hooks/charmhelpers/contrib/hahelpers/apache.py	2014-10-06 15:38:41 +0000
@@ -20,20 +20,27 @@
 )
 
 
-def get_cert():
+def get_cert(cn=None):
+    # TODO: deal with multiple https endpoints via charm config
     cert = config_get('ssl_cert')
     key = config_get('ssl_key')
     if not (cert and key):
         log("Inspecting identity-service relations for SSL certificate.",
             level=INFO)
         cert = key = None
+        if cn:
+            ssl_cert_attr = 'ssl_cert_{}'.format(cn)
+            ssl_key_attr = 'ssl_key_{}'.format(cn)
+        else:
+            ssl_cert_attr = 'ssl_cert'
+            ssl_key_attr = 'ssl_key'
         for r_id in relation_ids('identity-service'):
             for unit in relation_list(r_id):
                 if not cert:
-                    cert = relation_get('ssl_cert',
+                    cert = relation_get(ssl_cert_attr,
                                         rid=r_id, unit=unit)
                 if not key:
-                    key = relation_get('ssl_key',
+                    key = relation_get(ssl_key_attr,
                                        rid=r_id, unit=unit)
     return (cert, key)
 
 
=== modified file 'hooks/charmhelpers/contrib/hahelpers/cluster.py'
--- hooks/charmhelpers/contrib/hahelpers/cluster.py	2014-03-27 11:23:24 +0000
+++ hooks/charmhelpers/contrib/hahelpers/cluster.py	2014-10-06 15:38:41 +0000
@@ -6,6 +6,11 @@
 #  Adam Gandelman <[e-mail]>
 #
 
+"""
+Helpers for clustering and determining "cluster leadership" and other
+clustering-related helpers.
+"""
+
 import subprocess
 import os
 
@@ -19,6 +24,7 @@
     config as config_get,
     INFO,
     ERROR,
+    WARNING,
     unit_get,
 )
 
@@ -27,6 +33,29 @@
     pass
 
 
+def is_elected_leader(resource):
+    """
+    Returns True if the charm executing this is the elected cluster leader.
+
+    It relies on two mechanisms to determine leadership:
+        1. If the charm is part of a corosync cluster, call corosync to
+        determine leadership.
+        2. If the charm is not part of a corosync cluster, the leader is
+        determined as being "the alive unit with the lowest unit numer". In
+        other words, the oldest surviving unit.
+    """
+    if is_clustered():
+        if not is_crm_leader(resource):
+            log('Deferring action to CRM leader.', level=INFO)
+            return False
+    else:
+        peers = peer_units()
+        if peers and not oldest_peer(peers):
+            log('Deferring action to oldest service unit.', level=INFO)
+            return False
+    return True
+
+
 def is_clustered():
     for r_id in (relation_ids('ha') or []):
         for unit in (relation_list(r_id) or []):
@@ -38,7 +67,11 @@
     return False
 
 
-def is_leader(resource):
+def is_crm_leader(resource):
+    """
+    Returns True if the charm calling this is the elected corosync leader,
+    as returned by calling the external "crm" command.
+    """
     cmd = [
         "crm", "resource",
         "show", resource
@@ -54,15 +87,31 @@
             return False
 
 
-def peer_units():
+def is_leader(resource):
+    log("is_leader is deprecated. Please consider using is_crm_leader "
+        "instead.", level=WARNING)
+    return is_crm_leader(resource)
+
+
+def peer_units(peer_relation="cluster"):
     peers = []
-    for r_id in (relation_ids('cluster') or []):
+    for r_id in (relation_ids(peer_relation) or []):
         for unit in (relation_list(r_id) or []):
             peers.append(unit)
     return peers
 
 
+def peer_ips(peer_relation='cluster', addr_key='private-address'):
+    '''Return a dict of peers and their private-address'''
+    peers = {}
+    for r_id in relation_ids(peer_relation):
+        for unit in relation_list(r_id):
+            peers[unit] = relation_get(addr_key, rid=r_id, unit=unit)
+    return peers
+
+
 def oldest_peer(peers):
+    """Determines who the oldest peer is by comparing unit numbers."""
     local_unit_no = int(os.getenv('JUJU_UNIT_NAME').split('/')[1])
     for peer in peers:
         remote_unit_no = int(peer.split('/')[1])
@@ -72,16 +121,9 @@
 
 
 def eligible_leader(resource):
-    if is_clustered():
-        if not is_leader(resource):
-            log('Deferring action to CRM leader.', level=INFO)
-            return False
-    else:
-        peers = peer_units()
-        if peers and not oldest_peer(peers):
-            log('Deferring action to oldest service unit.', level=INFO)
-            return False
-    return True
+    log("eligible_leader is deprecated. Please consider using "
+        "is_elected_leader instead.", level=WARNING)
+    return is_elected_leader(resource)
 
 
 def https():
@@ -97,10 +139,9 @@
         return True
     for r_id in relation_ids('identity-service'):
         for unit in relation_list(r_id):
+            # TODO - needs fixing for new helper as ssl_cert/key suffixes with CN
             rel_state = [
                 relation_get('https_keystone', rid=r_id, unit=unit),
-                relation_get('ssl_cert', rid=r_id, unit=unit),
-                relation_get('ssl_key', rid=r_id, unit=unit),
                 relation_get('ca_cert', rid=r_id, unit=unit),
             ]
             # NOTE: works around (LP: #1203241)
@@ -146,12 +187,12 @@
     Obtains all relevant configuration from charm configuration required
     for initiating a relation to hacluster:
 
-        ha-bindiface, ha-mcastport, vip, vip_iface, vip_cidr
+        ha-bindiface, ha-mcastport, vip
 
     returns: dict: A dict containing settings keyed by setting name.
     raises: HAIncompleteConfig if settings are missing.
     '''
-    settings = ['ha-bindiface', 'ha-mcastport', 'vip', 'vip_iface', 'vip_cidr']
+    settings = ['ha-bindiface', 'ha-mcastport', 'vip']
     conf = {}
     for setting in settings:
         conf[setting] = config_get(setting)
@@ -170,6 +211,7 @@
 
     :configs    : OSTemplateRenderer: A config tempating object to inspect for
                                       a complete https context.
+
     :vip_setting:                str: Setting in charm config that specifies
                                       VIP address.
     '''
 
=== added directory 'hooks/charmhelpers/contrib/network'
=== added file 'hooks/charmhelpers/contrib/network/__init__.py'
=== added file 'hooks/charmhelpers/contrib/network/ip.py'
--- hooks/charmhelpers/contrib/network/ip.py	1970-01-01 00:00:00 +0000
+++ hooks/charmhelpers/contrib/network/ip.py	2014-10-06 15:38:41 +0000
@@ -0,0 +1,343 @@
+import glob
+import re
+import subprocess
+import sys
+
+from functools import partial
+
+from charmhelpers.core.hookenv import unit_get
+from charmhelpers.fetch import apt_install
+from charmhelpers.core.hookenv import (
+    WARNING,
+    ERROR,
+    log
+)
+
+try:
+    import netifaces
+except ImportError:
+    apt_install('python-netifaces')
+    import netifaces
+
+try:
+    import netaddr
+except ImportError:
+    apt_install('python-netaddr')
+    import netaddr
+
+
+def _validate_cidr(network):
+    try:
+        netaddr.IPNetwork(network)
+    except (netaddr.core.AddrFormatError, ValueError):
+        raise ValueError("Network (%s) is not in CIDR presentation format" %
+                         network)
+
+
+def get_address_in_network(network, fallback=None, fatal=False):
+    """
+    Get an IPv4 or IPv6 address within the network from the host.
+
+    :param network (str): CIDR presentation format. For example,
+        '192.168.1.0/24'.
+    :param fallback (str): If no address is found, return fallback.
+    :param fatal (boolean): If no address is found, fallback is not
+        set and fatal is True then exit(1).
+
+    """
+
+    def not_found_error_out():
+        log("No IP address found in network: %s" % network,
+            level=ERROR)
+        sys.exit(1)
+
+    if network is None:
+        if fallback is not None:
+            return fallback
+        else:
+            if fatal:
+                not_found_error_out()
+
+    _validate_cidr(network)
+    network = netaddr.IPNetwork(network)
+    for iface in netifaces.interfaces():
+        addresses = netifaces.ifaddresses(iface)
+        if network.version == 4 and netifaces.AF_INET in addresses:
+            addr = addresses[netifaces.AF_INET][0]['addr']
+            netmask = addresses[netifaces.AF_INET][0]['netmask']
+            cidr = netaddr.IPNetwork("%s/%s" % (addr, netmask))
+            if cidr in network:
+                return str(cidr.ip)
+        if network.version == 6 and netifaces.AF_INET6 in addresses:
+            for addr in addresses[netifaces.AF_INET6]:
+                if not addr['addr'].startswith('fe80'):
+                    cidr = netaddr.IPNetwork("%s/%s" % (addr['addr'],
+                                                        addr['netmask']))
+                    if cidr in network:
+                        return str(cidr.ip)
+
+    if fallback is not None:
+        return fallback
+
+    if fatal:
+        not_found_error_out()
+
+    return None
+
+
+def is_ipv6(address):
+    '''Determine whether provided address is IPv6 or not'''
+    try:
+        address = netaddr.IPAddress(address)
+    except netaddr.AddrFormatError:
+        # probably a hostname - so not an address at all!
+        return False
+    else:
+        return address.version == 6
+
+
+def is_address_in_network(network, address):
+    """
+    Determine whether the provided address is within a network range.
+
+    :param network (str): CIDR presentation format. For example,
+        '192.168.1.0/24'.
+    :param address: An individual IPv4 or IPv6 address without a net
+        mask or subnet prefix. For example, '192.168.1.1'.
+    :returns boolean: Flag indicating whether address is in network.
+    """
+    try:
+        network = netaddr.IPNetwork(network)
+    except (netaddr.core.AddrFormatError, ValueError):
+        raise ValueError("Network (%s) is not in CIDR presentation format" %
+                         network)
+    try:
+        address = netaddr.IPAddress(address)
+    except (netaddr.core.AddrFormatError, ValueError):
+        raise ValueError("Address (%s) is not in correct presentation format" %
+                         address)
+    if address in network:
+        return True
+    else:
+        return False
+
+
+def _get_for_address(address, key):
+    """Retrieve an attribute of or the physical interface that
+    the IP address provided could be bound to.
+
+    :param address (str): An individual IPv4 or IPv6 address without a net
+        mask or subnet prefix. For example, '192.168.1.1'.
+    :param key: 'iface' for the physical interface name or an attribute
+        of the configured interface, for example 'netmask'.
+    :returns str: Requested attribute or None if address is not bindable.
+    """
+    address = netaddr.IPAddress(address)
+    for iface in netifaces.interfaces():
+        addresses = netifaces.ifaddresses(iface)
+        if address.version == 4 and netifaces.AF_INET in addresses:
+            addr = addresses[netifaces.AF_INET][0]['addr']
+            netmask = addresses[netifaces.AF_INET][0]['netmask']
+            cidr = netaddr.IPNetwork("%s/%s" % (addr, netmask))
+            if address in cidr:
+                if key == 'iface':
+                    return iface
+                else:
+                    return addresses[netifaces.AF_INET][0][key]
+        if address.version == 6 and netifaces.AF_INET6 in addresses:
+            for addr in addresses[netifaces.AF_INET6]:
+                if not addr['addr'].startswith('fe80'):
+                    cidr = netaddr.IPNetwork("%s/%s" % (addr['addr'],
+                                                        addr['netmask']))
+                    if address in cidr:
+                        if key == 'iface':
+                            return iface
+                        else:
+                            return addr[key]
+    return None
+
+
+get_iface_for_address = partial(_get_for_address, key='iface')
+
+get_netmask_for_address = partial(_get_for_address, key='netmask')
+
+
+def format_ipv6_addr(address):
+    """
+    IPv6 needs to be wrapped with [] in url link to parse correctly.
+    """
+    if is_ipv6(address):
+        address = "[%s]" % address
+    else:
+        log("Not a valid ipv6 address: %s" % address, level=WARNING)
+        address = None
+
+    return address
+
+
+def get_iface_addr(iface='eth0', inet_type='AF_INET', inc_aliases=False,
+                   fatal=True, exc_list=None):
+    """
+    Return the assigned IP address for a given interface, if any, or [].
+    """
+    # Extract nic if passed /dev/ethX
+    if '/' in iface:
+        iface = iface.split('/')[-1]
+    if not exc_list:
+        exc_list = []
+    try:
+        inet_num = getattr(netifaces, inet_type)
+    except AttributeError:
+        raise Exception('Unknown inet type ' + str(inet_type))
+
+    interfaces = netifaces.interfaces()
+    if inc_aliases:
+        ifaces = []
+        for _iface in interfaces:
+            if iface == _iface or _iface.split(':')[0] == iface:
+                ifaces.append(_iface)
+        if fatal and not ifaces:
+            raise Exception("Invalid interface '%s'" % iface)
+        ifaces.sort()
+    else:
+        if iface not in interfaces:
+            if fatal:
+                raise Exception("%s not found " % (iface))
+            else:
+                return []
+        else:
+            ifaces = [iface]
+
+    addresses = []
+    for netiface in ifaces:
+        net_info = netifaces.ifaddresses(netiface)
+        if inet_num in net_info:
+            for entry in net_info[inet_num]:
+                if 'addr' in entry and entry['addr'] not in exc_list:
+                    addresses.append(entry['addr'])
+    if fatal and not addresses:
+        raise Exception("Interface '%s' doesn't have any %s addresses." %
+                        (iface, inet_type))
+    return addresses
+
+get_ipv4_addr = partial(get_iface_addr, inet_type='AF_INET')
+
+
+def get_iface_from_addr(addr):
+    """Work out on which interface the provided address is configured."""
+    for iface in netifaces.interfaces():
+        addresses = netifaces.ifaddresses(iface)
+        for inet_type in addresses:
+            for _addr in addresses[inet_type]:
+                _addr = _addr['addr']
+                # link local
+                ll_key = re.compile("(.+)%.*")
+                raw = re.match(ll_key, _addr)
+                if raw:
+                    _addr = raw.group(1)
+                if _addr == addr:
+                    log("Address '%s' is configured on iface '%s'" %
+                        (addr, iface))
+                    return iface
+
+    msg = "Unable to infer net iface on which '%s' is configured" % (addr)
+    raise Exception(msg)
+
+
+def sniff_iface(f):
+    """If no iface provided, inject net iface inferred from unit private
+    address.
+    """
+    def iface_sniffer(*args, **kwargs):
+        if not kwargs.get('iface', None):
+            kwargs['iface'] = get_iface_from_addr(unit_get('private-address'))
+
+        return f(*args, **kwargs)
+
+    return iface_sniffer
+
+
+@sniff_iface
+def get_ipv6_addr(iface=None, inc_aliases=False, fatal=True, exc_list=None,
+                  dynamic_only=True):
+    """Get assigned IPv6 address for a given interface.
+
+    Returns list of addresses found. If no address found, returns empty list.
+
+    If iface is None, we infer the current primary interface by doing a reverse
+    lookup on the unit private-address.
+
+    We currently only support scope global IPv6 addresses i.e. non-temporary
+    addresses. If no global IPv6 address is found, return the first one found
+    in the ipv6 address list.
+    """
+    addresses = get_iface_addr(iface=iface, inet_type='AF_INET6',
+                               inc_aliases=inc_aliases, fatal=fatal,
+                               exc_list=exc_list)
+
+    if addresses:
+        global_addrs = []
+        for addr in addresses:
+            key_scope_link_local = re.compile("^fe80::..(.+)%(.+)")
+            m = re.match(key_scope_link_local, addr)
+            if m:
+                eui_64_mac = m.group(1)
+                iface = m.group(2)
+            else:
+                global_addrs.append(addr)
+
+        if global_addrs:
+            # Make sure any found global addresses are not temporary
+            cmd = ['ip', 'addr', 'show', iface]
+            out = subprocess.check_output(cmd)
+            if dynamic_only:
+                key = re.compile("inet6 (.+)/[0-9]+ scope global dynamic.*")
+            else:
+                key = re.compile("inet6 (.+)/[0-9]+ scope global.*")
+
+            addrs = []
+            for line in out.split('\n'):
+                line = line.strip()
+                m = re.match(key, line)
+                if m and 'temporary' not in line:
+                    # Return the first valid address we find
+                    for addr in global_addrs:
+                        if m.group(1) == addr:
+                            if not dynamic_only or \
+                                    m.group(1).endswith(eui_64_mac):
+                                addrs.append(addr)
+
+            if addrs:
+                return addrs
+
+    if fatal:
+        raise Exception("Interface '%s' doesn't have a scope global "
+                        "non-temporary ipv6 address." % iface)
+
+    return []
+
+
+def get_bridges(vnic_dir='/sys/devices/virtual/net'):
+    """
+    Return a list of bridges on the system or []
+    """
+    b_rgex = vnic_dir + '/*/bridge'
+    return [x.replace(vnic_dir, '').split('/')[1] for x in glob.glob(b_rgex)]
+
+
+def get_bridge_nics(bridge, vnic_dir='/sys/devices/virtual/net'):
+    """
+    Return a list of nics comprising a given bridge on the system or []
+    """
+    brif_rgex = "%s/%s/brif/*" % (vnic_dir, bridge)
+    return [x.split('/')[-1] for x in glob.glob(brif_rgex)]
+
+
+def is_bridge_member(nic):
+    """
+    Check if a given nic is a member of a bridge
+    """
+    for bridge in get_bridges():
+        if nic in get_bridge_nics(bridge):
+            return True
+    return False
 
=== added directory 'hooks/charmhelpers/contrib/openstack/amulet'
=== added file 'hooks/charmhelpers/contrib/openstack/amulet/__init__.py'
=== added file 'hooks/charmhelpers/contrib/openstack/amulet/deployment.py'
--- hooks/charmhelpers/contrib/openstack/amulet/deployment.py	1970-01-01 00:00:00 +0000
+++ hooks/charmhelpers/contrib/openstack/amulet/deployment.py	2014-10-06 15:38:41 +0000
@@ -0,0 +1,94 @@
+from bzrlib.branch import Branch
+import os
+import re
+from charmhelpers.contrib.amulet.deployment import (
+    AmuletDeployment
+)
+
+
+class OpenStackAmuletDeployment(AmuletDeployment):
+    """OpenStack amulet deployment.
+
+       This class inherits from AmuletDeployment and has additional support
+       that is specifically for use by OpenStack charms.
+       """
+
+    def __init__(self, series=None, openstack=None, source=None):
+        """Initialize the deployment environment."""
+        super(OpenStackAmuletDeployment, self).__init__(series)
+        self.openstack = openstack
+        self.source = source
+
+    def _is_dev_branch(self):
+        """Determine if branch being tested is a dev (i.e. next) branch."""
+        branch = Branch.open(os.getcwd())
+        parent = branch.get_parent()
+        pattern = re.compile("^.*/next/$")
+        if (pattern.match(parent)):
+            return True
+        else:
+            return False
+
+    def _determine_branch_locations(self, other_services):
+        """Determine the branch locations for the other services.
+
+           If the branch being tested is a dev branch, then determine the
+           development branch locations for the other services. Otherwise,
+           the default charm store branches will be used."""
+        name = 0
+        if self._is_dev_branch():
+            updated_services = []
+            for svc in other_services:
+                if svc[name] in ['mysql', 'mongodb', 'rabbitmq-server']:
+                    location = 'lp:charms/{}'.format(svc[name])
+                else:
+                    temp = 'lp:~openstack-charmers/charms/trusty/{}/next'
+                    location = temp.format(svc[name])
+                updated_services.append(svc + (location,))
+            other_services = updated_services
+        return other_services
+
+    def _add_services(self, this_service, other_services):
+        """Add services to the deployment and set openstack-origin/source."""
+        name = 0
+        other_services = self._determine_branch_locations(other_services)
+        super(OpenStackAmuletDeployment, self)._add_services(this_service,
+                                                             other_services)
+        services = other_services
+        services.append(this_service)
+        use_source = ['mysql', 'mongodb', 'rabbitmq-server', 'ceph']
+
+        if self.openstack:
+            for svc in services:
+                if svc[name] not in use_source:
+                    config = {'openstack-origin': self.openstack}
+                    self.d.configure(svc[name], config)
+
+        if self.source:
+            for svc in services:
+                if svc[name] in use_source:
+                    config = {'source': self.source}
+                    self.d.configure(svc[name], config)
+
+    def _configure_services(self, configs):
+        """Configure all of the services."""
+        for service, config in configs.iteritems():
+            self.d.configure(service, config)
+
+    def _get_openstack_release(self):
+        """Get openstack release.
+
+           Return an integer representing the enum value of the openstack
+           release.
+           """
+        (self.precise_essex, self.precise_folsom, self.precise_grizzly,
+         self.precise_havana, self.precise_icehouse,
+         self.trusty_icehouse) = range(6)
+        releases = {
+            ('precise', None): self.precise_essex,
+            ('precise', 'cloud:precise-folsom'): self.precise_folsom,
+            ('precise', 'cloud:precise-grizzly'): self.precise_grizzly,
+            ('precise', 'cloud:precise-havana'): self.precise_havana,
+            ('precise', 'cloud:precise-icehouse'): self.precise_icehouse,
+            ('trusty', None): self.trusty_icehouse}
+        return releases[(self.series, self.openstack)]
 
=== added file 'hooks/charmhelpers/contrib/openstack/amulet/utils.py'
--- hooks/charmhelpers/contrib/openstack/amulet/utils.py	1970-01-01 00:00:00 +0000
+++ hooks/charmhelpers/contrib/openstack/amulet/utils.py	2014-10-06 15:38:41 +0000
@@ -0,0 +1,276 @@
+import logging
+import os
+import time
+import urllib
+
+import glanceclient.v1.client as glance_client
+import keystoneclient.v2_0 as keystone_client
+import novaclient.v1_1.client as nova_client
+
+from charmhelpers.contrib.amulet.utils import (
+    AmuletUtils
+)
+
+DEBUG = logging.DEBUG
+ERROR = logging.ERROR
+
+
+class OpenStackAmuletUtils(AmuletUtils):
+    """OpenStack amulet utilities.
+
+       This class inherits from AmuletUtils and has additional support
+       that is specifically for use by OpenStack charms.
+       """
+
+    def __init__(self, log_level=ERROR):
+        """Initialize the deployment environment."""
+        super(OpenStackAmuletUtils, self).__init__(log_level)
+
+    def validate_endpoint_data(self, endpoints, admin_port, internal_port,
+                               public_port, expected):
+        """Validate endpoint data.
+
+           Validate actual endpoint data vs expected endpoint data. The ports
+           are used to find the matching endpoint.
+           """
+        found = False
+        for ep in endpoints:
+            self.log.debug('endpoint: {}'.format(repr(ep)))
+            if (admin_port in ep.adminurl and
+                    internal_port in ep.internalurl and
+                    public_port in ep.publicurl):
+                found = True
+                actual = {'id': ep.id,
+                          'region': ep.region,
+                          'adminurl': ep.adminurl,
+                          'internalurl': ep.internalurl,
+                          'publicurl': ep.publicurl,
+                          'service_id': ep.service_id}
+                ret = self._validate_dict_data(expected, actual)
+                if ret:
+                    return 'unexpected endpoint data - {}'.format(ret)
+
+        if not found:
+            return 'endpoint not found'
+
+    def validate_svc_catalog_endpoint_data(self, expected, actual):
+        """Validate service catalog endpoint data.
+
+           Validate a list of actual service catalog endpoints vs a list of
+           expected service catalog endpoints.
+           """
+        self.log.debug('actual: {}'.format(repr(actual)))
+        for k, v in expected.iteritems():
+            if k in actual:
+                ret = self._validate_dict_data(expected[k][0], actual[k][0])
+                if ret:
+                    return self.endpoint_error(k, ret)
+            else:
+                return "endpoint {} does not exist".format(k)
+        return ret
+
+    def validate_tenant_data(self, expected, actual):
+        """Validate tenant data.
+
+           Validate a list of actual tenant data vs list of expected tenant
+           data.
+           """
+        self.log.debug('actual: {}'.format(repr(actual)))
+        for e in expected:
+            found = False
+            for act in actual:
+                a = {'enabled': act.enabled, 'description': act.description,
+                     'name': act.name, 'id': act.id}
+                if e['name'] == a['name']:
+                    found = True
+                    ret = self._validate_dict_data(e, a)
+                    if ret:
+                        return "unexpected tenant data - {}".format(ret)
+            if not found:
+                return "tenant {} does not exist".format(e['name'])
+        return ret
+
+    def validate_role_data(self, expected, actual):
+        """Validate role data.
+
+           Validate a list of actual role data vs a list of expected role
+           data.
+           """
+        self.log.debug('actual: {}'.format(repr(actual)))
+        for e in expected:
+            found = False
+            for act in actual:
+                a = {'name': act.name, 'id': act.id}
+                if e['name'] == a['name']:
+                    found = True
+                    ret = self._validate_dict_data(e, a)
+                    if ret:
+                        return "unexpected role data - {}".format(ret)
+            if not found:
+                return "role {} does not exist".format(e['name'])
+        return ret
+
+    def validate_user_data(self, expected, actual):
+        """Validate user data.
+
+           Validate a list of actual user data vs a list of expected user
+           data.
+           """
+        self.log.debug('actual: {}'.format(repr(actual)))
+        for e in expected:
+            found = False
+            for act in actual:
+                a = {'enabled': act.enabled, 'name': act.name,
+                     'email': act.email, 'tenantId': act.tenantId,
+                     'id': act.id}
+                if e['name'] == a['name']:
+                    found = True
+                    ret = self._validate_dict_data(e, a)
+                    if ret:
+                        return "unexpected user data - {}".format(ret)
+            if not found:
+                return "user {} does not exist".format(e['name'])
+        return ret
+
+    def validate_flavor_data(self, expected, actual):
+        """Validate flavor data.
+
+           Validate a list of actual flavors vs a list of expected flavors.
+           """
+        self.log.debug('actual: {}'.format(repr(actual)))
+        act = [a.name for a in actual]
+        return self._validate_list_data(expected, act)
+
+    def tenant_exists(self, keystone, tenant):
+        """Return True if tenant exists."""
+        return tenant in [t.name for t in keystone.tenants.list()]
+
+    def authenticate_keystone_admin(self, keystone_sentry, user, password,
+                                    tenant):
+        """Authenticates admin user with the keystone admin endpoint."""
+        unit = keystone_sentry
+        service_ip = unit.relation('shared-db',
+                                   'mysql:shared-db')['private-address']
+        ep = "http://{}:35357/v2.0".format(service_ip.strip().decode('utf-8'))
+        return keystone_client.Client(username=user, password=password,
+                                      tenant_name=tenant, auth_url=ep)
+
+    def authenticate_keystone_user(self, keystone, user, password, tenant):
+        """Authenticates a regular user with the keystone public endpoint."""
+        ep = keystone.service_catalog.url_for(service_type='identity',
+                                              endpoint_type='publicURL')
+        return keystone_client.Client(username=user, password=password,
+                                      tenant_name=tenant, auth_url=ep)
+
+    def authenticate_glance_admin(self, keystone):
+        """Authenticates admin user with glance."""
+        ep = keystone.service_catalog.url_for(service_type='image',
+                                              endpoint_type='adminURL')
+        return glance_client.Client(ep, token=keystone.auth_token)
+
+    def authenticate_nova_user(self, keystone, user, password, tenant):
+        """Authenticates a regular user with nova-api."""
+        ep = keystone.service_catalog.url_for(service_type='identity',
+                                              endpoint_type='publicURL')
+        return nova_client.Client(username=user, api_key=password,
+                                  project_id=tenant, auth_url=ep)
+
+    def create_cirros_image(self, glance, image_name):
+        """Download the latest cirros image and upload it to glance."""
+        http_proxy = os.getenv('AMULET_HTTP_PROXY')
+        self.log.debug('AMULET_HTTP_PROXY: {}'.format(http_proxy))
+        if http_proxy:
+            proxies = {'http': http_proxy}
+            opener = urllib.FancyURLopener(proxies)
+        else:
+            opener = urllib.FancyURLopener()
+
+        f = opener.open("http://download.cirros-cloud.net/version/released")
+        version = f.read().strip()
+        cirros_img = "cirros-{}-x86_64-disk.img".format(version)
+        local_path = os.path.join('tests', cirros_img)
+
+        if not os.path.exists(local_path):
+            cirros_url = "http://{}/{}/{}".format("download.cirros-cloud.net",
+                                                  version, cirros_img)
+            opener.retrieve(cirros_url, local_path)
+        f.close()
+
+        with open(local_path) as f:
+            image = glance.images.create(name=image_name, is_public=True,
+                                         disk_format='qcow2',
+                                         container_format='bare', data=f)
+        count = 1
+        status = image.status
+        while status != 'active' and count < 10:
+            time.sleep(3)
+            image = glance.images.get(image.id)
+            status = image.status
+            self.log.debug('image status: {}'.format(status))
+            count += 1
+
+        if status != 'active':
+            self.log.error('image creation timed out')
+            return None
+
+        return image
+
+    def delete_image(self, glance, image):
+        """Delete the specified image."""
+        num_before = len(list(glance.images.list()))
+        glance.images.delete(image)
+
+        count = 1
+        num_after = len(list(glance.images.list()))
+        while num_after != (num_before - 1) and count < 10:
+            time.sleep(3)
+            num_after = len(list(glance.images.list()))
+            self.log.debug('number of images: {}'.format(num_after))
+            count += 1
+
+        if num_after != (num_before - 1):
+            self.log.error('image deletion timed out')
+            return False
+
+        return True
+
+    def create_instance(self, nova, image_name, instance_name, flavor):
+        """Create the specified instance."""
+        image = nova.images.find(name=image_name)
+        flavor = nova.flavors.find(name=flavor)
+        instance = nova.servers.create(name=instance_name, image=image,
+                                       flavor=flavor)
+
+        count = 1
+        status = instance.status
+        while status != 'ACTIVE' and count < 60:
+            time.sleep(3)
+            instance = nova.servers.get(instance.id)
+            status = instance.status
+            self.log.debug('instance status: {}'.format(status))
+            count += 1
+
+        if status != 'ACTIVE':
+            self.log.error('instance creation timed out')
+            return None
+
+        return instance
+
+    def delete_instance(self, nova, instance):
+        """Delete the specified instance."""
+        num_before = len(list(nova.servers.list()))
+        nova.servers.delete(instance)
+
+        count = 1
+        num_after = len(list(nova.servers.list()))
+        while num_after != (num_before - 1) and count < 10:
+            time.sleep(3)
+            num_after = len(list(nova.servers.list()))
+            self.log.debug('number of instances: {}'.format(num_after))
+            count += 1
+
+        if num_after != (num_before - 1):
+            self.log.error('instance deletion timed out')
+            return False
+
+        return True
 
=== modified file 'hooks/charmhelpers/contrib/openstack/context.py'
--- hooks/charmhelpers/contrib/openstack/context.py	2014-08-13 15:57:07 +0000
+++ hooks/charmhelpers/contrib/openstack/context.py	2014-10-06 15:38:41 +0000
@@ -8,7 +8,6 @@
     check_call
 )
 
-
 from charmhelpers.fetch import (
     apt_install,
     filter_installed_packages,
@@ -21,10 +20,20 @@
     relation_get,
     relation_ids,
     related_units,
+    relation_set,
     unit_get,
     unit_private_ip,
     ERROR,
-    INFO
+<<<<<<< TREE
+    INFO
+=======
+    INFO
+)
+
+from charmhelpers.core.host import (
+    mkdir,
+    write_file
+>>>>>>> MERGE-SOURCE
 )
 
 from charmhelpers.contrib.hahelpers.cluster import (
@@ -37,12 +46,20 @@
 from charmhelpers.contrib.hahelpers.apache import (
     get_cert,
     get_ca_cert,
+    install_ca_cert,
 )
 
 from charmhelpers.contrib.openstack.neutron import (
     neutron_plugin_attribute,
 )
 
+from charmhelpers.contrib.network.ip import (
+    get_address_in_network,
+    get_ipv6_addr,
+    format_ipv6_addr,
+    is_address_in_network
+)
+
 CA_CERT_PATH = '/usr/local/share/ca-certificates/keystone_juju_ca_cert.crt'
 
 
@@ -135,8 +152,26 @@
                 'Missing required charm config options. '
                 '(database name and user)')
             raise OSContextError
+
         ctxt = {}
 
+        # NOTE(jamespage) if mysql charm provides a network upon which
+        # access to the database should be made, reconfigure relation
+        # with the service units local address and defer execution
+        access_network = relation_get('access-network')
+        if access_network is not None:
+            if self.relation_prefix is not None:
+                hostname_key = "{}_hostname".format(self.relation_prefix)
+            else:
+                hostname_key = "hostname"
+            access_hostname = get_address_in_network(access_network,
+                                                     unit_get('private-address'))
+            set_hostname = relation_get(attribute=hostname_key,
+                                        unit=local_unit())
+            if set_hostname != access_hostname:
+                relation_set(relation_settings={hostname_key: access_hostname})
+                return ctxt  # Defer any further hook execution for now....
+
         password_setting = 'password'
         if self.relation_prefix:
             password_setting = self.relation_prefix + '_password'
@@ -144,8 +179,10 @@
         for rid in relation_ids('shared-db'):
             for unit in related_units(rid):
                 rdata = relation_get(rid=rid, unit=unit)
+                host = rdata.get('db_host')
+                host = format_ipv6_addr(host) or host
                 ctxt = {
-                    'database_host': rdata.get('db_host'),
+                    'database_host': host,
                     'database': self.database,
                     'database_user': self.user,
                     'database_password': rdata.get(password_setting),
@@ -221,10 +258,15 @@
         for rid in relation_ids('identity-service'):
             for unit in related_units(rid):
                 rdata = relation_get(rid=rid, unit=unit)
+                serv_host = rdata.get('service_host')
+                serv_host = format_ipv6_addr(serv_host) or serv_host
+                auth_host = rdata.get('auth_host')
+                auth_host = format_ipv6_addr(auth_host) or auth_host
+
                 ctxt = {
                     'service_port': rdata.get('service_port'),
-                    'service_host': rdata.get('service_host'),
-                    'auth_host': rdata.get('auth_host'),
+                    'service_host': serv_host,
+                    'auth_host': auth_host,
                     'auth_port': rdata.get('auth_port'),
                     'admin_tenant_name': rdata.get('service_tenant'),
                     'admin_user': rdata.get('service_username'),
@@ -244,32 +286,42 @@
 
 
 class AMQPContext(OSContextGenerator):
-    interfaces = ['amqp']
 
-    def __init__(self, ssl_dir=None):
+    def __init__(self, ssl_dir=None, rel_name='amqp', relation_prefix=None):
         self.ssl_dir = ssl_dir
+        self.rel_name = rel_name
+        self.relation_prefix = relation_prefix
+        self.interfaces = [rel_name]
 
     def __call__(self):
         log('Generating template context for amqp')
         conf = config()
+        user_setting = 'rabbit-user'
+        vhost_setting = 'rabbit-vhost'
+        if self.relation_prefix:
+            user_setting = self.relation_prefix + '-rabbit-user'
+            vhost_setting = self.relation_prefix + '-rabbit-vhost'
+
         try:
-            username = conf['rabbit-user']
-            vhost = conf['rabbit-vhost']
+            username = conf[user_setting]
+            vhost = conf[vhost_setting]
         except KeyError as e:
             log('Could not generate shared_db context. '
                 'Missing required charm config options: %s.' % e)
             raise OSContextError
         ctxt = {}
-        for rid in relation_ids('amqp'):
+        for rid in relation_ids(self.rel_name):
             ha_vip_only = False
             for unit in related_units(rid):
                 if relation_get('clustered', rid=rid, unit=unit):
                     ctxt['clustered'] = True
-                    ctxt['rabbitmq_host'] = relation_get('vip', rid=rid,
-                                                         unit=unit)
+                    vip = relation_get('vip', rid=rid, unit=unit)
+                    vip = format_ipv6_addr(vip) or vip
+                    ctxt['rabbitmq_host'] = vip
                 else:
-                    ctxt['rabbitmq_host'] = relation_get('private-address',
-                                                         rid=rid, unit=unit)
+                    host = relation_get('private-address', rid=rid, unit=unit)
+                    host = format_ipv6_addr(host) or host
+                    ctxt['rabbitmq_host'] = host
                 ctxt.update({
                     'rabbitmq_user': username,
                     'rabbitmq_password': relation_get('password', rid=rid,
@@ -308,8 +360,9 @@
                     and len(related_units(rid)) > 1:
                 rabbitmq_hosts = []
                 for unit in related_units(rid):
-                    rabbitmq_hosts.append(relation_get('private-address',
-                                                       rid=rid, unit=unit))
+                    host = relation_get('private-address', rid=rid, unit=unit)
+                    host = format_ipv6_addr(host) or host
+                    rabbitmq_hosts.append(host)
                 ctxt['rabbitmq_hosts'] = ','.join(rabbitmq_hosts)
         if not context_complete(ctxt):
             return {}
@@ -333,10 +386,13 @@
         use_syslog = str(config('use-syslog')).lower()
         for rid in relation_ids('ceph'):
             for unit in related_units(rid):
-                mon_hosts.append(relation_get('private-address', rid=rid,
-                                              unit=unit))
                 auth = relation_get('auth', rid=rid, unit=unit)
                 key = relation_get('key', rid=rid, unit=unit)
+                ceph_addr = \
+                    relation_get('ceph-public-address', rid=rid, unit=unit) or \
+                    relation_get('private-address', rid=rid, unit=unit)
+                ceph_addr = format_ipv6_addr(ceph_addr) or ceph_addr
+                mon_hosts.append(ceph_addr)
 
         ctxt = {
             'mon_hosts': ' '.join(mon_hosts),
@@ -370,7 +426,14 @@
 
         cluster_hosts = {}
         l_unit = local_unit().replace('/', '-')
-        cluster_hosts[l_unit] = unit_get('private-address')
+
+        if config('prefer-ipv6'):
+            addr = get_ipv6_addr(exc_list=[config('vip')])[0]
+        else:
+            addr = unit_get('private-address')
+
+        cluster_hosts[l_unit] = get_address_in_network(config('os-internal-network'),
+                                                       addr)
 
         for rid in relation_ids('cluster'):
             for unit in related_units(rid):
@@ -381,6 +444,21 @@
         ctxt = {
             'units': cluster_hosts,
         }
+
+        if config('haproxy-server-timeout'):
+            ctxt['haproxy_server_timeout'] = config('haproxy-server-timeout')
+        if config('haproxy-client-timeout'):
+            ctxt['haproxy_client_timeout'] = config('haproxy-client-timeout')
+
+        if config('prefer-ipv6'):
+            ctxt['local_host'] = 'ip6-localhost'
+            ctxt['haproxy_host'] = '::'
+            ctxt['stat_port'] = ':::8888'
+        else:
+            ctxt['local_host'] = '127.0.0.1'
+            ctxt['haproxy_host'] = '0.0.0.0'
+            ctxt['stat_port'] = ':8888'
+
         if len(cluster_hosts.keys()) > 1:
             # Enable haproxy when we have enough peers.
             log('Ensuring haproxy enabled in /etc/default/haproxy.')
@@ -419,12 +497,13 @@
     """
     Generates a context for an apache vhost configuration that configures
     HTTPS reverse proxying for one or many endpoints.  Generated context
-    looks something like:
-    {
-        'namespace': 'cinder',
-        'private_address': 'iscsi.mycinderhost.com',
-        'endpoints': [(8776, 8766), (8777, 8767)]
-    }
+    looks something like::
+
+        {
+            'namespace': 'cinder',
+            'private_address': 'iscsi.mycinderhost.com',
+            'endpoints': [(8776, 8766), (8777, 8767)]
+        }
 
     The endpoints list consists of a tuples mapping external ports
     to internal ports.
@@ -440,22 +519,36 @@
         cmd = ['a2enmod', 'ssl', 'proxy', 'proxy_http']
         check_call(cmd)
 
-    def configure_cert(self):
-        if not os.path.isdir('/etc/apache2/ssl'):
-            os.mkdir('/etc/apache2/ssl')
+    def configure_cert(self, cn=None):
         ssl_dir = os.path.join('/etc/apache2/ssl/', self.service_namespace)
-        if not os.path.isdir(ssl_dir):
-            os.mkdir(ssl_dir)
-        cert, key = get_cert()
-        with open(os.path.join(ssl_dir, 'cert'), 'w') as cert_out:
-            cert_out.write(b64decode(cert))
-        with open(os.path.join(ssl_dir, 'key'), 'w') as key_out:
-            key_out.write(b64decode(key))
+        mkdir(path=ssl_dir)
+        cert, key = get_cert(cn)
+        if cn:
+            cert_filename = 'cert_{}'.format(cn)
+            key_filename = 'key_{}'.format(cn)
+        else:
+            cert_filename = 'cert'
+            key_filename = 'key'
+        write_file(path=os.path.join(ssl_dir, cert_filename),
+                   content=b64decode(cert))
+        write_file(path=os.path.join(ssl_dir, key_filename),
+                   content=b64decode(key))
+
+    def configure_ca(self):
         ca_cert = get_ca_cert()
         if ca_cert:
-            with open(CA_CERT_PATH, 'w') as ca_out:
-                ca_out.write(b64decode(ca_cert))
-            check_call(['update-ca-certificates'])
+            install_ca_cert(b64decode(ca_cert))
+
+    def canonical_names(self):
+        '''Figure out which canonical names clients will access this service'''
+        cns = []
+        for r_id in relation_ids('identity-service'):
+            for unit in related_units(r_id):
+                rdata = relation_get(rid=r_id, unit=unit)
+                for k in rdata:
+                    if k.startswith('ssl_key_'):
+                        cns.append(k.lstrip('ssl_key_'))
+        return list(set(cns))
 
     def __call__(self):
         if isinstance(self.external_ports, basestring):
@@ -463,21 +556,47 @@
         if (not self.external_ports or not https()):
             return {}
 
-        self.configure_cert()
+        self.configure_ca()
         self.enable_modules()
 
         ctxt = {
             'namespace': self.service_namespace,
-            'private_address': unit_get('private-address'),
-            'endpoints': []
+            'endpoints': [],
+            'ext_ports': []
         }
-        if is_clustered():
-            ctxt['private_address'] = config('vip')
-        for api_port in self.external_ports:
-            ext_port = determine_apache_port(api_port)
-            int_port = determine_api_port(api_port)
-            portmap = (int(ext_port), int(int_port))
-            ctxt['endpoints'].append(portmap)
+
+        for cn in self.canonical_names():
+            self.configure_cert(cn)
+
+        addresses = []
+        vips = []
+        if config('vip'):
+            vips = config('vip').split()
+
+        for network_type in ['os-internal-network',
+                             'os-admin-network',
+                             'os-public-network']:
+            address = get_address_in_network(config(network_type),
+                                             unit_get('private-address'))
+            if len(vips) > 0 and is_clustered():
+                for vip in vips:
+                    if is_address_in_network(config(network_type),
+                                             vip):
+                        addresses.append((address, vip))
+                        break
+            elif is_clustered():
+                addresses.append((address, config('vip')))
+            else:
+                addresses.append((address, address))
+
+        for address, endpoint in set(addresses):
+            for api_port in self.external_ports:
+                ext_port = determine_apache_port(api_port)
+                int_port = determine_api_port(api_port)
+                portmap = (address, endpoint, int(ext_port), int(int_port))
+                ctxt['endpoints'].append(portmap)
+                ctxt['ext_ports'].append(int(ext_port))
+        ctxt['ext_ports'] = list(set(ctxt['ext_ports']))
         return ctxt
 
 
@@ -542,6 +661,26 @@
 
         return nvp_ctxt
 
+    def n1kv_ctxt(self):
+        driver = neutron_plugin_attribute(self.plugin, 'driver',
+                                          self.network_manager)
+        n1kv_config = neutron_plugin_attribute(self.plugin, 'config',
+                                               self.network_manager)
+        n1kv_ctxt = {
+            'core_plugin': driver,
+            'neutron_plugin': 'n1kv',
+            'neutron_security_groups': self.neutron_security_groups,
+            'local_ip': unit_private_ip(),
+            'config': n1kv_config,
+            'vsm_ip': config('n1kv-vsm-ip'),
+            'vsm_username': config('n1kv-vsm-username'),
+            'vsm_password': config('n1kv-vsm-password'),
+            'restrict_policy_profiles': config(
+                'n1kv_restrict_policy_profiles'),
+        }
+
+        return n1kv_ctxt
+
     def neutron_ctxt(self):
         if https():
             proto = 'https'
@@ -573,6 +712,8 @@
             ctxt.update(self.ovs_ctxt())
         elif self.plugin in ['nvp', 'nsx']:
             ctxt.update(self.nvp_ctxt())
+        elif self.plugin == 'n1kv':
+            ctxt.update(self.n1kv_ctxt())
 
         alchemy_flags = config('neutron-alchemy-flags')
         if alchemy_flags:
@@ -612,7 +753,7 @@
     The subordinate interface allows subordinates to export their
     configuration requirements to the principle for multiple config
     files and multiple serivces.  Ie, a subordinate that has interfaces
-    to both glance and nova may export to following yaml blob as json:
+    to both glance and nova may export to following yaml blob as json::
 
         glance:
             /etc/glance/glance-api.conf:
@@ -631,7 +772,8 @@
 
     It is then up to the principle charms to subscribe this context to
     the service+config file it is interestd in.  Configuration data will
-    be available in the template context, in glance's case, as:
+    be available in the template context, in glance's case, as::
+
         ctxt = {
             ... other context ...
             'subordinate_config': {
@@ -684,15 +826,38 @@
 
                     sub_config = sub_config[self.config_file]
                     for k, v in sub_config.iteritems():
-                        if k == 'sections':
-                            for section, config_dict in v.iteritems():
-                                log("adding section '%s'" % (section))
-                                ctxt[k][section] = config_dict
-                        else:
-                            ctxt[k] = v
-
-        log("%d section(s) found" % (len(ctxt['sections'])), level=INFO)
-
+<<<<<<< TREE
+                        if k == 'sections':
+                            for section, config_dict in v.iteritems():
+                                log("adding section '%s'" % (section))
+                                ctxt[k][section] = config_dict
+                        else:
+                            ctxt[k] = v
+
+        log("%d section(s) found" % (len(ctxt['sections'])), level=INFO)
+
+=======
+                        if k == 'sections':
+                            for section, config_dict in v.iteritems():
+                                log("adding section '%s'" % (section))
+                                ctxt[k][section] = config_dict
+                        else:
+                            ctxt[k] = v
+
+        log("%d section(s) found" % (len(ctxt['sections'])), level=INFO)
+
+        return ctxt
+
+
+class LogLevelContext(OSContextGenerator):
+
+    def __call__(self):
+        ctxt = {}
+        ctxt['debug'] = \
+            False if config('debug') is None else config('debug')
+        ctxt['verbose'] = \
+            False if config('verbose') is None else config('verbose')
+>>>>>>> MERGE-SOURCE
         return ctxt
 
 
@@ -703,3 +868,16 @@
             'use_syslog': config('use-syslog')
         }
         return ctxt
+
+
+class BindHostContext(OSContextGenerator):
+
+    def __call__(self):
+        if config('prefer-ipv6'):
+            return {
+                'bind_host': '::'
+            }
+        else:
+            return {
+                'bind_host': '0.0.0.0'
+            }
 
=== added file 'hooks/charmhelpers/contrib/openstack/ip.py'
--- hooks/charmhelpers/contrib/openstack/ip.py	1970-01-01 00:00:00 +0000
+++ hooks/charmhelpers/contrib/openstack/ip.py	2014-10-06 15:38:41 +0000
@@ -0,0 +1,79 @@
+from charmhelpers.core.hookenv import (
+    config,
+    unit_get,
+)
+
+from charmhelpers.contrib.network.ip import (
+    get_address_in_network,
+    is_address_in_network,
+    is_ipv6,
+    get_ipv6_addr,
+)
+
+from charmhelpers.contrib.hahelpers.cluster import is_clustered
+
+PUBLIC = 'public'
+INTERNAL = 'int'
+ADMIN = 'admin'
+
+_address_map = {
+    PUBLIC: {
+        'config': 'os-public-network',
+        'fallback': 'public-address'
+    },
+    INTERNAL: {
+        'config': 'os-internal-network',
+        'fallback': 'private-address'
+    },
+    ADMIN: {
+        'config': 'os-admin-network',
+        'fallback': 'private-address'
+    }
+}
+
+
+def canonical_url(configs, endpoint_type=PUBLIC):
+    '''
+    Returns the correct HTTP URL to this host given the state of HTTPS
+    configuration, hacluster and charm configuration.
+
+    :configs OSTemplateRenderer: A config tempating object to inspect for
+        a complete https context.
+    :endpoint_type str: The endpoint type to resolve.
+
+    :returns str: Base URL for services on the current service unit.
+    '''
+    scheme = 'http'
+    if 'https' in configs.complete_contexts():
+        scheme = 'https'
+    address = resolve_address(endpoint_type)
+    if is_ipv6(address):
+        address = "[{}]".format(address)
+    return '%s://%s' % (scheme, address)
+
+
+def resolve_address(endpoint_type=PUBLIC):
+    resolved_address = None
+    if is_clustered():
+        if config(_address_map[endpoint_type]['config']) is None:
+            # Assume vip is simple and pass back directly
+            resolved_address = config('vip')
+        else:
+            for vip in config('vip').split():
+                if is_address_in_network(
+                        config(_address_map[endpoint_type]['config']),
+                        vip):
+                    resolved_address = vip
+    else:
+        if config('prefer-ipv6'):
+            fallback_addr = get_ipv6_addr(exc_list=[config('vip')])[0]
+        else:
+            fallback_addr = unit_get(_address_map[endpoint_type]['fallback'])
+        resolved_address = get_address_in_network(
+            config(_address_map[endpoint_type]['config']), fallback_addr)
+
+    if resolved_address is None:
+        raise ValueError('Unable to resolve a suitable IP address'
+                         ' based on charm state and configuration')
+    else:
+        return resolved_address
 
=== modified file 'hooks/charmhelpers/contrib/openstack/neutron.py'
--- hooks/charmhelpers/contrib/openstack/neutron.py	2014-05-19 11:39:11 +0000
+++ hooks/charmhelpers/contrib/openstack/neutron.py	2014-10-06 15:38:41 +0000
@@ -128,6 +128,20 @@
             'server_packages': ['neutron-server',
                                 'neutron-plugin-vmware'],
             'server_services': ['neutron-server']
+        },
+        'n1kv': {
+            'config': '/etc/neutron/plugins/cisco/cisco_plugins.ini',
+            'driver': 'neutron.plugins.cisco.network_plugin.PluginV2',
+            'contexts': [
+                context.SharedDBContext(user=config('neutron-database-user'),
+                                        database=config('neutron-database'),
+                                        relation_prefix='neutron',
+                                        ssl_dir=NEUTRON_CONF_DIR)],
+            'services': [],
+            'packages': [['neutron-plugin-cisco']],
+            'server_packages': ['neutron-server',
+                                'neutron-plugin-cisco'],
+            'server_services': ['neutron-server']
         }
     }
     if release >= 'icehouse':
 
=== modified file 'hooks/charmhelpers/contrib/openstack/templates/haproxy.cfg'
--- hooks/charmhelpers/contrib/openstack/templates/haproxy.cfg	2014-03-27 11:23:24 +0000
+++ hooks/charmhelpers/contrib/openstack/templates/haproxy.cfg	2014-10-06 15:38:41 +0000
@@ -1,6 +1,6 @@
 global
-    log 127.0.0.1 local0
-    log 127.0.0.1 local1 notice
+    log {{ local_host }} local0
+    log {{ local_host }} local1 notice
     maxconn 20000
     user haproxy
     group haproxy
@@ -14,10 +14,19 @@
     retries 3
     timeout queue 1000
     timeout connect 1000
+{% if haproxy_client_timeout -%}
+    timeout client {{ haproxy_client_timeout }}
+{% else -%}
     timeout client 30000
+{% endif -%}
+
+{% if haproxy_server_timeout -%}
+    timeout server {{ haproxy_server_timeout }}
+{% else -%}
     timeout server 30000
+{% endif -%}
 
-listen stats :8888
+listen stats {{ stat_port }}
     mode http
     stats enable
     stats hide-version
@@ -27,7 +36,12 @@
 
 {% if units -%}
 {% for service, ports in service_ports.iteritems() -%}
-listen {{ service }} 0.0.0.0:{{ ports[0] }}
+listen {{ service }}_ipv4 0.0.0.0:{{ ports[0] }}
+    balance roundrobin
+    {% for unit, address in units.iteritems() -%}
+    server {{ unit }} {{ address }}:{{ ports[1] }} check
+    {% endfor %}
+listen {{ service }}_ipv6 :::{{ ports[0] }}
     balance roundrobin
     {% for unit, address in units.iteritems() -%}
     server {{ unit }} {{ address }}:{{ ports[1] }} check
 
=== modified file 'hooks/charmhelpers/contrib/openstack/templates/openstack_https_frontend'
--- hooks/charmhelpers/contrib/openstack/templates/openstack_https_frontend	2013-09-27 12:02:37 +0000
+++ hooks/charmhelpers/contrib/openstack/templates/openstack_https_frontend	2014-10-06 15:38:41 +0000
@@ -1,16 +1,18 @@
 {% if endpoints -%}
-{% for ext, int in endpoints -%}
-Listen {{ ext }}
-NameVirtualHost *:{{ ext }}
-<VirtualHost *:{{ ext }}>
-    ServerName {{ private_address }}
+{% for ext_port in ext_ports -%}
+Listen {{ ext_port }}
+{% endfor -%}
+{% for address, endpoint, ext, int in endpoints -%}
+<VirtualHost {{ address }}:{{ ext }}>
+    ServerName {{ endpoint }}
     SSLEngine on
-    SSLCertificateFile /etc/apache2/ssl/{{ namespace }}/cert
-    SSLCertificateKeyFile /etc/apache2/ssl/{{ namespace }}/key
+    SSLCertificateFile /etc/apache2/ssl/{{ namespace }}/cert_{{ endpoint }}
+    SSLCertificateKeyFile /etc/apache2/ssl/{{ namespace }}/key_{{ endpoint }}
     ProxyPass / http://localhost:{{ int }}/
     ProxyPassReverse / http://localhost:{{ int }}/
     ProxyPreserveHost on
 </VirtualHost>
+{% endfor -%}
 <Proxy *>
     Order deny,allow
     Allow from all
@@ -19,5 +21,4 @@
     Order allow,deny
     Allow from all
 </Location>
-{% endfor -%}
 {% endif -%}
 
=== modified file 'hooks/charmhelpers/contrib/openstack/templates/openstack_https_frontend.conf'
--- hooks/charmhelpers/contrib/openstack/templates/openstack_https_frontend.conf	2013-09-27 12:02:37 +0000
+++ hooks/charmhelpers/contrib/openstack/templates/openstack_https_frontend.conf	2014-10-06 15:38:41 +0000
@@ -1,16 +1,18 @@
 {% if endpoints -%}
-{% for ext, int in endpoints -%}
-Listen {{ ext }}
-NameVirtualHost *:{{ ext }}
-<VirtualHost *:{{ ext }}>
-    ServerName {{ private_address }}
+{% for ext_port in ext_ports -%}
+Listen {{ ext_port }}
+{% endfor -%}
+{% for address, endpoint, ext, int in endpoints -%}
+<VirtualHost {{ address }}:{{ ext }}>
+    ServerName {{ endpoint }}
     SSLEngine on
-    SSLCertificateFile /etc/apache2/ssl/{{ namespace }}/cert
-    SSLCertificateKeyFile /etc/apache2/ssl/{{ namespace }}/key
+    SSLCertificateFile /etc/apache2/ssl/{{ namespace }}/cert_{{ endpoint }}
+    SSLCertificateKeyFile /etc/apache2/ssl/{{ namespace }}/key_{{ endpoint }}
     ProxyPass / http://localhost:{{ int }}/
     ProxyPassReverse / http://localhost:{{ int }}/
     ProxyPreserveHost on
 </VirtualHost>
+{% endfor -%}
 <Proxy *>
     Order deny,allow
     Allow from all
@@ -19,5 +21,4 @@
     Order allow,deny
     Allow from all
 </Location>
-{% endfor -%}
 {% endif -%}
 
=== modified file 'hooks/charmhelpers/contrib/openstack/templating.py'
--- hooks/charmhelpers/contrib/openstack/templating.py	2013-09-27 12:02:37 +0000
+++ hooks/charmhelpers/contrib/openstack/templating.py	2014-10-06 15:38:41 +0000
@@ -30,17 +30,17 @@
     loading dir.
 
     A charm may also ship a templates dir with this module
-    and it will be appended to the bottom of the search list, eg:
-    hooks/charmhelpers/contrib/openstack/templates.
-
-    :param templates_dir: str: Base template directory containing release
-                               sub-directories.
-    :param os_release   : str: OpenStack release codename to construct template
-                               loader.
-
-    :returns            : jinja2.ChoiceLoader constructed with a list of
-                          jinja2.FilesystemLoaders, ordered in descending
-                          order by OpenStack release.
+    and it will be appended to the bottom of the search list, eg::
+
+        hooks/charmhelpers/contrib/openstack/templates
+
+    :param templates_dir (str): Base template directory containing release
+        sub-directories.
+    :param os_release (str): OpenStack release codename to construct template
+        loader.
+    :returns: jinja2.ChoiceLoader constructed with a list of
+        jinja2.FilesystemLoaders, ordered in descending
+        order by OpenStack release.
     """
     tmpl_dirs = [(rel, os.path.join(templates_dir, rel))
                  for rel in OPENSTACK_CODENAMES.itervalues()]
@@ -111,7 +111,8 @@
     and ease the burden of managing config templates across multiple OpenStack
     releases.
 
-    Basic usage:
+    Basic usage::
+
         # import some common context generates from charmhelpers
         from charmhelpers.contrib.openstack import context
 
@@ -131,21 +132,19 @@
         # write out all registered configs
         configs.write_all()
 
-    Details:
+    **OpenStack Releases and template loading**
 
-    OpenStack Releases and template loading
-    ---------------------------------------
     When the object is instantiated, it is associated with a specific OS
     release.  This dictates how the template loader will be constructed.
 
     The constructed loader attempts to load the template from several places
     in the following order:
-        - from the most recent OS release-specific template dir (if one exists)
-        - the base templates_dir
-        - a template directory shipped in the charm with this helper file.
-
-
-    For the example above, '/tmp/templates' contains the following structure:
+    - from the most recent OS release-specific template dir (if one exists)
+    - the base templates_dir
+    - a template directory shipped in the charm with this helper file.
+
+    For the example above, '/tmp/templates' contains the following structure::
+
         /tmp/templates/nova.conf
         /tmp/templates/api-paste.ini
         /tmp/templates/grizzly/api-paste.ini
@@ -169,8 +168,8 @@
     $CHARM/hooks/charmhelpers/contrib/openstack/templates.  This allows
     us to ship common templates (haproxy, apache) with the helpers.
 
-    Context generators
-    ---------------------------------------
+    **Context generators**
+
     Context generators are used to generate template contexts during hook
     execution.  Doing so may require inspecting service relations, charm
     config, etc.  When registered, a config file is associated with a list
 
=== modified file 'hooks/charmhelpers/contrib/openstack/utils.py'
--- hooks/charmhelpers/contrib/openstack/utils.py	2014-08-27 07:17:33 +0000
+++ hooks/charmhelpers/contrib/openstack/utils.py	2014-10-06 15:38:41 +0000
@@ -3,8 +3,8 @@
 # Common python helper functions used for OpenStack charms.
 from collections import OrderedDict
 
-import apt_pkg as apt
 import subprocess
+import json
 import os
 import socket
 import sys
@@ -14,7 +14,9 @@
     log as juju_log,
     charm_dir,
     ERROR,
-    INFO
+    INFO,
+    relation_ids,
+    relation_set
 )
 
 from charmhelpers.contrib.storage.linux.lvm import (
@@ -23,6 +25,10 @@
     remove_lvm_physical_volume,
 )
 
+from charmhelpers.contrib.network.ip import (
+    get_ipv6_addr
+)
+
 from charmhelpers.core.host import lsb_release, mounts, umount
 from charmhelpers.fetch import apt_install, apt_cache
 from charmhelpers.contrib.storage.linux.utils import is_block_device, zap_disk
@@ -41,7 +47,8 @@
     ('quantal', 'folsom'),
     ('raring', 'grizzly'),
     ('saucy', 'havana'),
-    ('trusty', 'icehouse')
+    ('trusty', 'icehouse'),
+    ('utopic', 'juno'),
 ])
 
 
@@ -52,6 +59,7 @@
     ('2013.1', 'grizzly'),
     ('2013.2', 'havana'),
     ('2014.1', 'icehouse'),
+    ('2014.2', 'juno'),
 ])
 
 # The ugly duckling
@@ -69,6 +77,7 @@
     ('1.13.0', 'icehouse'),
     ('1.12.0', 'icehouse'),
     ('1.11.0', 'icehouse'),
+    ('2.0.0', 'juno'),
 ])
 
 DEFAULT_LOOPBACK_SIZE = '5G'
@@ -83,6 +92,8 @@
     '''Derive OpenStack release codename from a given installation source.'''
     ubuntu_rel = lsb_release()['DISTRIB_CODENAME']
     rel = ''
+    if src is None:
+        return rel
     if src in ['distro', 'distro-proposed']:
         try:
             rel = UBUNTU_OPENSTACK_RELEASE[ubuntu_rel]
@@ -130,8 +141,14 @@
 
 def get_os_codename_package(package, fatal=True):
     '''Derive OpenStack release codename from an installed package.'''
-
-    cache = apt_cache()
+<<<<<<< TREE
+
+    cache = apt_cache()
+=======
+    import apt_pkg as apt
+
+    cache = apt_cache()
+>>>>>>> MERGE-SOURCE
 
     try:
         pkg = cache[package]
@@ -182,7 +199,7 @@
     for version, cname in vers_map.iteritems():
         if cname == codename:
             return version
-    #e = "Could not determine OpenStack version for package: %s" % pkg
+    # e = "Could not determine OpenStack version for package: %s" % pkg
     # error_out(e)
 
 
@@ -268,6 +285,9 @@
             'icehouse': 'precise-updates/icehouse',
             'icehouse/updates': 'precise-updates/icehouse',
             'icehouse/proposed': 'precise-proposed/icehouse',
+            'juno': 'trusty-updates/juno',
+            'juno/updates': 'trusty-updates/juno',
+            'juno/proposed': 'trusty-proposed/juno',
         }
 
         try:
@@ -315,6 +335,7 @@
 
     """
 
+    import apt_pkg as apt
     src = config('openstack-origin')
     cur_vers = get_os_version_package(package)
     available_vers = get_os_version_install_source(src)
@@ -448,3 +469,21 @@
             return result
     else:
         return result.split('.')[0]
+
+
+def sync_db_with_multi_ipv6_addresses(database, database_user,
+                                      relation_prefix=None):
+    hosts = get_ipv6_addr(dynamic_only=False)
+
+    kwargs = {'database': database,
+              'username': database_user,
+              'hostname': json.dumps(hosts)}
+
+    if relation_prefix:
+        keys = kwargs.keys()
+        for key in keys:
+            kwargs["%s_%s" % (relation_prefix, key)] = kwargs[key]
+            del kwargs[key]
+
+    for rid in relation_ids('shared-db'):
+        relation_set(relation_id=rid, **kwargs)
 
=== added directory 'hooks/charmhelpers/contrib/peerstorage'
=== added file 'hooks/charmhelpers/contrib/peerstorage/__init__.py'
--- hooks/charmhelpers/contrib/peerstorage/__init__.py	1970-01-01 00:00:00 +0000
+++ hooks/charmhelpers/contrib/peerstorage/__init__.py	2014-10-06 15:38:41 +0000
@@ -0,0 +1,131 @@
+from charmhelpers.core.hookenv import relation_id as current_relation_id
+from charmhelpers.core.hookenv import (
+    is_relation_made,
+    relation_ids,
+    relation_get,
+    local_unit,
+    relation_set,
+)
+
+
+"""
+This helper provides functions to support use of a peer relation
+for basic key/value storage, with the added benefit that all storage
+can be replicated across peer units.
+
+Requirement to use:
+
+To use this, the "peer_echo()" method has to be called form the peer
+relation's relation-changed hook:
+
[e-mail]("cluster-relation-changed") # Adapt the to your peer relation name
+def cluster_relation_changed():
+    peer_echo()
+
+Once this is done, you can use peer storage from anywhere:
+
[e-mail]("some-hook")
+def some_hook():
+    # You can store and retrieve key/values this way:
+    if is_relation_made("cluster"):  # from charmhelpers.core.hookenv
+        # There are peers available so we can work with peer storage
+        peer_store("mykey", "myvalue")
+        value = peer_retrieve("mykey")
+        print value
+    else:
+        print "No peers joind the relation, cannot share key/values :("
+"""
+
+
+def peer_retrieve(key, relation_name='cluster'):
+    """Retrieve a named key from peer relation `relation_name`."""
+    cluster_rels = relation_ids(relation_name)
+    if len(cluster_rels) > 0:
+        cluster_rid = cluster_rels[0]
+        return relation_get(attribute=key, rid=cluster_rid,
+                            unit=local_unit())
+    else:
+        raise ValueError('Unable to detect'
+                         'peer relation {}'.format(relation_name))
+
+
+def peer_retrieve_by_prefix(prefix, relation_name='cluster', delimiter='_',
+                            inc_list=None, exc_list=None):
+    """ Retrieve k/v pairs given a prefix and filter using {inc,exc}_list """
+    inc_list = inc_list if inc_list else []
+    exc_list = exc_list if exc_list else []
+    peerdb_settings = peer_retrieve('-', relation_name=relation_name)
+    matched = {}
+    for k, v in peerdb_settings.items():
+        full_prefix = prefix + delimiter
+        if k.startswith(full_prefix):
+            new_key = k.replace(full_prefix, '')
+            if new_key in exc_list:
+                continue
+            if new_key in inc_list or len(inc_list) == 0:
+                matched[new_key] = v
+    return matched
+
+
+def peer_store(key, value, relation_name='cluster'):
+    """Store the key/value pair on the named peer relation `relation_name`."""
+    cluster_rels = relation_ids(relation_name)
+    if len(cluster_rels) > 0:
+        cluster_rid = cluster_rels[0]
+        relation_set(relation_id=cluster_rid,
+                     relation_settings={key: value})
+    else:
+        raise ValueError('Unable to detect '
+                         'peer relation {}'.format(relation_name))
+
+
+def peer_echo(includes=None):
+    """Echo filtered attributes back onto the same relation for storage.
+
+    This is a requirement to use the peerstorage module - it needs to be called
+    from the peer relation's changed hook.
+    """
+    rdata = relation_get()
+    echo_data = {}
+    if includes is None:
+        echo_data = rdata.copy()
+        for ex in ['private-address', 'public-address']:
+            if ex in echo_data:
+                echo_data.pop(ex)
+    else:
+        for attribute, value in rdata.iteritems():
+            for include in includes:
+                if include in attribute:
+                    echo_data[attribute] = value
+    if len(echo_data) > 0:
+        relation_set(relation_settings=echo_data)
+
+
+def peer_store_and_set(relation_id=None, peer_relation_name='cluster',
+                       peer_store_fatal=False, relation_settings=None,
+                       delimiter='_', **kwargs):
+    """Store passed-in arguments both in argument relation and in peer storage.
+
+    It functions like doing relation_set() and peer_store() at the same time,
+    with the same data.
+
+    @param relation_id: the id of the relation to store the data on. Defaults
+                        to the current relation.
+    @param peer_store_fatal: Set to True, the function will raise an exception
+                             should the peer sotrage not be avialable."""
+
+    relation_settings = relation_settings if relation_settings else {}
+    relation_set(relation_id=relation_id,
+                 relation_settings=relation_settings,
+                 **kwargs)
+    if is_relation_made(peer_relation_name):
+        for key, value in dict(kwargs.items() +
+                               relation_settings.items()).iteritems():
+            key_prefix = relation_id or current_relation_id()
+            peer_store(key_prefix + delimiter + key,
+                       value,
+                       relation_name=peer_relation_name)
+    else:
+        if peer_store_fatal:
+            raise ValueError('Unable to detect '
+                             'peer relation {}'.format(peer_relation_name))
 
=== modified file 'hooks/charmhelpers/contrib/storage/linux/ceph.py'
--- hooks/charmhelpers/contrib/storage/linux/ceph.py	2014-02-24 17:51:34 +0000
+++ hooks/charmhelpers/contrib/storage/linux/ceph.py	2014-10-06 15:38:41 +0000
@@ -303,7 +303,7 @@
                         blk_device, fstype, system_services=[]):
     """
     NOTE: This function must only be called from a single service unit for
-          the same rbd_img otherwise data loss will occur.
+    the same rbd_img otherwise data loss will occur.
 
     Ensures given pool and RBD image exists, is mapped to a block device,
     and the device is formatted and mounted at the given mount_point.
 
=== added file 'hooks/charmhelpers/core/fstab.py'
--- hooks/charmhelpers/core/fstab.py	1970-01-01 00:00:00 +0000
+++ hooks/charmhelpers/core/fstab.py	2014-10-06 15:38:41 +0000
@@ -0,0 +1,116 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+
+__author__ = 'Jorge Niedbalski R. <[e-mail]>'
+
+import os
+
+
+class Fstab(file):
+    """This class extends file in order to implement a file reader/writer
+    for file `/etc/fstab`
+    """
+
+    class Entry(object):
+        """Entry class represents a non-comment line on the `/etc/fstab` file
+        """
+        def __init__(self, device, mountpoint, filesystem,
+                     options, d=0, p=0):
+            self.device = device
+            self.mountpoint = mountpoint
+            self.filesystem = filesystem
+
+            if not options:
+                options = "defaults"
+
+            self.options = options
+            self.d = d
+            self.p = p
+
+        def __eq__(self, o):
+            return str(self) == str(o)
+
+        def __str__(self):
+            return "{} {} {} {} {} {}".format(self.device,
+                                              self.mountpoint,
+                                              self.filesystem,
+                                              self.options,
+                                              self.d,
+                                              self.p)
+
+    DEFAULT_PATH = os.path.join(os.path.sep, 'etc', 'fstab')
+
+    def __init__(self, path=None):
+        if path:
+            self._path = path
+        else:
+            self._path = self.DEFAULT_PATH
+        file.__init__(self, self._path, 'r+')
+
+    def _hydrate_entry(self, line):
+        # NOTE: use split with no arguments to split on any
+        #       whitespace including tabs
+        return Fstab.Entry(*filter(
+            lambda x: x not in ('', None),
+            line.strip("\n").split()))
+
+    @property
+    def entries(self):
+        self.seek(0)
+        for line in self.readlines():
+            try:
+                if not line.startswith("#"):
+                    yield self._hydrate_entry(line)
+            except ValueError:
+                pass
+
+    def get_entry_by_attr(self, attr, value):
+        for entry in self.entries:
+            e_attr = getattr(entry, attr)
+            if e_attr == value:
+                return entry
+        return None
+
+    def add_entry(self, entry):
+        if self.get_entry_by_attr('device', entry.device):
+            return False
+
+        self.write(str(entry) + '\n')
+        self.truncate()
+        return entry
+
+    def remove_entry(self, entry):
+        self.seek(0)
+
+        lines = self.readlines()
+
+        found = False
+        for index, line in enumerate(lines):
+            if not line.startswith("#"):
+                if self._hydrate_entry(line) == entry:
+                    found = True
+                    break
+
+        if not found:
+            return False
+
+        lines.remove(line)
+
+        self.seek(0)
+        self.write(''.join(lines))
+        self.truncate()
+        return True
+
+    @classmethod
+    def remove_by_mountpoint(cls, mountpoint, path=None):
+        fstab = cls(path=path)
+        entry = fstab.get_entry_by_attr('mountpoint', mountpoint)
+        if entry:
+            return fstab.remove_entry(entry)
+        return False
+
+    @classmethod
+    def add(cls, device, mountpoint, filesystem, options=None, path=None):
+        return cls(path=path).add_entry(Fstab.Entry(device,
+                                                    mountpoint, filesystem,
+                                                    options=options))
 
=== renamed file 'hooks/charmhelpers/core/fstab.py' => 'hooks/charmhelpers/core/fstab.py.moved'
=== modified file 'hooks/charmhelpers/core/hookenv.py'
--- hooks/charmhelpers/core/hookenv.py	2014-05-19 11:39:11 +0000
+++ hooks/charmhelpers/core/hookenv.py	2014-10-06 15:38:41 +0000
@@ -25,7 +25,7 @@
 def cached(func):
     """Cache return values for multiple executions of func + args
 
-    For example:
+    For example::
 
         @cached
         def unit_get(attribute):
@@ -156,12 +156,15 @@
 
 
 class Config(dict):
-    """A Juju charm config dictionary that can write itself to
-    disk (as json) and track which values have changed since
-    the previous hook invocation.
-
-    Do not instantiate this object directly - instead call
-    ``hookenv.config()``
+    """A dictionary representation of the charm's config.yaml, with some
+    extra features:
+
+    - See which values in the dictionary have changed since the previous hook.
+    - For values that have changed, see what the previous value was.
+    - Store arbitrary data for use in a later hook.
+
+    NOTE: Do not instantiate this object directly - instead call
+    ``hookenv.config()``, which will return an instance of :class:`Config`.
 
     Example usage::
 
@@ -170,8 +173,8 @@
         >>> config = hookenv.config()
         >>> config['foo']
         'bar'
+        >>> # store a new key/value for later use
         >>> config['mykey'] = 'myval'
-        >>> config.save()
 
 
         >>> # user runs `juju set mycharm foo=baz`
@@ -188,22 +191,34 @@
         >>> # keys/values that we add are preserved across hooks
         >>> config['mykey']
         'myval'
-        >>> # don't forget to save at the end of hook!
-        >>> config.save()
 
     """
     CONFIG_FILE_NAME = '.juju-persistent-config'
 
     def __init__(self, *args, **kw):
         super(Config, self).__init__(*args, **kw)
+        self.implicit_save = True
         self._prev_dict = None
         self.path = os.path.join(charm_dir(), Config.CONFIG_FILE_NAME)
         if os.path.exists(self.path):
             self.load_previous()
 
+    def __getitem__(self, key):
+        """For regular dict lookups, check the current juju config first,
+        then the previous (saved) copy. This ensures that user-saved values
+        will be returned by a dict lookup.
+
+        """
+        try:
+            return dict.__getitem__(self, key)
+        except KeyError:
+            return (self._prev_dict or {})[key]
+
     def load_previous(self, path=None):
-        """Load previous copy of config from disk so that current values
-        can be compared to previous values.
+        """Load previous copy of config from disk.
+
+        In normal usage you don't need to call this method directly - it
+        is called automatically at object initialization.
 
         :param path:
 
@@ -218,8 +233,8 @@
             self._prev_dict = json.load(f)
 
     def changed(self, key):
-        """Return true if the value for this key has changed since
-        the last save.
+        """Return True if the current value for this key is different from
+        the previous value.
 
         """
         if self._prev_dict is None:
@@ -228,7 +243,7 @@
 
     def previous(self, key):
         """Return previous value for this key, or None if there
-        is no "previous" value.
+        is no previous value.
 
         """
         if self._prev_dict:
@@ -238,7 +253,13 @@
     def save(self):
         """Save this config to disk.
 
-        Preserves items in _prev_dict that do not exist in self.
+        If the charm is using the :mod:`Services Framework <services.base>`
+        or :meth:'@hook <Hooks.hook>' decorator, this
+        is called automatically at the end of successful hook execution.
+        Otherwise, it should be called directly by user code.
+
+        To disable automatic saves, set ``implicit_save=False`` on this
+        instance.
 
         """
         if self._prev_dict:
@@ -285,8 +306,9 @@
         raise
 
 
-def relation_set(relation_id=None, relation_settings={}, **kwargs):
+def relation_set(relation_id=None, relation_settings=None, **kwargs):
     """Set relation information for the current unit"""
+    relation_settings = relation_settings if relation_settings else {}
     relation_cmd_line = ['relation-set']
     if relation_id is not None:
         relation_cmd_line.extend(('-r', relation_id))
@@ -445,27 +467,29 @@
 class Hooks(object):
     """A convenient handler for hook functions.
 
-    Example:
+    Example::
+
         hooks = Hooks()
 
         # register a hook, taking its name from the function name
         @hooks.hook()
         def install():
-            ...
+            pass  # your code here
 
         # register a hook, providing a custom hook name
         @hooks.hook("config-changed")
         def config_changed():
-            ...
+            pass  # your code here
 
         if __name__ == "__main__":
             # execute a hook based on the name the program is called by
             hooks.execute(sys.argv)
     """
 
-    def __init__(self):
+    def __init__(self, config_save=True):
         super(Hooks, self).__init__()
         self._hooks = {}
+        self._config_save = config_save
 
     def register(self, name, function):
         """Register a hook"""
@@ -476,6 +500,10 @@
         hook_name = os.path.basename(args[0])
         if hook_name in self._hooks:
             self._hooks[hook_name]()
+            if self._config_save:
+                cfg = config()
+                if cfg.implicit_save:
+                    cfg.save()
         else:
             raise UnregisteredHookError(hook_name)
 
 
=== modified file 'hooks/charmhelpers/core/host.py'
--- hooks/charmhelpers/core/host.py	2014-08-27 07:17:33 +0000
+++ hooks/charmhelpers/core/host.py	2014-10-06 15:38:41 +0000
@@ -12,7 +12,8 @@
 import string
 import subprocess
 import hashlib
-import apt_pkg
+import shutil
+from contextlib import contextmanager
 
 from collections import OrderedDict
 
@@ -53,7 +54,7 @@
 def service_running(service):
     """Determine whether a system service is running"""
     try:
-        output = subprocess.check_output(['service', service, 'status'])
+        output = subprocess.check_output(['service', service, 'status'], stderr=subprocess.STDOUT)
     except subprocess.CalledProcessError:
         return False
     else:
@@ -63,6 +64,16 @@
             return False
 
 
+def service_available(service_name):
+    """Determine whether a system service is available"""
+    try:
+        subprocess.check_output(['service', service_name, 'status'], stderr=subprocess.STDOUT)
+    except subprocess.CalledProcessError as e:
+        return 'unrecognized service' not in e.output
+    else:
+        return True
+
+
 def adduser(username, password=None, shell='/bin/bash', system_user=False):
     """Add a user to the system"""
     try:
@@ -198,10 +209,15 @@
     return system_mounts
 
 
-def file_hash(path):
-    """Generate a md5 hash of the contents of 'path' or None if not found """
+def file_hash(path, hash_type='md5'):
+    """
+    Generate a hash checksum of the contents of 'path' or None if not found.
+
+    :param str hash_type: Any hash alrgorithm supported by :mod:`hashlib`,
+                          such as md5, sha1, sha256, sha512, etc.
+    """
     if os.path.exists(path):
-        h = hashlib.md5()
+        h = getattr(hashlib, hash_type)()
         with open(path, 'r') as source:
             h.update(source.read())  # IGNORE:E1101 - it does have update
         return h.hexdigest()
@@ -209,16 +225,36 @@
         return None
 
 
+def check_hash(path, checksum, hash_type='md5'):
+    """
+    Validate a file using a cryptographic checksum.
+
+    :param str checksum: Value of the checksum used to validate the file.
+    :param str hash_type: Hash algorithm used to generate `checksum`.
+        Can be any hash alrgorithm supported by :mod:`hashlib`,
+        such as md5, sha1, sha256, sha512, etc.
+    :raises ChecksumError: If the file fails the checksum
+
+    """
+    actual_checksum = file_hash(path, hash_type)
+    if checksum != actual_checksum:
+        raise ChecksumError("'%s' != '%s'" % (checksum, actual_checksum))
+
+
+class ChecksumError(ValueError):
+    pass
+
+
 def restart_on_change(restart_map, stopstart=False):
     """Restart services based on configuration files changing
 
-    This function is used a decorator, for example
+    This function is used a decorator, for example::
 
         @restart_on_change({
             '/etc/ceph/ceph.conf': [ 'cinder-api', 'cinder-volume' ]
             })
         def ceph_client_changed():
-            ...
+            pass  # your code here
 
     In this example, the cinder-api and cinder-volume services
     would be restarted if /etc/ceph/ceph.conf is changed by the
@@ -314,12 +350,40 @@
 
 def cmp_pkgrevno(package, revno, pkgcache=None):
     '''Compare supplied revno with the revno of the installed package
-       1 => Installed revno is greater than supplied arg
-       0 => Installed revno is the same as supplied arg
-      -1 => Installed revno is less than supplied arg
+
+    *  1 => Installed revno is greater than supplied arg
+    *  0 => Installed revno is the same as supplied arg
+    * -1 => Installed revno is less than supplied arg
+
     '''
-    from charmhelpers.fetch import apt_cache
+<<<<<<< TREE
+    from charmhelpers.fetch import apt_cache
+=======
+    import apt_pkg
+    from charmhelpers.fetch import apt_cache
+>>>>>>> MERGE-SOURCE
     if not pkgcache:
         pkgcache = apt_cache()
     pkg = pkgcache[package]
     return apt_pkg.version_compare(pkg.current_ver.ver_str, revno)
+
+
+@contextmanager
+def chdir(d):
+    cur = os.getcwd()
+    try:
+        yield os.chdir(d)
+    finally:
+        os.chdir(cur)
+
+
+def chownr(path, owner, group):
+    uid = pwd.getpwnam(owner).pw_uid
+    gid = grp.getgrnam(group).gr_gid
+
+    for root, dirs, files in os.walk(path):
+        for name in dirs + files:
+            full = os.path.join(root, name)
+            broken_symlink = os.path.lexists(full) and not os.path.exists(full)
+            if not broken_symlink:
+                os.chown(full, uid, gid)
 
=== added directory 'hooks/charmhelpers/core/services'
=== added file 'hooks/charmhelpers/core/services/__init__.py'
--- hooks/charmhelpers/core/services/__init__.py	1970-01-01 00:00:00 +0000
+++ hooks/charmhelpers/core/services/__init__.py	2014-10-06 15:38:41 +0000
@@ -0,0 +1,2 @@
+from .base import *
+from .helpers import *
 
=== added file 'hooks/charmhelpers/core/services/base.py'
--- hooks/charmhelpers/core/services/base.py	1970-01-01 00:00:00 +0000
+++ hooks/charmhelpers/core/services/base.py	2014-10-06 15:38:41 +0000
@@ -0,0 +1,313 @@
+import os
+import re
+import json
+from collections import Iterable
+
+from charmhelpers.core import host
+from charmhelpers.core import hookenv
+
+
+__all__ = ['ServiceManager', 'ManagerCallback',
+           'PortManagerCallback', 'open_ports', 'close_ports', 'manage_ports',
+           'service_restart', 'service_stop']
+
+
+class ServiceManager(object):
+    def __init__(self, services=None):
+        """
+        Register a list of services, given their definitions.
+
+        Service definitions are dicts in the following formats (all keys except
+        'service' are optional)::
+
+            {
+                "service": <service name>,
+                "required_data": <list of required data contexts>,
+                "provided_data": <list of provided data contexts>,
+                "data_ready": <one or more callbacks>,
+                "data_lost": <one or more callbacks>,
+                "start": <one or more callbacks>,
+                "stop": <one or more callbacks>,
+                "ports": <list of ports to manage>,
+            }
+
+        The 'required_data' list should contain dicts of required data (or
+        dependency managers that act like dicts and know how to collect the data).
+        Only when all items in the 'required_data' list are populated are the list
+        of 'data_ready' and 'start' callbacks executed.  See `is_ready()` for more
+        information.
+
+        The 'provided_data' list should contain relation data providers, most likely
+        a subclass of :class:`charmhelpers.core.services.helpers.RelationContext`,
+        that will indicate a set of data to set on a given relation.
+
+        The 'data_ready' value should be either a single callback, or a list of
+        callbacks, to be called when all items in 'required_data' pass `is_ready()`.
+        Each callback will be called with the service name as the only parameter.
+        After all of the 'data_ready' callbacks are called, the 'start' callbacks
+        are fired.
+
+        The 'data_lost' value should be either a single callback, or a list of
+        callbacks, to be called when a 'required_data' item no longer passes
+        `is_ready()`.  Each callback will be called with the service name as the
+        only parameter.  After all of the 'data_lost' callbacks are called,
+        the 'stop' callbacks are fired.
+
+        The 'start' value should be either a single callback, or a list of
+        callbacks, to be called when starting the service, after the 'data_ready'
+        callbacks are complete.  Each callback will be called with the service
+        name as the only parameter.  This defaults to
+        `[host.service_start, services.open_ports]`.
+
+        The 'stop' value should be either a single callback, or a list of
+        callbacks, to be called when stopping the service.  If the service is
+        being stopped because it no longer has all of its 'required_data', this
+        will be called after all of the 'data_lost' callbacks are complete.
+        Each callback will be called with the service name as the only parameter.
+        This defaults to `[services.close_ports, host.service_stop]`.
+
+        The 'ports' value should be a list of ports to manage.  The default
+        'start' handler will open the ports after the service is started,
+        and the default 'stop' handler will close the ports prior to stopping
+        the service.
+
+
+        Examples:
+
+        The following registers an Upstart service called bingod that depends on
+        a mongodb relation and which runs a custom `db_migrate` function prior to
+        restarting the service, and a Runit service called spadesd::
+
+            manager = services.ServiceManager([
+                {
+                    'service': 'bingod',
+                    'ports': [80, 443],
+                    'required_data': [MongoRelation(), config(), {'my': 'data'}],
+                    'data_ready': [
+                        services.template(source='bingod.conf'),
+                        services.template(source='bingod.ini',
+                                          target='/etc/bingod.ini',
+                                          owner='bingo', perms=0400),
+                    ],
+                },
+                {
+                    'service': 'spadesd',
+                    'data_ready': services.template(source='spadesd_run.j2',
+                                                    target='/etc/sv/spadesd/run',
+                                                    perms=0555),
+                    'start': runit_start,
+                    'stop': runit_stop,
+                },
+            ])
+            manager.manage()
+        """
+        self._ready_file = os.path.join(hookenv.charm_dir(), 'READY-SERVICES.json')
+        self._ready = None
+        self.services = {}
+        for service in services or []:
+            service_name = service['service']
+            self.services[service_name] = service
+
+    def manage(self):
+        """
+        Handle the current hook by doing The Right Thing with the registered services.
+        """
+        hook_name = hookenv.hook_name()
+        if hook_name == 'stop':
+            self.stop_services()
+        else:
+            self.provide_data()
+            self.reconfigure_services()
+        cfg = hookenv.config()
+        if cfg.implicit_save:
+            cfg.save()
+
+    def provide_data(self):
+        """
+        Set the relation data for each provider in the ``provided_data`` list.
+
+        A provider must have a `name` attribute, which indicates which relation
+        to set data on, and a `provide_data()` method, which returns a dict of
+        data to set.
+        """
+        hook_name = hookenv.hook_name()
+        for service in self.services.values():
+            for provider in service.get('provided_data', []):
+                if re.match(r'{}-relation-(joined|changed)'.format(provider.name), hook_name):
+                    data = provider.provide_data()
+                    _ready = provider._is_ready(data) if hasattr(provider, '_is_ready') else data
+                    if _ready:
+                        hookenv.relation_set(None, data)
+
+    def reconfigure_services(self, *service_names):
+        """
+        Update all files for one or more registered services, and,
+        if ready, optionally restart them.
+
+        If no service names are given, reconfigures all registered services.
+        """
+        for service_name in service_names or self.services.keys():
+            if self.is_ready(service_name):
+                self.fire_event('data_ready', service_name)
+                self.fire_event('start', service_name, default=[
+                    service_restart,
+                    manage_ports])
+                self.save_ready(service_name)
+            else:
+                if self.was_ready(service_name):
+                    self.fire_event('data_lost', service_name)
+                self.fire_event('stop', service_name, default=[
+                    manage_ports,
+                    service_stop])
+                self.save_lost(service_name)
+
+    def stop_services(self, *service_names):
+        """
+        Stop one or more registered services, by name.
+
+        If no service names are given, stops all registered services.
+        """
+        for service_name in service_names or self.services.keys():
+            self.fire_event('stop', service_name, default=[
+                manage_ports,
+                service_stop])
+
+    def get_service(self, service_name):
+        """
+        Given the name of a registered service, return its service definition.
+        """
+        service = self.services.get(service_name)
+        if not service:
+            raise KeyError('Service not registered: %s' % service_name)
+        return service
+
+    def fire_event(self, event_name, service_name, default=None):
+        """
+        Fire a data_ready, data_lost, start, or stop event on a given service.
+        """
+        service = self.get_service(service_name)
+        callbacks = service.get(event_name, default)
+        if not callbacks:
+            return
+        if not isinstance(callbacks, Iterable):
+            callbacks = [callbacks]
+        for callback in callbacks:
+            if isinstance(callback, ManagerCallback):
+                callback(self, service_name, event_name)
+            else:
+                callback(service_name)
+
+    def is_ready(self, service_name):
+        """
+        Determine if a registered service is ready, by checking its 'required_data'.
+
+        A 'required_data' item can be any mapping type, and is considered ready
+        if `bool(item)` evaluates as True.
+        """
+        service = self.get_service(service_name)
+        reqs = service.get('required_data', [])
+        return all(bool(req) for req in reqs)
+
+    def _load_ready_file(self):
+        if self._ready is not None:
+            return
+        if os.path.exists(self._ready_file):
+            with open(self._ready_file) as fp:
+                self._ready = set(json.load(fp))
+        else:
+            self._ready = set()
+
+    def _save_ready_file(self):
+        if self._ready is None:
+            return
+        with open(self._ready_file, 'w') as fp:
+            json.dump(list(self._ready), fp)
+
+    def save_ready(self, service_name):
+        """
+        Save an indicator that the given service is now data_ready.
+        """
+        self._load_ready_file()
+        self._ready.add(service_name)
+        self._save_ready_file()
+
+    def save_lost(self, service_name):
+        """
+        Save an indicator that the given service is no longer data_ready.
+        """
+        self._load_ready_file()
+        self._ready.discard(service_name)
+        self._save_ready_file()
+
+    def was_ready(self, service_name):
+        """
+        Determine if the given service was previously data_ready.
+        """
+        self._load_ready_file()
+        return service_name in self._ready
+
+
+class ManagerCallback(object):
+    """
+    Special case of a callback that takes the `ServiceManager` instance
+    in addition to the service name.
+
+    Subclasses should implement `__call__` which should accept three parameters:
+
+        * `manager`       The `ServiceManager` instance
+        * `service_name`  The name of the service it's being triggered for
+        * `event_name`    The name of the event that this callback is handling
+    """
+    def __call__(self, manager, service_name, event_name):
+        raise NotImplementedError()
+
+
+class PortManagerCallback(ManagerCallback):
+    """
+    Callback class that will open or close ports, for use as either
+    a start or stop action.
+    """
+    def __call__(self, manager, service_name, event_name):
+        service = manager.get_service(service_name)
+        new_ports = service.get('ports', [])
+        port_file = os.path.join(hookenv.charm_dir(), '.{}.ports'.format(service_name))
+        if os.path.exists(port_file):
+            with open(port_file) as fp:
+                old_ports = fp.read().split(',')
+            for old_port in old_ports:
+                if bool(old_port):
+                    old_port = int(old_port)
+                    if old_port not in new_ports:
+                        hookenv.close_port(old_port)
+        with open(port_file, 'w') as fp:
+            fp.write(','.join(str(port) for port in new_ports))
+        for port in new_ports:
+            if event_name == 'start':
+                hookenv.open_port(port)
+            elif event_name == 'stop':
+                hookenv.close_port(port)
+
+
+def service_stop(service_name):
+    """
+    Wrapper around host.service_stop to prevent spurious "unknown service"
+    messages in the logs.
+    """
+    if host.service_running(service_name):
+        host.service_stop(service_name)
+
+
+def service_restart(service_name):
+    """
+    Wrapper around host.service_restart to prevent spurious "unknown service"
+    messages in the logs.
+    """
+    if host.service_available(service_name):
+        if host.service_running(service_name):
+            host.service_restart(service_name)
+        else:
+            host.service_start(service_name)
+
+
+# Convenience aliases
+open_ports = close_ports = manage_ports = PortManagerCallback()
 
=== added file 'hooks/charmhelpers/core/services/helpers.py'
--- hooks/charmhelpers/core/services/helpers.py	1970-01-01 00:00:00 +0000
+++ hooks/charmhelpers/core/services/helpers.py	2014-10-06 15:38:41 +0000
@@ -0,0 +1,239 @@
+import os
+import yaml
+from charmhelpers.core import hookenv
+from charmhelpers.core import templating
+
+from charmhelpers.core.services.base import ManagerCallback
+
+
+__all__ = ['RelationContext', 'TemplateCallback',
+           'render_template', 'template']
+
+
+class RelationContext(dict):
+    """
+    Base class for a context generator that gets relation data from juju.
+
+    Subclasses must provide the attributes `name`, which is the name of the
+    interface of interest, `interface`, which is the type of the interface of
+    interest, and `required_keys`, which is the set of keys required for the
+    relation to be considered complete.  The data for all interfaces matching
+    the `name` attribute that are complete will used to populate the dictionary
+    values (see `get_data`, below).
+
+    The generated context will be namespaced under the relation :attr:`name`,
+    to prevent potential naming conflicts.
+
+    :param str name: Override the relation :attr:`name`, since it can vary from charm to charm
+    :param list additional_required_keys: Extend the list of :attr:`required_keys`
+    """
+    name = None
+    interface = None
+    required_keys = []
+
+    def __init__(self, name=None, additional_required_keys=None):
+        if name is not None:
+            self.name = name
+        if additional_required_keys is not None:
+            self.required_keys.extend(additional_required_keys)
+        self.get_data()
+
+    def __bool__(self):
+        """
+        Returns True if all of the required_keys are available.
+        """
+        return self.is_ready()
+
+    __nonzero__ = __bool__
+
+    def __repr__(self):
+        return super(RelationContext, self).__repr__()
+
+    def is_ready(self):
+        """
+        Returns True if all of the `required_keys` are available from any units.
+        """
+        ready = len(self.get(self.name, [])) > 0
+        if not ready:
+            hookenv.log('Incomplete relation: {}'.format(self.__class__.__name__), hookenv.DEBUG)
+        return ready
+
+    def _is_ready(self, unit_data):
+        """
+        Helper method that tests a set of relation data and returns True if
+        all of the `required_keys` are present.
+        """
+        return set(unit_data.keys()).issuperset(set(self.required_keys))
+
+    def get_data(self):
+        """
+        Retrieve the relation data for each unit involved in a relation and,
+        if complete, store it in a list under `self[self.name]`.  This
+        is automatically called when the RelationContext is instantiated.
+
+        The units are sorted lexographically first by the service ID, then by
+        the unit ID.  Thus, if an interface has two other services, 'db:1'
+        and 'db:2', with 'db:1' having two units, 'wordpress/0' and 'wordpress/1',
+        and 'db:2' having one unit, 'mediawiki/0', all of which have a complete
+        set of data, the relation data for the units will be stored in the
+        order: 'wordpress/0', 'wordpress/1', 'mediawiki/0'.
+
+        If you only care about a single unit on the relation, you can just
+        access it as `{{ interface[0]['key'] }}`.  However, if you can at all
+        support multiple units on a relation, you should iterate over the list,
+        like::
+
+            {% for unit in interface -%}
+                {{ unit['key'] }}{% if not loop.last %},{% endif %}
+            {%- endfor %}
+
+        Note that since all sets of relation data from all related services and
+        units are in a single list, if you need to know which service or unit a
+        set of data came from, you'll need to extend this class to preserve
+        that information.
+        """
+        if not hookenv.relation_ids(self.name):
+            return
+
+        ns = self.setdefault(self.name, [])
+        for rid in sorted(hookenv.relation_ids(self.name)):
+            for unit in sorted(hookenv.related_units(rid)):
+                reldata = hookenv.relation_get(rid=rid, unit=unit)
+                if self._is_ready(reldata):
+                    ns.append(reldata)
+
+    def provide_data(self):
+        """
+        Return data to be relation_set for this interface.
+        """
+        return {}
+
+
+class MysqlRelation(RelationContext):
+    """
+    Relation context for the `mysql` interface.
+
+    :param str name: Override the relation :attr:`name`, since it can vary from charm to charm
+    :param list additional_required_keys: Extend the list of :attr:`required_keys`
+    """
+    name = 'db'
+    interface = 'mysql'
+    required_keys = ['host', 'user', 'password', 'database']
+
+
+class HttpRelation(RelationContext):
+    """
+    Relation context for the `http` interface.
+
+    :param str name: Override the relation :attr:`name`, since it can vary from charm to charm
+    :param list additional_required_keys: Extend the list of :attr:`required_keys`
+    """
+    name = 'website'
+    interface = 'http'
+    required_keys = ['host', 'port']
+
+    def provide_data(self):
+        return {
+            'host': hookenv.unit_get('private-address'),
+            'port': 80,
+        }
+
+
+class RequiredConfig(dict):
+    """
+    Data context that loads config options with one or more mandatory options.
+
+    Once the required options have been changed from their default values, all
+    config options will be available, namespaced under `config` to prevent
+    potential naming conflicts (for example, between a config option and a
+    relation property).
+
+    :param list *args: List of options that must be changed from their default values.
+    """
+
+    def __init__(self, *args):
+        self.required_options = args
+        self['config'] = hookenv.config()
+        with open(os.path.join(hookenv.charm_dir(), 'config.yaml')) as fp:
+            self.config = yaml.load(fp).get('options', {})
+
+    def __bool__(self):
+        for option in self.required_options:
+            if option not in self['config']:
+                return False
+            current_value = self['config'][option]
+            default_value = self.config[option].get('default')
+            if current_value == default_value:
+                return False
+            if current_value in (None, '') and default_value in (None, ''):
+                return False
+        return True
+
+    def __nonzero__(self):
+        return self.__bool__()
+
+
+class StoredContext(dict):
+    """
+    A data context that always returns the data that it was first created with.
+
+    This is useful to do a one-time generation of things like passwords, that
+    will thereafter use the same value that was originally generated, instead
+    of generating a new value each time it is run.
+    """
+    def __init__(self, file_name, config_data):
+        """
+        If the file exists, populate `self` with the data from the file.
+        Otherwise, populate with the given data and persist it to the file.
+        """
+        if os.path.exists(file_name):
+            self.update(self.read_context(file_name))
+        else:
+            self.store_context(file_name, config_data)
+            self.update(config_data)
+
+    def store_context(self, file_name, config_data):
+        if not os.path.isabs(file_name):
+            file_name = os.path.join(hookenv.charm_dir(), file_name)
+        with open(file_name, 'w') as file_stream:
+            os.fchmod(file_stream.fileno(), 0600)
+            yaml.dump(config_data, file_stream)
+
+    def read_context(self, file_name):
+        if not os.path.isabs(file_name):
+            file_name = os.path.join(hookenv.charm_dir(), file_name)
+        with open(file_name, 'r') as file_stream:
+            data = yaml.load(file_stream)
+            if not data:
+                raise OSError("%s is empty" % file_name)
+            return data
+
+
+class TemplateCallback(ManagerCallback):
+    """
+    Callback class that will render a Jinja2 template, for use as a ready action.
+
+    :param str source: The template source file, relative to `$CHARM_DIR/templates`
+    :param str target: The target to write the rendered template to
+    :param str owner: The owner of the rendered file
+    :param str group: The group of the rendered file
+    :param int perms: The permissions of the rendered file
+    """
+    def __init__(self, source, target, owner='root', group='root', perms=0444):
+        self.source = source
+        self.target = target
+        self.owner = owner
+        self.group = group
+        self.perms = perms
+
+    def __call__(self, manager, service_name, event_name):
+        service = manager.get_service(service_name)
+        context = {}
+        for ctx in service.get('required_data', []):
+            context.update(ctx)
+        templating.render(self.source, self.target, context,
+                          self.owner, self.group, self.perms)
+
+
+# Convenience aliases for templates
+render_template = template = TemplateCallback
 
=== added file 'hooks/charmhelpers/core/templating.py'
--- hooks/charmhelpers/core/templating.py	1970-01-01 00:00:00 +0000
+++ hooks/charmhelpers/core/templating.py	2014-10-06 15:38:41 +0000
@@ -0,0 +1,51 @@
+import os
+
+from charmhelpers.core import host
+from charmhelpers.core import hookenv
+
+
+def render(source, target, context, owner='root', group='root', perms=0444, templates_dir=None):
+    """
+    Render a template.
+
+    The `source` path, if not absolute, is relative to the `templates_dir`.
+
+    The `target` path should be absolute.
+
+    The context should be a dict containing the values to be replaced in the
+    template.
+
+    The `owner`, `group`, and `perms` options will be passed to `write_file`.
+
+    If omitted, `templates_dir` defaults to the `templates` folder in the charm.
+
+    Note: Using this requires python-jinja2; if it is not installed, calling
+    this will attempt to use charmhelpers.fetch.apt_install to install it.
+    """
+    try:
+        from jinja2 import FileSystemLoader, Environment, exceptions
+    except ImportError:
+        try:
+            from charmhelpers.fetch import apt_install
+        except ImportError:
+            hookenv.log('Could not import jinja2, and could not import '
+                        'charmhelpers.fetch to install it',
+                        level=hookenv.ERROR)
+            raise
+        apt_install('python-jinja2', fatal=True)
+        from jinja2 import FileSystemLoader, Environment, exceptions
+
+    if templates_dir is None:
+        templates_dir = os.path.join(hookenv.charm_dir(), 'templates')
+    loader = Environment(loader=FileSystemLoader(templates_dir))
+    try:
+        source = source
+        template = loader.get_template(source)
+    except exceptions.TemplateNotFound as e:
+        hookenv.log('Could not load template %s from %s.' %
+                    (source, templates_dir),
+                    level=hookenv.ERROR)
+        raise e
+    content = template.render(context)
+    host.mkdir(os.path.dirname(target))
+    host.write_file(target, content, owner, group, perms)
 
=== modified file 'hooks/charmhelpers/fetch/__init__.py'
--- hooks/charmhelpers/fetch/__init__.py	2014-08-27 07:17:33 +0000
+++ hooks/charmhelpers/fetch/__init__.py	2014-10-06 15:38:41 +0000
@@ -1,4 +1,5 @@
 import importlib
+from tempfile import NamedTemporaryFile
 import time
 from yaml import safe_load
 from charmhelpers.core.host import (
@@ -13,7 +14,6 @@
     config,
     log,
 )
-import apt_pkg
 import os
 
 
@@ -56,6 +56,15 @@
     'icehouse/proposed': 'precise-proposed/icehouse',
     'precise-icehouse/proposed': 'precise-proposed/icehouse',
     'precise-proposed/icehouse': 'precise-proposed/icehouse',
+    # Juno
+    'juno': 'trusty-updates/juno',
+    'trusty-juno': 'trusty-updates/juno',
+    'trusty-juno/updates': 'trusty-updates/juno',
+    'trusty-updates/juno': 'trusty-updates/juno',
+    'juno/proposed': 'trusty-proposed/juno',
+    'juno/proposed': 'trusty-proposed/juno',
+    'trusty-juno/proposed': 'trusty-proposed/juno',
+    'trusty-proposed/juno': 'trusty-proposed/juno',
 }
 
 # The order of this list is very important. Handlers should be listed in from
@@ -108,8 +117,12 @@
 
 def filter_installed_packages(packages):
     """Returns a list of packages that require installation"""
+<<<<<<< TREE
 
     cache = apt_cache()
+=======
+    cache = apt_cache()
+>>>>>>> MERGE-SOURCE
     _pkgs = []
     for package in packages:
         try:
@@ -122,15 +135,28 @@
     return _pkgs
 
 
-def apt_cache(in_memory=True):
-    """Build and return an apt cache"""
-    apt_pkg.init()
-    if in_memory:
-        apt_pkg.config.set("Dir::Cache::pkgcache", "")
-        apt_pkg.config.set("Dir::Cache::srcpkgcache", "")
-    return apt_pkg.Cache()
-
-
+<<<<<<< TREE
+def apt_cache(in_memory=True):
+    """Build and return an apt cache"""
+    apt_pkg.init()
+    if in_memory:
+        apt_pkg.config.set("Dir::Cache::pkgcache", "")
+        apt_pkg.config.set("Dir::Cache::srcpkgcache", "")
+    return apt_pkg.Cache()
+
+
+=======
+def apt_cache(in_memory=True):
+    """Build and return an apt cache"""
+    import apt_pkg
+    apt_pkg.init()
+    if in_memory:
+        apt_pkg.config.set("Dir::Cache::pkgcache", "")
+        apt_pkg.config.set("Dir::Cache::srcpkgcache", "")
+    return apt_pkg.Cache()
+
+
+>>>>>>> MERGE-SOURCE
 def apt_install(packages, options=None, fatal=False):
     """Install one or more packages"""
     if options is None:
@@ -196,6 +222,28 @@
 
 
 def add_source(source, key=None):
+    """Add a package source to this system.
+
+    @param source: a URL or sources.list entry, as supported by
+    add-apt-repository(1). Examples::
+
+        ppa:charmers/example
+        deb https://stub:[e-mail]/ubuntu trusty main
+
+    In addition:
+        'proposed:' may be used to enable the standard 'proposed'
+        pocket for the release.
+        'cloud:' may be used to activate official cloud archive pockets,
+        such as 'cloud:icehouse'
+
+    @param key: A key to be added to the system's APT keyring and used
+    to verify the signatures on packages. Ideally, this should be an
+    ASCII format GPG public key including the block headers. A GPG key
+    id may also be used, but be aware that only insecure protocols are
+    available to retrieve the actual public key from a public keyserver
+    placing your Juju environment at risk. ppa and cloud archive keys
+    are securely added automtically, so sould not be provided.
+    """
     if source is None:
         log('Source is not present. Skipping')
         return
@@ -220,61 +268,96 @@
         release = lsb_release()['DISTRIB_CODENAME']
         with open('/etc/apt/sources.list.d/proposed.list', 'w') as apt:
             apt.write(PROPOSED_POCKET.format(release))
+    else:
+        raise SourceConfigError("Unknown source: {!r}".format(source))
+
     if key:
-        subprocess.check_call(['apt-key', 'adv', '--keyserver',
-                               'hkp://keyserver.ubuntu.com:80', '--recv',
-                               key])
+        if '-----BEGIN PGP PUBLIC KEY BLOCK-----' in key:
+            with NamedTemporaryFile() as key_file:
+                key_file.write(key)
+                key_file.flush()
+                key_file.seek(0)
+                subprocess.check_call(['apt-key', 'add', '-'], stdin=key_file)
+        else:
+            # Note that hkp: is in no way a secure protocol. Using a
+            # GPG key id is pointless from a security POV unless you
+            # absolutely trust your network and DNS.
+            subprocess.check_call(['apt-key', 'adv', '--keyserver',
+                                   'hkp://keyserver.ubuntu.com:80', '--recv',
+                                   key])
 
 
 def configure_sources(update=False,
                       sources_var='install_sources',
                       keys_var='install_keys'):
     """
-    Configure multiple sources from charm configuration
+    Configure multiple sources from charm configuration.
+
+    The lists are encoded as yaml fragments in the configuration.
+    The frament needs to be included as a string. Sources and their
+    corresponding keys are of the types supported by add_source().
 
     Example config:
-        install_sources:
+        install_sources: |
           - "ppa:foo"
           - "http://example.com/repo precise main"
-        install_keys:
+        install_keys: |
           - null
           - "a1b2c3d4"
 
     Note that 'null' (a.k.a. None) should not be quoted.
     """
-    sources = safe_load(config(sources_var))
-    keys = config(keys_var)
-    if keys is not None:
-        keys = safe_load(keys)
-    if isinstance(sources, basestring) and (
-            keys is None or isinstance(keys, basestring)):
-        add_source(sources, keys)
+    sources = safe_load((config(sources_var) or '').strip()) or []
+    keys = safe_load((config(keys_var) or '').strip()) or None
+
+    if isinstance(sources, basestring):
+        sources = [sources]
+
+    if keys is None:
+        for source in sources:
+            add_source(source, None)
     else:
-        if not len(sources) == len(keys):
-            msg = 'Install sources and keys lists are different lengths'
-            raise SourceConfigError(msg)
-        for src_num in range(len(sources)):
-            add_source(sources[src_num], keys[src_num])
+        if isinstance(keys, basestring):
+            keys = [keys]
+
+        if len(sources) != len(keys):
+            raise SourceConfigError(
+                'Install sources and keys lists are different lengths')
+        for source, key in zip(sources, keys):
+            add_source(source, key)
     if update:
         apt_update(fatal=True)
 
 
-def install_remote(source):
+def install_remote(source, *args, **kwargs):
     """
     Install a file tree from a remote source
 
     The specified source should be a url of the form:
         scheme://[host]/path[#[option=value][&...]]
 
-    Schemes supported are based on this modules submodules
-    Options supported are submodule-specific"""
+    Schemes supported are based on this modules submodules.
+    Options supported are submodule-specific.
+    Additional arguments are passed through to the submodule.
+
+    For example::
+
+        dest = install_remote('http://example.com/archive.tgz',
+                              checksum='deadbeef',
+                              hash_type='sha1')
+
+    This will download `archive.tgz`, validate it using SHA1 and, if
+    the file is ok, extract it and return the directory in which it
+    was extracted.  If the checksum fails, it will raise
+    :class:`charmhelpers.core.host.ChecksumError`.
+    """
     # We ONLY check for True here because can_handle may return a string
     # explaining why it can't handle a given source.
     handlers = [h for h in plugins() if h.can_handle(source) is True]
     installed_to = None
     for handler in handlers:
         try:
-            installed_to = handler.install(source)
+            installed_to = handler.install(source, *args, **kwargs)
         except UnhandledSource:
             pass
     if not installed_to:
 
=== modified file 'hooks/charmhelpers/fetch/archiveurl.py'
--- hooks/charmhelpers/fetch/archiveurl.py	2014-03-20 13:47:46 +0000
+++ hooks/charmhelpers/fetch/archiveurl.py	2014-10-06 15:38:41 +0000
@@ -1,6 +1,8 @@
 import os
 import urllib2
+from urllib import urlretrieve
 import urlparse
+import hashlib
 
 from charmhelpers.fetch import (
     BaseFetchHandler,
@@ -10,11 +12,19 @@
     get_archive_handler,
     extract,
 )
-from charmhelpers.core.host import mkdir
+from charmhelpers.core.host import mkdir, check_hash
 
 
 class ArchiveUrlFetchHandler(BaseFetchHandler):
-    """Handler for archives via generic URLs"""
+    """
+    Handler to download archive files from arbitrary URLs.
+
+    Can fetch from http, https, ftp, and file URLs.
+
+    Can install either tarballs (.tar, .tgz, .tbz2, etc) or zip files.
+
+    Installs the contents of the archive in $CHARM_DIR/fetched/.
+    """
     def can_handle(self, source):
         url_parts = self.parse_url(source)
         if url_parts.scheme not in ('http', 'https', 'ftp', 'file'):
@@ -24,6 +34,12 @@
         return False
 
     def download(self, source, dest):
+        """
+        Download an archive file.
+
+        :param str source: URL pointing to an archive file.
+        :param str dest: Local path location to download archive file to.
+        """
         # propogate all exceptions
         # URLError, OSError, etc
         proto, netloc, path, params, query, fragment = urlparse.urlparse(source)
@@ -48,7 +64,30 @@
                 os.unlink(dest)
             raise e
 
-    def install(self, source):
+    # Mandatory file validation via Sha1 or MD5 hashing.
+    def download_and_validate(self, url, hashsum, validate="sha1"):
+        tempfile, headers = urlretrieve(url)
+        check_hash(tempfile, hashsum, validate)
+        return tempfile
+
+    def install(self, source, dest=None, checksum=None, hash_type='sha1'):
+        """
+        Download and install an archive file, with optional checksum validation.
+
+        The checksum can also be given on the `source` URL's fragment.
+        For example::
+
+            handler.install('http://example.com/file.tgz#sha1=deadbeef')
+
+        :param str source: URL pointing to an archive file.
+        :param str dest: Local destination path to install to. If not given,
+            installs to `$CHARM_DIR/archives/archive_file_name`.
+        :param str checksum: If given, validate the archive file after download.
+        :param str hash_type: Algorithm used to generate `checksum`.
+            Can be any hash alrgorithm supported by :mod:`hashlib`,
+            such as md5, sha1, sha256, sha512, etc.
+
+        """
         url_parts = self.parse_url(source)
         dest_dir = os.path.join(os.environ.get('CHARM_DIR'), 'fetched')
         if not os.path.exists(dest_dir):
@@ -60,4 +99,10 @@
             raise UnhandledSource(e.reason)
         except OSError as e:
             raise UnhandledSource(e.strerror)
-        return extract(dld_file)
+        options = urlparse.parse_qs(url_parts.fragment)
+        for key, value in options.items():
+            if key in hashlib.algorithms:
+                check_hash(dld_file, value, key)
+        if checksum:
+            check_hash(dld_file, checksum, hash_type)
+        return extract(dld_file, dest)
 
=== modified file 'hooks/swift_context.py'
--- hooks/swift_context.py	2014-04-10 16:52:10 +0000
+++ hooks/swift_context.py	2014-10-06 15:38:41 +0000
@@ -4,7 +4,8 @@
     relation_ids,
     related_units,
     relation_get,
-    unit_get
+    unit_get,
+    service_name
 )
 
 from charmhelpers.contrib.openstack.context import (
@@ -19,9 +20,14 @@
     determine_apache_port,
 )
 
+from charmhelpers.contrib.network.ip import (
+    get_ipv6_addr
+)
+
 from charmhelpers.contrib.openstack.utils import get_host_ip
 import subprocess
 import os
+import uuid
 
 
 from charmhelpers.contrib.hahelpers.apache import (
@@ -116,7 +122,11 @@
         for relid in relation_ids('swift-storage'):
             for unit in related_units(relid):
                 host = relation_get('private-address', unit, relid)
-                allowed_hosts.append(get_host_ip(host))
+                if config('prefer-ipv6'):
+                    host_ip = get_ipv6_addr(exc_list=[config('vip')])[0]
+                else:
+                    host_ip = get_host_ip(host)
+                allowed_hosts.append(host_ip)
 
         ctxt = {
             'www_dir': WWW_DIR,
@@ -134,12 +144,21 @@
         if workers == '0':
             import multiprocessing
             workers = multiprocessing.cpu_count()
+        if config('prefer-ipv6'):
+            proxy_ip = '[%s]' % get_ipv6_addr(exc_list=[config('vip')])[0]
+            memcached_ip = 'ip6-localhost'
+        else:
+            proxy_ip = get_host_ip(unit_get('private-address'))
+            memcached_ip = get_host_ip(unit_get('private-address'))
         ctxt = {
-            'proxy_ip': get_host_ip(unit_get('private-address')),
+            'proxy_ip': proxy_ip,
+            'memcached_ip': memcached_ip,
             'bind_port': determine_api_port(bind_port),
             'workers': workers,
             'operator_roles': config('operator-roles'),
-            'delay_auth_decision': config('delay-auth-decision')
+            'delay_auth_decision': config('delay-auth-decision'),
+            'node_timeout': config('node-timeout'),
+            'recoverable_node_timeout': config('recoverable-node-timeout'),
         }
 
         ctxt['ssl'] = False
@@ -194,9 +213,11 @@
 class MemcachedContext(OSContextGenerator):
 
     def __call__(self):
-        ctxt = {
-            'proxy_ip': get_host_ip(unit_get('private-address'))
-        }
+        ctxt = {}
+        if config('prefer-ipv6'):
+            ctxt['memcached_ip'] = 'ip6-localhost'
+        else:
+            ctxt['memcached_ip'] = get_host_ip(unit_get('private-address'))
         return ctxt
 
 SWIFT_HASH_FILE = '/var/lib/juju/swift-hash-path.conf'
@@ -211,10 +232,8 @@
         with open(SWIFT_HASH_FILE, 'w') as hashfile:
             hashfile.write(swift_hash)
     else:
-        cmd = ['od', '-t', 'x8', '-N', '8', '-A', 'n']
-        rand = open('/dev/random', 'r')
-        p = subprocess.Popen(cmd, stdout=subprocess.PIPE, stdin=rand)
-        swift_hash = p.communicate()[0].strip()
+        swift_hash = str(uuid.uuid3(uuid.UUID(os.environ.get("JUJU_ENV_UUID")),
+                                    service_name()))
         with open(SWIFT_HASH_FILE, 'w') as hashfile:
             hashfile.write(swift_hash)
     return swift_hash
 
=== modified file 'hooks/swift_hooks.py'
--- hooks/swift_hooks.py	2014-04-10 16:52:10 +0000
+++ hooks/swift_hooks.py	2014-10-06 15:38:41 +0000
@@ -24,7 +24,8 @@
     add_to_ring,
     should_balance,
     do_openstack_upgrade,
-    write_rc_script
+    write_rc_script,
+    setup_ipv6
 )
 from swift_context import get_swift_hash
 
@@ -48,6 +49,19 @@
 )
 from charmhelpers.payload.execd import execd_preinstall
 
+from charmhelpers.contrib.openstack.ip import (
+    canonical_url,
+    PUBLIC, INTERNAL, ADMIN
+)
+from charmhelpers.contrib.network.ip import (
+    get_iface_for_address,
+    get_netmask_for_address,
+    get_address_in_network,
+    get_ipv6_addr,
+    format_ipv6_addr,
+    is_ipv6
+)
+
 extra_pkgs = [
     "haproxy",
     "python-jinja2"
@@ -71,7 +85,6 @@
     pkgs = determine_packages(rel)
     apt_install(pkgs, fatal=True)
     apt_install(extra_pkgs, fatal=True)
-
     ensure_swift_dir()
     # initialize new storage rings.
     for ring in SWIFT_RINGS.iteritems():
@@ -92,20 +105,16 @@
 def keystone_joined(relid=None):
     if not cluster.eligible_leader(SWIFT_HA_RES):
         return
-    if cluster.is_clustered():
-        hostname = config('vip')
-    else:
-        hostname = unit_get('private-address')
     port = config('bind-port')
-    if cluster.https():
-        proto = 'https'
-    else:
-        proto = 'http'
-    admin_url = '%s://%s:%s' % (proto, hostname, port)
-    internal_url = public_url = '%s/v1/AUTH_$(tenant_id)s' % admin_url
+    admin_url = '%s:%s' % (canonical_url(CONFIGS, ADMIN), port)
+    internal_url = '%s:%s/v1/AUTH_$(tenant_id)s' % \
+        (canonical_url(CONFIGS, INTERNAL), port)
+    public_url = '%s:%s/v1/AUTH_$(tenant_id)s' % \
+        (canonical_url(CONFIGS, PUBLIC), port)
     relation_set(service='swift',
                  region=config('region'),
-                 public_url=public_url, internal_url=internal_url,
+                 public_url=public_url,
+                 internal_url=internal_url,
                  admin_url=admin_url,
                  requested_roles=config('operator-roles'),
                  relation_id=relid)
@@ -142,9 +151,12 @@
 
         if cluster.is_clustered():
             hostname = config('vip')
+        elif config('prefer-ipv6'):
+            hostname = get_ipv6_addr(exc_list=[config('vip')])[0]
         else:
             hostname = unit_get('private-address')
 
+        hostname = format_ipv6_addr(hostname) or hostname
         rings_url = 'http://%s/%s' % (hostname, path)
         # notify storage nodes that there is a new ring to fetch.
         for relid in relation_ids('swift-storage'):
@@ -157,9 +169,14 @@
 @hooks.hook('swift-storage-relation-changed')
 @restart_on_change(restart_map())
 def storage_changed():
+    if config('prefer-ipv6'):
+        host_ip = '[%s]' % relation_get('private-address')
+    else:
+        host_ip = openstack.get_host_ip(relation_get('private-address'))
+
     zone = get_zone(config('zone-assignment'))
     node_settings = {
-        'ip': openstack.get_host_ip(relation_get('private-address')),
+        'ip': host_ip,
         'zone': zone,
         'account_port': relation_get('account_port'),
         'object_port': relation_get('object_port'),
@@ -195,16 +212,33 @@
 @hooks.hook('config-changed')
 @restart_on_change(restart_map())
 def config_changed():
+    if config('prefer-ipv6'):
+        setup_ipv6()
+
     configure_https()
     open_port(config('bind-port'))
     # Determine whether or not we should do an upgrade, based on the
     # the version offered in keyston-release.
     if (openstack.openstack_upgrade_available('python-swift')):
         do_openstack_upgrade(CONFIGS)
-
-
[e-mail]('cluster-relation-changed',
-            'cluster-relation-joined')
+    for r_id in relation_ids('identity-service'):
+        keystone_joined(relid=r_id)
+
+
[e-mail]('cluster-relation-joined')
+def cluster_joined(relation_id=None):
+    if config('prefer-ipv6'):
+        private_addr = get_ipv6_addr(exc_list=[config('vip')])[0]
+    else:
+        private_addr = unit_get('private-address')
+
+    address = get_address_in_network(config('os-internal-network'),
+                                     private_addr)
+    relation_set(relation_id=relation_id,
+                 relation_settings={'private-address': address})
+
+
[e-mail]('cluster-relation-changed')
 @restart_on_change(restart_map())
 def cluster_changed():
     CONFIGS.write_all()
@@ -229,8 +263,6 @@
     corosync_bindiface = config('ha-bindiface')
     corosync_mcastport = config('ha-mcastport')
     vip = config('vip')
-    vip_cidr = config('vip_cidr')
-    vip_iface = config('vip_iface')
     if not vip:
         log('Unable to configure hacluster as vip not provided',
             level=ERROR)
@@ -238,14 +270,37 @@
 
     # Obtain resources
     resources = {
-        'res_swift_vip': 'ocf:heartbeat:IPaddr2',
         'res_swift_haproxy': 'lsb:haproxy'
     }
     resource_params = {
-        'res_swift_vip': 'params ip="%s" cidr_netmask="%s" nic="%s"' %
-        (vip, vip_cidr, vip_iface),
         'res_swift_haproxy': 'op monitor interval="5s"'
     }
+
+    vip_group = []
+    for vip in vip.split():
+        if is_ipv6(vip):
+            res_swift_vip = 'ocf:heartbeat:IPv6addr'
+            vip_params = 'ipv6addr'
+        else:
+            res_swift_vip = 'ocf:heartbeat:IPaddr2'
+            vip_params = 'ip'
+
+        iface = get_iface_for_address(vip)
+        if iface is not None:
+            vip_key = 'res_swift_{}_vip'.format(iface)
+            resources[vip_key] = res_swift_vip
+            resource_params[vip_key] = (
+                'params {ip}="{vip}" cidr_netmask="{netmask}"'
+                ' nic="{iface}"'.format(ip=vip_params,
+                                        vip=vip,
+                                        iface=iface,
+                                        netmask=get_netmask_for_address(vip))
+            )
+            vip_group.append(vip_key)
+
+    if len(vip_group) >= 1:
+        relation_set(groups={'grp_swift_vips': ' '.join(vip_group)})
+
     init_services = {
         'res_swift_haproxy': 'haproxy'
     }
 
=== modified file 'hooks/swift_utils.py'
--- hooks/swift_utils.py	2014-08-11 08:59:49 +0000
+++ hooks/swift_utils.py	2014-10-06 15:38:41 +0000
@@ -12,7 +12,13 @@
 )
 from charmhelpers.fetch import (
     apt_update,
-    apt_upgrade
+    apt_upgrade,
+    apt_install,
+    add_source
+)
+
+from charmhelpers.core.host import (
+    lsb_release
 )
 
 import charmhelpers.contrib.openstack.context as context
@@ -63,7 +69,7 @@
 # > Folsom specific packages
 FOLSOM_PACKAGES = BASE_PACKAGES + ['swift-plugin-s3']
 
-SWIFT_HA_RES = 'res_swift_vip'
+SWIFT_HA_RES = 'grp_swift_vips'
 
 TEMPLATES = 'templates/'
 
@@ -75,7 +81,8 @@
         'services': ['swift-proxy'],
     }),
     (SWIFT_PROXY_CONF, {
-        'hook_contexts': [swift_context.SwiftIdentityContext()],
+        'hook_contexts': [swift_context.SwiftIdentityContext(),
+                          context.BindHostContext()],
         'services': ['swift-proxy'],
     }),
     (HAPROXY_CONF, {
@@ -368,3 +375,19 @@
     apt_upgrade(options=dpkg_opts, fatal=True, dist=True)
     configs.set_release(openstack_release=new_os_rel)
     configs.write_all()
+
+
+def setup_ipv6():
+    ubuntu_rel = lsb_release()['DISTRIB_CODENAME'].lower()
+    if ubuntu_rel < "trusty":
+        raise Exception("IPv6 is not supported in the charms for Ubuntu "
+                        "versions less than Trusty 14.04")
+
+    # NOTE(xianghui): Need to install haproxy(1.5.3) from trusty-backports
+    # to support ipv6 address, so check is required to make sure not
+    # breaking other versions, IPv6 only support for >= Trusty
+    if ubuntu_rel == 'trusty':
+        add_source('deb http://archive.ubuntu.com/ubuntu trusty-backports'
+                   ' main')
+        apt_update()
+        apt_install('haproxy/trusty-backports', fatal=True)
 
=== modified file 'revision'
--- revision	2013-09-27 12:02:37 +0000
+++ revision	2014-10-06 15:38:41 +0000
@@ -1,1 +1,1 @@
-146
+147
 
=== modified file 'templates/essex/proxy-server.conf'
--- templates/essex/proxy-server.conf	2014-02-27 12:17:53 +0000
+++ templates/essex/proxy-server.conf	2014-10-06 15:38:41 +0000
@@ -19,6 +19,8 @@
 use = egg:swift#proxy
 allow_account_management = true
 {% if auth_type == 'keystone' %}account_autocreate = true{% endif %}
+node_timeout = {{ node_timeout }}
+recoverable_node_timeout = {{ recoverable_node_timeout }}
 
 [filter:tempauth]
 use = egg:swift#tempauth
 
=== modified file 'templates/grizzly/proxy-server.conf'
--- templates/grizzly/proxy-server.conf	2014-03-27 11:23:24 +0000
+++ templates/grizzly/proxy-server.conf	2014-10-06 15:38:41 +0000
@@ -19,6 +19,8 @@
 use = egg:swift#proxy
 allow_account_management = true
 {% if auth_type == 'keystone' %}account_autocreate = true{% endif %}
+node_timeout = {{ node_timeout }}
+recoverable_node_timeout = {{ recoverable_node_timeout }}
 
 [filter:tempauth]
 use = egg:swift#tempauth
 
=== modified file 'templates/havana/proxy-server.conf'
--- templates/havana/proxy-server.conf	2014-03-27 11:23:24 +0000
+++ templates/havana/proxy-server.conf	2014-10-06 15:38:41 +0000
@@ -19,6 +19,8 @@
 use = egg:swift#proxy
 allow_account_management = true
 {% if auth_type == 'keystone' %}account_autocreate = true{% endif %}
+node_timeout = {{ node_timeout }}
+recoverable_node_timeout = {{ recoverable_node_timeout }}
 
 [filter:tempauth]
 use = egg:swift#tempauth
 
=== modified file 'templates/icehouse/proxy-server.conf'
--- templates/icehouse/proxy-server.conf	2014-04-07 14:44:39 +0000
+++ templates/icehouse/proxy-server.conf	2014-10-06 15:38:41 +0000
@@ -2,6 +2,7 @@
 bind_port = {{ bind_port }}
 workers = {{ workers }}
 user = swift
+bind_ip = {{ bind_host }}
 {% if ssl %}
 cert_file = {{ ssl_cert }}
 key_file = {{ ssl_key }}
@@ -19,6 +20,8 @@
 use = egg:swift#proxy
 allow_account_management = true
 {% if auth_type == 'keystone' %}account_autocreate = true{% endif %}
+node_timeout = {{ node_timeout }}
+recoverable_node_timeout = {{ recoverable_node_timeout }}
 
 [filter:tempauth]
 use = egg:swift#tempauth
@@ -29,7 +32,7 @@
 
 [filter:cache]
 use = egg:swift#memcache
-memcache_servers = {{ proxy_ip }}:11211
+memcache_servers = {{ memcached_ip }}:11211
 
 [filter:account-quotas]
 use = egg:swift#account_quotas
 
=== modified file 'templates/memcached.conf'
--- templates/memcached.conf	2013-09-27 12:02:37 +0000
+++ templates/memcached.conf	2014-10-06 15:38:41 +0000
@@ -32,7 +32,7 @@
 # Specify which IP address to listen on. The default is to listen on all IP addresses
 # This parameter is one of the only security measures that memcached has, so make sure
 # it's listening on a firewalled interface.
--l {{ proxy_ip }} 
+-l {{ memcached_ip }} 
 
 # Limit the number of simultaneous incoming connections. The daemon default is 1024
 # -c 1024
 
=== added directory 'tests'
=== added file 'tests/00-setup'
--- tests/00-setup	1970-01-01 00:00:00 +0000
+++ tests/00-setup	2014-10-06 15:38:41 +0000
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+set -ex
+
+sudo add-apt-repository --yes ppa:juju/stable
+sudo apt-get update --yes
+sudo apt-get install --yes python-amulet
+sudo apt-get install --yes python-swiftclient
+sudo apt-get install --yes python-glanceclient
+sudo apt-get install --yes python-keystoneclient
+sudo apt-get install --yes python-novaclient
 
=== added file 'tests/10-basic-precise-essex'
--- tests/10-basic-precise-essex	1970-01-01 00:00:00 +0000
+++ tests/10-basic-precise-essex	2014-10-06 15:38:41 +0000
@@ -0,0 +1,9 @@
+#!/usr/bin/python
+
+"""Amulet tests on a basic swift-proxy deployment on precise-essex."""
+
+from basic_deployment import SwiftProxyBasicDeployment
+
+if __name__ == '__main__':
+    deployment = SwiftProxyBasicDeployment(series='precise')
+    deployment.run_tests()
 
=== added file 'tests/11-basic-precise-folsom'
--- tests/11-basic-precise-folsom	1970-01-01 00:00:00 +0000
+++ tests/11-basic-precise-folsom	2014-10-06 15:38:41 +0000
@@ -0,0 +1,11 @@
+#!/usr/bin/python
+
+"""Amulet tests on a basic swift-proxy deployment on precise-folsom."""
+
+from basic_deployment import SwiftProxyBasicDeployment
+
+if __name__ == '__main__':
+    deployment = SwiftProxyBasicDeployment(series='precise',
+                                          openstack='cloud:precise-folsom',
+                                          source='cloud:precise-updates/folsom')
+    deployment.run_tests()
 
=== added file 'tests/12-basic-precise-grizzly'
--- tests/12-basic-precise-grizzly	1970-01-01 00:00:00 +0000
+++ tests/12-basic-precise-grizzly	2014-10-06 15:38:41 +0000
@@ -0,0 +1,11 @@
+#!/usr/bin/python
+
+"""Amulet tests on a basic swift-proxy deployment on precise-grizzly."""
+
+from basic_deployment import SwiftProxyBasicDeployment
+
+if __name__ == '__main__':
+    deployment = SwiftProxyBasicDeployment(series='precise',
+                                         openstack='cloud:precise-grizzly',
+                                         source='cloud:precise-updates/grizzly')
+    deployment.run_tests()
 
=== added file 'tests/13-basic-precise-havana'
--- tests/13-basic-precise-havana	1970-01-01 00:00:00 +0000
+++ tests/13-basic-precise-havana	2014-10-06 15:38:41 +0000
@@ -0,0 +1,11 @@
+#!/usr/bin/python
+
+"""Amulet tests on a basic swift-proxy deployment on precise-havana."""
+
+from basic_deployment import SwiftProxyBasicDeployment
+
+if __name__ == '__main__':
+    deployment = SwiftProxyBasicDeployment(series='precise',
+                                          openstack='cloud:precise-havana',
+                                          source='cloud:precise-updates/havana')
+    deployment.run_tests()
 
=== added file 'tests/14-basic-precise-icehouse'
--- tests/14-basic-precise-icehouse	1970-01-01 00:00:00 +0000
+++ tests/14-basic-precise-icehouse	2014-10-06 15:38:41 +0000
@@ -0,0 +1,11 @@
+#!/usr/bin/python
+
+"""Amulet tests on a basic swift-proxy deployment on precise-icehouse."""
+
+from basic_deployment import SwiftProxyBasicDeployment
+
+if __name__ == '__main__':
+    deployment = SwiftProxyBasicDeployment(series='precise',
+                                        openstack='cloud:precise-icehouse',
+                                        source='cloud:precise-updates/icehouse')
+    deployment.run_tests()
 
=== added file 'tests/15-basic-trusty-icehouse'
--- tests/15-basic-trusty-icehouse	1970-01-01 00:00:00 +0000
+++ tests/15-basic-trusty-icehouse	2014-10-06 15:38:41 +0000
@@ -0,0 +1,9 @@
+#!/usr/bin/python
+
+"""Amulet tests on a basic swift-proxy deployment on trusty-icehouse."""
+
+from basic_deployment import SwiftProxyBasicDeployment
+
+if __name__ == '__main__':
+    deployment = SwiftProxyBasicDeployment(series='trusty')
+    deployment.run_tests()
 
=== added file 'tests/README'
--- tests/README	1970-01-01 00:00:00 +0000
+++ tests/README	2014-10-06 15:38:41 +0000
@@ -0,0 +1,52 @@
+This directory provides Amulet tests that focus on verification of swift-proxy
+deployments.
+
+If you use a web proxy server to access the web, you'll need to set the
+AMULET_HTTP_PROXY environment variable to the http URL of the proxy server.
+
+The following examples demonstrate different ways that tests can be executed.
+All examples are run from the charm's root directory.
+
+  * To run all tests (starting with 00-setup):
+
+      make test
+
+  * To run a specific test module (or modules):
+
+      juju test -v -p AMULET_HTTP_PROXY 15-basic-trusty-icehouse
+
+  * To run a specific test module (or modules), and keep the environment
+    deployed after a failure:
+
+      juju test --set-e -v -p AMULET_HTTP_PROXY 15-basic-trusty-icehouse
+
+  * To re-run a test module against an already deployed environment (one
+    that was deployed by a previous call to 'juju test --set-e'):
+
+      ./tests/15-basic-trusty-icehouse
+
+For debugging and test development purposes, all code should be idempotent.
+In other words, the code should have the ability to be re-run without changing
+the results beyond the initial run.  This enables editing and re-running of a
+test module against an already deployed environment, as described above.
+
+Manual debugging tips:
+
+  * Set the following env vars before using the OpenStack CLI as admin:
+      export OS_AUTH_URL=http://`juju-deployer -f keystone 2>&1 | tail -n 1`:5000/v2.0
+      export OS_TENANT_NAME=admin
+      export OS_USERNAME=admin
+      export OS_PASSWORD=openstack
+      export OS_REGION_NAME=RegionOne
+
+  * Set the following env vars before using the OpenStack CLI as demoUser:
+      export OS_AUTH_URL=http://`juju-deployer -f keystone 2>&1 | tail -n 1`:5000/v2.0
+      export OS_TENANT_NAME=demoTenant
+      export OS_USERNAME=demoUser
+      export OS_PASSWORD=password
+      export OS_REGION_NAME=RegionOne
+
+  * Sample swift command:
+      swift -A $OS_AUTH_URL --os-tenant-name services --os-username swift \
+            --os-password password list
+      (where tenant/user names and password are in swift-proxy's nova.conf file)
 
=== added file 'tests/basic_deployment.py'
--- tests/basic_deployment.py	1970-01-01 00:00:00 +0000
+++ tests/basic_deployment.py	2014-10-06 15:38:41 +0000
@@ -0,0 +1,827 @@
+#!/usr/bin/python
+
+import amulet
+import swiftclient
+
+from charmhelpers.contrib.openstack.amulet.deployment import (
+    OpenStackAmuletDeployment
+)
+
+from charmhelpers.contrib.openstack.amulet.utils import (
+    OpenStackAmuletUtils,
+    DEBUG, # flake8: noqa
+    ERROR
+)
+
+# Use DEBUG to turn on debug logging
+u = OpenStackAmuletUtils(ERROR)
+
+
+class SwiftProxyBasicDeployment(OpenStackAmuletDeployment):
+    """Amulet tests on a basic swift-proxy deployment."""
+
+    def __init__(self, series, openstack=None, source=None):
+        """Deploy the entire test environment."""
+        super(SwiftProxyBasicDeployment, self).__init__(series, openstack,
+                                                        source)
+        self._add_services()
+        self._add_relations()
+        self._configure_services()
+        self._deploy()
+        self._initialize_tests()
+
+    def _add_services(self):
+        """Add the service that we're testing, including the number of units,
+           where swift-proxy is local, and the other charms are from
+           the charm store."""
+        this_service = ('swift-proxy', 1)
+        other_services = [('mysql', 1),
+                          ('keystone', 1), ('glance', 1), ('swift-storage', 1)]
+        super(SwiftProxyBasicDeployment, self)._add_services(this_service,
+                                                             other_services)
+
+    def _add_relations(self):
+        """Add all of the relations for the services."""
+        relations = {
+          'keystone:shared-db': 'mysql:shared-db',
+          'swift-proxy:identity-service': 'keystone:identity-service',
+          'swift-storage:swift-storage': 'swift-proxy:swift-storage',
+          'glance:identity-service': 'keystone:identity-service',
+          'glance:shared-db': 'mysql:shared-db',
+          'glance:object-store': 'swift-proxy:object-store'
+        }
+        super(SwiftProxyBasicDeployment, self)._add_relations(relations)
+
+    def _configure_services(self):
+        """Configure all of the services."""
+        keystone_config = {'admin-password': 'openstack',
+                           'admin-token': 'ubuntutesting'}
+        swift_proxy_config = {'zone-assignment': 'manual',
+                           'replicas': '1',
+                           'swift-hash': 'fdfef9d4-8b06-11e2-8ac0-531c923c8fae',
+                           'use-https': 'no'}
+        swift_storage_config = {'zone': '1',
+                                'block-device': 'vdb',
+                                'overwrite': 'true'}
+        configs = {'keystone': keystone_config,
+                   'swift-proxy': swift_proxy_config,
+                   'swift-storage': swift_storage_config}
+        super(SwiftProxyBasicDeployment, self)._configure_services(configs)
+
+    def _initialize_tests(self):
+        """Perform final initialization before tests get run."""
+        # Access the sentries for inspecting service units
+        self.mysql_sentry = self.d.sentry.unit['mysql/0']
+        self.keystone_sentry = self.d.sentry.unit['keystone/0']
+        self.glance_sentry = self.d.sentry.unit['glance/0']
+        self.swift_proxy_sentry = self.d.sentry.unit['swift-proxy/0']
+        self.swift_storage_sentry = self.d.sentry.unit['swift-storage/0']
+
+        # Authenticate admin with keystone
+        self.keystone = u.authenticate_keystone_admin(self.keystone_sentry,
+                                                      user='admin',
+                                                      password='openstack',
+                                                      tenant='admin')
+
+        # Authenticate admin with glance endpoint
+        self.glance = u.authenticate_glance_admin(self.keystone)
+
+        # Authenticate swift user
+        keystone_relation = self.keystone_sentry.relation('identity-service',
+                                                 'swift-proxy:identity-service')
+        ep = self.keystone.service_catalog.url_for(service_type='identity',
+                                                   endpoint_type='publicURL')
+        self.swift = swiftclient.Connection(authurl=ep,
+                                user=keystone_relation['service_username'],
+                                key=keystone_relation['service_password'],
+                                tenant_name=keystone_relation['service_tenant'],
+                                auth_version='2.0')
+
+        # Create a demo tenant/role/user
+        self.demo_tenant = 'demoTenant'
+        self.demo_role = 'demoRole'
+        self.demo_user = 'demoUser'
+        if not u.tenant_exists(self.keystone, self.demo_tenant):
+            tenant = self.keystone.tenants.create(tenant_name=self.demo_tenant,
+                                                  description='demo tenant',
+                                                  enabled=True)
+            self.keystone.roles.create(name=self.demo_role)
+            self.keystone.users.create(name=self.demo_user,
+                                       password='password',
+                                       tenant_id=tenant.id,
+                                       email='[e-mail]')
+
+        # Authenticate demo user with keystone
+        self.keystone_demo = \
+            u.authenticate_keystone_user(self.keystone, user=self.demo_user,
+                                         password='password',
+                                         tenant=self.demo_tenant)
+
+    def test_services(self):
+        """Verify the expected services are running on the corresponding
+           service units."""
+        swift_storage_services = ['status swift-account',
+                                  'status swift-account-auditor',
+                                  'status swift-account-reaper',
+                                  'status swift-account-replicator',
+                                  'status swift-container',
+                                  'status swift-container-auditor',
+                                  'status swift-container-replicator',
+                                  'status swift-container-updater',
+                                  'status swift-object',
+                                  'status swift-object-auditor',
+                                  'status swift-object-replicator',
+                                  'status swift-object-updater']
+        if self._get_openstack_release() >= self.precise_icehouse:
+            swift_storage_services.append('status swift-container-sync')
+
+        commands = {
+            self.mysql_sentry: ['status mysql'],
+            self.keystone_sentry: ['status keystone'],
+            self.glance_sentry: ['status glance-registry', 'status glance-api'],
+            self.swift_proxy_sentry: ['status swift-proxy'],
+            self.swift_storage_sentry: swift_storage_services
+        }
+
+        ret = u.validate_services(commands)
+        if ret:
+            amulet.raise_status(amulet.FAIL, msg=ret)
+
+    def test_users(self):
+        """Verify all existing roles."""
+        user1 = {'name': 'demoUser',
+                 'enabled': True,
+                 'tenantId': u.not_null,
+                 'id': u.not_null,
+                 'email': '[e-mail]'}
+        user2 = {'name': 'admin',
+                 'enabled': True,
+                 'tenantId': u.not_null,
+                 'id': u.not_null,
+                 'email': 'juju@localhost'}
+        user3 = {'name': 'glance',
+                 'enabled': True,
+                 'tenantId': u.not_null,
+                 'id': u.not_null,
+                 'email': u'juju@localhost'}
+        user4 = {'name': 'swift',
+                 'enabled': True,
+                 'tenantId': u.not_null,
+                 'id': u.not_null,
+                 'email': u'juju@localhost'}
+        expected = [user1, user2, user3, user4]
+        actual = self.keystone.users.list()
+
+        ret = u.validate_user_data(expected, actual)
+        if ret:
+            amulet.raise_status(amulet.FAIL, msg=ret)
+
+    def test_service_catalog(self):
+        """Verify that the service catalog endpoint data is valid."""
+        endpoint_vol = {'adminURL': u.valid_url,
+                        'region': 'RegionOne',
+                        'publicURL': u.valid_url,
+                        'internalURL': u.valid_url}
+        endpoint_id = {'adminURL': u.valid_url,
+                       'region': 'RegionOne',
+                       'publicURL': u.valid_url,
+                       'internalURL': u.valid_url}
+        if self._get_openstack_release() >= self.precise_folsom:
+            endpoint_vol['id'] = u.not_null
+            endpoint_id['id'] = u.not_null
+        expected = {'image': [endpoint_id], 'object-store': [endpoint_id],
+                    'identity': [endpoint_id]}
+        actual = self.keystone_demo.service_catalog.get_endpoints()
+
+        ret = u.validate_svc_catalog_endpoint_data(expected, actual)
+        if ret:
+            amulet.raise_status(amulet.FAIL, msg=ret)
+
+    def test_openstack_object_store_endpoint(self):
+        """Verify the swift object-store endpoint data."""
+        endpoints = self.keystone.endpoints.list()
+        admin_port = internal_port = public_port = '8080'
+        expected = {'id': u.not_null,
+                    'region': 'RegionOne',
+                    'adminurl': u.valid_url,
+                    'internalurl': u.valid_url,
+                    'publicurl': u.valid_url,
+                    'service_id': u.not_null}
+
+        ret = u.validate_endpoint_data(endpoints, admin_port, internal_port,
+                                       public_port, expected)
+        if ret:
+            message = 'object-store endpoint: {}'.format(ret)
+            amulet.raise_status(amulet.FAIL, msg=message)
+
+    def test_swift_proxy_identity_service_relation(self):
+        """Verify the swift-proxy to keystone identity-service relation data."""
+        unit = self.swift_proxy_sentry
+        relation = ['identity-service', 'keystone:identity-service']
+        expected = {
+            'service': 'swift',
+            'region': 'RegionOne',
+            'public_url': u.valid_url,
+            'internal_url': u.valid_url,
+            'private-address': u.valid_ip,
+            'requested_roles': 'Member,Admin',
+            'admin_url': u.valid_url
+        }
+
+        ret = u.validate_relation_data(unit, relation, expected)
+        if ret:
+            message = u.relation_error('swift-proxy identity-service', ret)
+            amulet.raise_status(amulet.FAIL, msg=message)
+
+    def test_keystone_identity_service_relation(self):
+        """Verify the keystone to swift-proxy identity-service relation data."""
+        unit = self.keystone_sentry
+        relation = ['identity-service', 'swift-proxy:identity-service']
+        expected = {
+            'service_protocol': 'http',
+            'service_tenant': 'services',
+            'admin_token': 'ubuntutesting',
+            'service_password': u.not_null,
+            'service_port': '5000',
+            'auth_port': '35357',
+            'auth_protocol': 'http',
+            'private-address': u.valid_ip,
+            'https_keystone': 'False',
+            'auth_host': u.valid_ip,
+            'service_username': 'swift',
+            'service_tenant_id': u.not_null,
+            'service_host': u.valid_ip
+        }
+
+        ret = u.validate_relation_data(unit, relation, expected)
+        if ret:
+            message = u.relation_error('keystone identity-service', ret)
+            amulet.raise_status(amulet.FAIL, msg=message)
+
+    def test_swift_storage_swift_storage_relation(self):
+        """Verify the swift-storage to swift-proxy swift-storage relation
+           data."""
+        unit = self.swift_storage_sentry
+        relation = ['swift-storage', 'swift-proxy:swift-storage']
+        expected = {
+            'account_port': '6002',
+            'zone': '1',
+            'object_port': '6000',
+            'container_port': '6001',
+            'private-address': u.valid_ip,
+            'device': 'vdb'
+        }
+
+        ret = u.validate_relation_data(unit, relation, expected)
+        if ret:
+            message = u.relation_error('swift-storage swift-storage', ret)
+            amulet.raise_status(amulet.FAIL, msg=message)
+
+    def test_swift_proxy_swift_storage_relation(self):
+        """Verify the swift-proxy to swift-storage swift-storage relation
+           data."""
+        unit = self.swift_proxy_sentry
+        relation = ['swift-storage', 'swift-storage:swift-storage']
+        expected = {
+            'private-address': u.valid_ip,
+            'trigger': u.not_null,
+            'rings_url': u.valid_url,
+            'swift_hash': u.not_null
+        }
+
+        ret = u.validate_relation_data(unit, relation, expected)
+        if ret:
+            message = u.relation_error('swift-proxy swift-storage', ret)
+            amulet.raise_status(amulet.FAIL, msg=message)
+
+    def test_glance_object_store_relation(self):
+        """Verify the glance to swift-proxy object-store relation data."""
+        unit = self.glance_sentry
+        relation = ['object-store', 'swift-proxy:object-store']
+        expected = { 'private-address': u.valid_ip }
+
+        ret = u.validate_relation_data(unit, relation, expected)
+        if ret:
+            message = u.relation_error('glance object-store', ret)
+            amulet.raise_status(amulet.FAIL, msg=message)
+
+    def test_swift_proxy_object_store_relation(self):
+        """Verify the swift-proxy to glance object-store relation data."""
+        unit = self.swift_proxy_sentry
+        relation = ['object-store', 'glance:object-store']
+        expected = {'private-address': u.valid_ip}
+        ret = u.validate_relation_data(unit, relation, expected)
+        if ret:
+            message = u.relation_error('swift-proxy object-store', ret)
+            amulet.raise_status(amulet.FAIL, msg=message)
+
+    def test_restart_on_config_change(self):
+        """Verify that the specified services are restarted when the config
+           is changed."""
+        svc = 'swift-proxy'
+        self.d.configure('swift-proxy', {'node-timeout': '90'})
+
+        if not u.service_restarted(self.swift_proxy_sentry, svc,
+                                   '/etc/swift/proxy-server.conf'):
+            msg = "service {} didn't restart after config change".format(svc)
+            amulet.raise_status(amulet.FAIL, msg=msg)
+
+        self.d.configure('swift-proxy', {'node-timeout': '60'})
+
+    def test_swift_config(self):
+        """Verify the data in the swift config file."""
+        unit = self.swift_proxy_sentry
+        conf = '/etc/swift/swift.conf'
+        swift_proxy_relation = unit.relation('swift-storage',
+                                             'swift-storage:swift-storage')
+        expected = {
+            'swift_hash_path_suffix': swift_proxy_relation['swift_hash']
+        }
+
+        ret = u.validate_config_data(unit, conf, 'swift-hash', expected)
+        if ret:
+            message = "swift config error: {}".format(ret)
+            amulet.raise_status(amulet.FAIL, msg=message)
+
+    def test_proxy_server_icehouse_config(self):
+        """Verify the data in the proxy-server config file."""
+        if self._get_openstack_release() < self.precise_icehouse:
+            return
+
+        unit = self.swift_proxy_sentry
+        conf = '/etc/swift/proxy-server.conf'
+        keystone_relation = self.keystone_sentry.relation('identity-service',
+                                                 'swift-proxy:identity-service')
+        swift_proxy_relation = unit.relation('identity-service',
+                                             'keystone:identity-service')
+        swift_proxy_ip = swift_proxy_relation['private-address']
+        auth_host = keystone_relation['auth_host']
+        auth_protocol = keystone_relation['auth_protocol']
+
+        expected = {
+            'DEFAULT': {
+                'bind_port': '8080',
+                'workers': '0',
+                'user': 'swift'
+            },
+            'pipeline:main': {
+                'pipeline': 'gatekeeper healthcheck cache swift3 s3token '
+                            'container_sync bulk tempurl slo dlo formpost '
+                            'authtoken keystoneauth staticweb '
+                            'container-quotas account-quotas proxy-server'
+            },
+            'app:proxy-server': {
+                'use': 'egg:swift#proxy',
+                'allow_account_management': 'true',
+                'account_autocreate': 'true',
+                'node_timeout': '60',
+                'recoverable_node_timeout': '30'
+            },
+            'filter:tempauth': {
+                'use': 'egg:swift#tempauth',
+                'user_system_root': 'testpass .admin https://{}:8080/v1/'
+                                    'AUTH_system'.format(swift_proxy_ip)
+            },
+            'filter:healthcheck': {'use': 'egg:swift#healthcheck'},
+            'filter:cache': {
+                'use': 'egg:swift#memcache',
+                'memcache_servers': '{}:11211'.format(swift_proxy_ip)
+            },
+            'filter:account-quotas': {'use': 'egg:swift#account_quotas'},
+            'filter:container-quotas': {'use': 'egg:swift#container_quotas'},
+            'filter:staticweb': {'use': 'egg:swift#staticweb'},
+            'filter:bulk': {'use': 'egg:swift#bulk'},
+            'filter:slo': {'use': 'egg:swift#slo'},
+            'filter:dlo': {'use': 'egg:swift#dlo'},
+            'filter:formpost': {'use': 'egg:swift#formpost'},
+            'filter:tempurl': {'use': 'egg:swift#tempurl'},
+            'filter:container_sync': {'use': 'egg:swift#container_sync'},
+            'filter:gatekeeper': {'use': 'egg:swift#gatekeeper'},
+            'filter:keystoneauth': {
+                'use': 'egg:swift#keystoneauth',
+                'operator_roles': 'Member,Admin'
+            },
+            'filter:authtoken': {
+                'paste.filter_factory': 'keystoneclient.middleware.'
+                                        'auth_token:filter_factory',
+                'auth_host': auth_host,
+                'auth_port': keystone_relation['auth_port'],
+                'auth_protocol': auth_protocol,
+                'auth_uri': '{}://{}:{}'.format(auth_protocol, auth_host,
+                                             keystone_relation['service_port']),
+                'admin_tenant_name': keystone_relation['service_tenant'],
+                'admin_user': keystone_relation['service_username'],
+                'admin_password': keystone_relation['service_password'],
+                'delay_auth_decision': 'true',
+                'signing_dir': '/etc/swift',
+                'cache': 'swift.cache'
+            },
+            'filter:s3token': {
+                'paste.filter_factory': 'keystoneclient.middleware.'
+                                        's3_token:filter_factory',
+                'service_host': keystone_relation['service_host'],
+                'service_port': keystone_relation['service_port'],
+                'auth_port': keystone_relation['auth_port'],
+                'auth_host': keystone_relation['auth_host'],
+                'auth_protocol': keystone_relation['auth_protocol'],
+                'auth_token': keystone_relation['admin_token'],
+                'admin_token': keystone_relation['admin_token']
+            },
+            'filter:swift3': {'use': 'egg:swift3#swift3'}
+        }
+
+        for section, pairs in expected.iteritems():
+            ret = u.validate_config_data(unit, conf, section, pairs)
+            if ret:
+                message = "proxy-server config error: {}".format(ret)
+                amulet.raise_status(amulet.FAIL, msg=message)
+
+    def test_proxy_server_havana_config(self):
+        """Verify the data in the proxy-server config file."""
+        if self._get_openstack_release() != self.precise_havana:
+            return
+
+        unit = self.swift_proxy_sentry
+        conf = '/etc/swift/proxy-server.conf'
+        keystone_relation = self.keystone_sentry.relation('identity-service',
+                                                 'swift-proxy:identity-service')
+        swift_proxy_relation = unit.relation('identity-service',
+                                             'keystone:identity-service')
+        swift_proxy_ip = swift_proxy_relation['private-address']
+        auth_host = keystone_relation['auth_host']
+        auth_protocol = keystone_relation['auth_protocol']
+
+        expected = {
+            'DEFAULT': {
+                'bind_port': '8080',
+                'workers': '0',
+                'user': 'swift'
+            },
+            'pipeline:main': {
+                'pipeline': 'healthcheck cache swift3 authtoken '
+                            'keystoneauth container-quotas account-quotas '
+                            'proxy-server'
+            },
+            'app:proxy-server': {
+                'use': 'egg:swift#proxy',
+                'allow_account_management': 'true',
+                'account_autocreate': 'true',
+                'node_timeout': '60',
+                'recoverable_node_timeout': '30'
+            },
+            'filter:tempauth': {
+                'use': 'egg:swift#tempauth',
+                'user_system_root': 'testpass .admin https://{}:8080/v1/'
+                                    'AUTH_system'.format(swift_proxy_ip)
+            },
+            'filter:healthcheck': {'use': 'egg:swift#healthcheck'},
+            'filter:cache': {
+                'use': 'egg:swift#memcache',
+                'memcache_servers': '{}:11211'.format(swift_proxy_ip)
+            },
+            'filter:account-quotas': {'use': 'egg:swift#account_quotas'},
+            'filter:container-quotas': {'use': 'egg:swift#container_quotas'},
+            'filter:keystoneauth': {
+                'use': 'egg:swift#keystoneauth',
+                'operator_roles': 'Member,Admin'
+            },
+            'filter:authtoken': {
+                'paste.filter_factory': 'keystoneclient.middleware.'
+                                        'auth_token:filter_factory',
+                'auth_host': auth_host,
+                'auth_port': keystone_relation['auth_port'],
+                'auth_protocol': auth_protocol,
+                'auth_uri': '{}://{}:{}'.format(auth_protocol, auth_host,
+                                             keystone_relation['service_port']),
+                'admin_tenant_name': keystone_relation['service_tenant'],
+                'admin_user': keystone_relation['service_username'],
+                'admin_password': keystone_relation['service_password'],
+                'delay_auth_decision': 'true',
+                'signing_dir': '/etc/swift',
+                'cache': 'swift.cache'
+            },
+            'filter:s3token': {
+                'paste.filter_factory': 'keystone.middleware.s3_token:'
+                                        'filter_factory',
+                'service_host': keystone_relation['service_host'],
+                'service_port': keystone_relation['service_port'],
+                'auth_port': keystone_relation['auth_port'],
+                'auth_host': keystone_relation['auth_host'],
+                'auth_protocol': keystone_relation['auth_protocol'],
+                'auth_token': keystone_relation['admin_token'],
+                'admin_token': keystone_relation['admin_token'],
+                'service_protocol': keystone_relation['service_protocol']
+            },
+            'filter:swift3': {'use': 'egg:swift3#swift3'}
+        }
+
+        for section, pairs in expected.iteritems():
+            ret = u.validate_config_data(unit, conf, section, pairs)
+            if ret:
+                message = "proxy-server config error: {}".format(ret)
+                amulet.raise_status(amulet.FAIL, msg=message)
+
+    def test_proxy_server_grizzly_config(self):
+        """Verify the data in the proxy-server config file."""
+        if self._get_openstack_release() != self.precise_grizzly:
+            return
+
+        unit = self.swift_proxy_sentry
+        conf = '/etc/swift/proxy-server.conf'
+        keystone_relation = self.keystone_sentry.relation('identity-service',
+                                                 'swift-proxy:identity-service')
+        swift_proxy_relation = unit.relation('identity-service',
+                                             'keystone:identity-service')
+        swift_proxy_ip = swift_proxy_relation['private-address']
+        auth_host = keystone_relation['auth_host']
+        auth_protocol = keystone_relation['auth_protocol']
+
+        expected = {
+            'DEFAULT': {
+                'bind_port': '8080',
+                'workers': '0',
+                'user': 'swift'
+            },
+            'pipeline:main': {
+                'pipeline': 'healthcheck cache swift3 s3token authtoken '
+                            'keystone container-quotas account-quotas '
+                            'proxy-server'
+            },
+            'app:proxy-server': {
+                'use': 'egg:swift#proxy',
+                'allow_account_management': 'true',
+                'account_autocreate': 'true',
+                'node_timeout': '60',
+                'recoverable_node_timeout': '30'
+            },
+            'filter:tempauth': {
+                'use': 'egg:swift#tempauth',
+                'user_system_root': 'testpass .admin https://{}:8080/v1/'
+                                    'AUTH_system'.format(swift_proxy_ip)
+            },
+            'filter:healthcheck': {'use': 'egg:swift#healthcheck'},
+            'filter:cache': {
+                'use': 'egg:swift#memcache',
+                'memcache_servers': '{}:11211'.format(swift_proxy_ip)
+            },
+            'filter:account-quotas': {'use': 'egg:swift#account_quotas'},
+            'filter:container-quotas': {'use': 'egg:swift#container_quotas'},
+            'filter:keystone': {
+                'paste.filter_factory': 'swift.common.middleware.'
+                                        'keystoneauth:filter_factory',
+                'operator_roles': 'Member,Admin'
+            },
+            'filter:authtoken': {
+                'paste.filter_factory': 'keystone.middleware.auth_token:'
+                                        'filter_factory',
+                'auth_host': auth_host,
+                'auth_port': keystone_relation['auth_port'],
+                'auth_protocol': auth_protocol,
+                'auth_uri': '{}://{}:{}'.format(auth_protocol, auth_host,
+                                             keystone_relation['service_port']),
+                'admin_tenant_name': keystone_relation['service_tenant'],
+                'admin_user': keystone_relation['service_username'],
+                'admin_password': keystone_relation['service_password'],
+                'delay_auth_decision': 'true',
+                'signing_dir': '/etc/swift'
+            },
+            'filter:s3token': {
+                'paste.filter_factory': 'keystone.middleware.s3_token:'
+                                        'filter_factory',
+                'service_host': keystone_relation['service_host'],
+                'service_port': keystone_relation['service_port'],
+                'auth_port': keystone_relation['auth_port'],
+                'auth_host': keystone_relation['auth_host'],
+                'auth_protocol': keystone_relation['auth_protocol'],
+                'auth_token': keystone_relation['admin_token'],
+                'admin_token': keystone_relation['admin_token'],
+                'service_protocol': keystone_relation['service_protocol']
+            },
+            'filter:swift3': {'use': 'egg:swift3#swift3'}
+        }
+
+        for section, pairs in expected.iteritems():
+            ret = u.validate_config_data(unit, conf, section, pairs)
+            if ret:
+                message = "proxy-server config error: {}".format(ret)
+                amulet.raise_status(amulet.FAIL, msg=message)
+
+    def test_proxy_server_folsom_config(self):
+        """Verify the data in the proxy-server config file."""
+        if self._get_openstack_release() != self.precise_folsom:
+            return
+
+        unit = self.swift_proxy_sentry
+        conf = '/etc/swift/proxy-server.conf'
+        keystone_relation = self.keystone_sentry.relation('identity-service',
+                                                 'swift-proxy:identity-service')
+        swift_proxy_relation = unit.relation('identity-service',
+                                             'keystone:identity-service')
+        swift_proxy_ip = swift_proxy_relation['private-address']
+        auth_host = keystone_relation['auth_host']
+        auth_protocol = keystone_relation['auth_protocol']
+
+        expected = {
+            'DEFAULT': {
+                'bind_port': '8080',
+                'workers': '0',
+                'user': 'swift'
+            },
+            'pipeline:main': {
+                'pipeline': 'healthcheck cache swift3 s3token authtoken '
+                            'keystone proxy-server'
+            },
+            'app:proxy-server': {
+                'use': 'egg:swift#proxy',
+                'allow_account_management': 'true',
+                'account_autocreate': 'true',
+                'node_timeout': '60',
+                'recoverable_node_timeout': '30'
+            },
+            'filter:tempauth': {
+                'use': 'egg:swift#tempauth',
+                'user_system_root': 'testpass .admin https://{}:8080/v1/'
+                                    'AUTH_system'.format(swift_proxy_ip)
+            },
+            'filter:healthcheck': {'use': 'egg:swift#healthcheck'},
+            'filter:cache': {
+                'use': 'egg:swift#memcache',
+                'memcache_servers': '{}:11211'.format(swift_proxy_ip)
+            },
+            'filter:keystone': {
+                'paste.filter_factory': 'keystone.middleware.swift_auth:'
+                                        'filter_factory',
+                'operator_roles': 'Member,Admin'
+            },
+            'filter:authtoken': {
+                'paste.filter_factory': 'keystone.middleware.auth_token:'
+                                        'filter_factory',
+                'auth_host': auth_host,
+                'auth_port': keystone_relation['auth_port'],
+                'auth_protocol': auth_protocol,
+                'auth_uri': '{}://{}:{}'.format(auth_protocol, auth_host,
+                                             keystone_relation['service_port']),
+                'admin_tenant_name': keystone_relation['service_tenant'],
+                'admin_user': keystone_relation['service_username'],
+                'admin_password': keystone_relation['service_password'],
+                'delay_auth_decision': '1'
+            },
+            'filter:s3token': {
+                'paste.filter_factory': 'keystone.middleware.s3_token:'
+                                        'filter_factory',
+                'service_host': keystone_relation['service_host'],
+                'service_port': keystone_relation['service_port'],
+                'auth_port': keystone_relation['auth_port'],
+                'auth_host': keystone_relation['auth_host'],
+                'auth_protocol': keystone_relation['auth_protocol'],
+                'auth_token': keystone_relation['admin_token'],
+                'admin_token': keystone_relation['admin_token'],
+                'service_protocol': keystone_relation['service_protocol']
+            },
+            'filter:swift3': {'use': 'egg:swift#swift3'}
+        }
+
+        for section, pairs in expected.iteritems():
+            ret = u.validate_config_data(unit, conf, section, pairs)
+            if ret:
+                message = "proxy-server config error: {}".format(ret)
+                amulet.raise_status(amulet.FAIL, msg=message)
+
+    def test_proxy_server_essex_config(self):
+        """Verify the data in the proxy-server config file."""
+        if self._get_openstack_release() != self.precise_essex:
+            return
+
+        unit = self.swift_proxy_sentry
+        conf = '/etc/swift/proxy-server.conf'
+        keystone_relation = self.keystone_sentry.relation('identity-service',
+                                                 'swift-proxy:identity-service')
+        swift_proxy_relation = unit.relation('identity-service',
+                                             'keystone:identity-service')
+        swift_proxy_ip = swift_proxy_relation['private-address']
+        auth_host = keystone_relation['auth_host']
+        auth_protocol = keystone_relation['auth_protocol']
+
+        expected = {
+            'DEFAULT': {
+                'bind_port': '8080',
+                'workers': '0',
+                'user': 'swift'
+            },
+            'pipeline:main': {
+                'pipeline': 'healthcheck cache swift3 s3token authtoken '
+                            'keystone proxy-server'
+            },
+            'app:proxy-server': {
+                'use': 'egg:swift#proxy',
+                'allow_account_management': 'true',
+                'account_autocreate': 'true',
+                'node_timeout': '60',
+                'recoverable_node_timeout': '30'
+            },
+            'filter:tempauth': {
+                'use': 'egg:swift#tempauth',
+                'user_system_root': 'testpass .admin https://{}:8080/v1/'
+                                    'AUTH_system'.format(swift_proxy_ip)
+            },
+            'filter:healthcheck': {'use': 'egg:swift#healthcheck'},
+            'filter:cache': {
+                'use': 'egg:swift#memcache',
+                'memcache_servers': '{}:11211'.format(swift_proxy_ip)
+            },
+            'filter:keystone': {
+                'paste.filter_factory': 'keystone.middleware.swift_auth:'
+                                        'filter_factory',
+                'operator_roles': 'Member,Admin'
+            },
+            'filter:authtoken': {
+                'paste.filter_factory': 'keystone.middleware.auth_token:'
+                                        'filter_factory',
+                'auth_host': auth_host,
+                'auth_port': keystone_relation['auth_port'],
+                'auth_protocol': auth_protocol,
+                'auth_uri': '{}://{}:{}'.format(auth_protocol, auth_host,
+                                         keystone_relation['service_port']),
+                'admin_tenant_name': keystone_relation['service_tenant'],
+                'admin_user': keystone_relation['service_username'],
+                'admin_password': keystone_relation['service_password'],
+                'delay_auth_decision': '1'
+            },
+            'filter:s3token': {
+                'paste.filter_factory': 'keystone.middleware.s3_token:'
+                                        'filter_factory',
+                'service_host': keystone_relation['service_host'],
+                'service_port': keystone_relation['service_port'],
+                'auth_port': keystone_relation['auth_port'],
+                'auth_host': keystone_relation['auth_host'],
+                'auth_protocol': keystone_relation['auth_protocol'],
+                'auth_token': keystone_relation['admin_token'],
+                'admin_token': keystone_relation['admin_token'],
+                'service_protocol': keystone_relation['service_protocol']
+            },
+            'filter:swift3': {'use': 'egg:swift#swift3'}
+        }
+
+        for section, pairs in expected.iteritems():
+            ret = u.validate_config_data(unit, conf, section, pairs)
+            if ret:
+                message = "proxy-server config error: {}".format(ret)
+                amulet.raise_status(amulet.FAIL, msg=message)
+
+    def test_image_create(self):
+        """Create an instance in glance, which is backed by swift, and validate
+           that some of the metadata for the image match in glance and swift."""
+        # NOTE(coreycb): Skipping failing test on folsom until resolved. On
+        #                folsom only, uploading an image to glance gets 400 Bad
+        #                Request - Error uploading image: (error): [Errno 111]
+        #                ECONNREFUSED (HTTP 400)
+        if self._get_openstack_release() == self.precise_folsom:
+            u.log.error("Skipping failing test until resolved")
+            return
+
+        # Create glance image
+        image = u.create_cirros_image(self.glance, "cirros-image")
+        if not image:
+            amulet.raise_status(amulet.FAIL, msg="Image create failed")
+
+        # Validate that cirros image exists in glance and get its checksum/size
+        images = list(self.glance.images.list())
+        if len(images) != 1:
+            msg = "Expected 1 glance image, found {}".format(len(images))
+            amulet.raise_status(amulet.FAIL, msg=msg)
+
+        if images[0].name != 'cirros-image':
+            message = "cirros image does not exist"
+            amulet.raise_status(amulet.FAIL, msg=message)
+
+        glance_image_md5 = image.checksum
+        glance_image_size = image.size
+
+        # Validate that swift object's checksum/size match that from glance
+        headers, containers = self.swift.get_account()
+        if len(containers) != 1:
+            msg = "Expected 1 swift container, found {}".format(len(containers))
+            amulet.raise_status(amulet.FAIL, msg=msg)
+
+        container_name = containers[0].get('name')
+
+        headers, objects = self.swift.get_container(container_name)
+        if len(objects) != 1:
+            msg = "Expected 1 swift object, found {}".format(len(objects))
+            amulet.raise_status(amulet.FAIL, msg=msg)
+
+        swift_object_size = objects[0].get('bytes')
+        swift_object_md5 = objects[0].get('hash')
+
+        if glance_image_size != swift_object_size:
+            msg = "Glance image size {} != swift object size {}".format( \
+                                           glance_image_size, swift_object_size)
+            amulet.raise_status(amulet.FAIL, msg=msg)
+
+        if glance_image_md5 != swift_object_md5:
+            msg = "Glance image hash {} != swift object hash {}".format( \
+                                             glance_image_md5, swift_object_md5)
+            amulet.raise_status(amulet.FAIL, msg=msg)
+
+        # Cleanup
+        u.delete_image(self.glance, image)
 
=== added directory 'tests/charmhelpers'
=== added file 'tests/charmhelpers/__init__.py'
=== added directory 'tests/charmhelpers/contrib'
=== added file 'tests/charmhelpers/contrib/__init__.py'
=== added directory 'tests/charmhelpers/contrib/amulet'
=== added file 'tests/charmhelpers/contrib/amulet/__init__.py'
=== added file 'tests/charmhelpers/contrib/amulet/deployment.py'
--- tests/charmhelpers/contrib/amulet/deployment.py	1970-01-01 00:00:00 +0000
+++ tests/charmhelpers/contrib/amulet/deployment.py	2014-10-06 15:38:41 +0000
@@ -0,0 +1,72 @@
+import amulet
+
+import os
+
+
+class AmuletDeployment(object):
+    """Amulet deployment.