coreos-cloudinit: bump to v1.2.1

config: add support for multiple github users

.travis.yml

@@ -1,11 +1,17 @@
 language: go
-go:
-  - 1.3
-  - 1.2
+sudo: false
+matrix:
+  include:
+    - go: 1.4
+      env: TOOLS_CMD=golang.org/x/tools/cmd
+    - go: 1.3
+      env: TOOLS_CMD=code.google.com/p/go.tools/cmd
+    - go: 1.2
+      env: TOOLS_CMD=code.google.com/p/go.tools/cmd
 
 install:
- - go get code.google.com/p/go.tools/cmd/cover
- - go get code.google.com/p/go.tools/cmd/vet
+ - go get ${TOOLS_CMD}/cover
+ - go get ${TOOLS_CMD}/vet
 
 script:
  - ./test

Documentation/cloud-config.md

@@ -1,6 +1,8 @@
 # Using Cloud-Config
 
-CoreOS allows you to declaratively customize various OS-level items, such as network configuration, user accounts, and systemd units. This document describes the full list of items we can configure. The `coreos-cloudinit` program uses these files as it configures the OS after startup or during runtime. Your cloud-config is processed during each boot.
+CoreOS allows you to declaratively customize various OS-level items, such as network configuration, user accounts, and systemd units. This document describes the full list of items we can configure. The `coreos-cloudinit` program uses these files as it configures the OS after startup or during runtime.
+
+Your cloud-config is processed during each boot. Invalid cloud-config won't be processed but will be logged in the journal. You can validate your cloud-config with the [CoreOS validator]({{site.url}}/validate) or by running `coreos-cloudinit -validate`.
 
 ## Configuration File
 
@@ -16,7 +18,7 @@ We've designed our implementation to allow the same cloud-config file to work ac
 
 The cloud-config file uses the [YAML][yaml] file format, which uses whitespace and new-lines to delimit lists, associative arrays, and values.
 
-A cloud-config file should contain `#cloud-config`, followed by an associative array which has zero or more of the following keys:
+A cloud-config file must contain `#cloud-config`, followed by an associative array which has zero or more of the following keys:
 
 - `coreos`
 - `ssh_authorized_keys`
@@ -66,7 +68,6 @@ Environment="ETCD_PEER_ADDR=192.0.2.13:7001"
 ```
 
 For more information about the available configuration parameters, see the [etcd documentation][etcd-config].
-Note that hyphens in the coreos.etcd.* keys are mapped to underscores.
 
 _Note: The `$private_ipv4` and `$public_ipv4` substitution variables referenced in other documents are only supported on Amazon EC2, Google Compute Engine, OpenStack, Rackspace, DigitalOcean, and Vagrant._
 
@@ -97,6 +98,63 @@ For more information on fleet configuration, see the [fleet documentation][fleet
 
 [fleet-config]: https://github.com/coreos/fleet/blob/master/Documentation/deployment-and-configuration.md#configuration
 
+#### flannel
+
+The `coreos.flannel.*` parameters also work very similarly to `coreos.etcd.*`
+and `coreos.fleet.*`. They can be used to set environment variables for
+flanneld. For example, the following cloud-config...
+
+```yaml
+#cloud-config
+
+coreos:
+  flannel:
+      etcd_prefix: /coreos.com/network2
+```
+
+...will generate a systemd unit drop-in like so:
+
+```
+[Service]
+Environment="FLANNELD_ETCD_PREFIX=/coreos.com/network2"
+```
+
+List of flannel configuration parameters:
+- **etcd_endpoints**: Comma separated list of etcd endpoints
+- **etcd_cafile**: Path to CA file used for TLS communication with etcd
+- **etcd_certfile**: Path to certificate file used for TLS communication with etcd
+- **etcd_keyfile**: Path to private key file used for TLS communication with etcd
+- **etcd_prefix**: Etcd prefix path to be used for flannel keys
+- **ip_masq**: Install IP masquerade rules for traffic outside of flannel subnet
+- **subnet_file**: Path to flannel subnet file to write out
+- **interface**: Interface (name or IP) that should be used for inter-host communication
+
+[flannel-readme]: https://github.com/coreos/flannel/blob/master/README.md
+
+#### locksmith
+
+The `coreos.locksmith.*` parameters can be used to set environment variables
+for locksmith. For example, the following cloud-config...
+
+```yaml
+#cloud-config
+
+coreos:
+  locksmith:
+      endpoint: example.com:4001
+```
+
+...will generate a systemd unit drop-in like so:
+
+```
+[Service]
+Environment="LOCKSMITHD_ENDPOINT=example.com:4001"
+```
+
+For the complete list of locksmith configuraion parameters, see the [locksmith documentation][locksmith-readme].
+
+[locksmith-readme]: https://github.com/coreos/locksmith/blob/master/README.md
+
 #### update
 
 The `coreos.update.*` parameters manipulate settings related to how CoreOS instances are updated.
@@ -135,6 +193,10 @@ Each item is an object with the following fields:
 - **content**: Plaintext string representing entire unit file. If no value is provided, the unit is assumed to exist already.
 - **command**: Command to execute on unit: start, stop, reload, restart, try-restart, reload-or-restart, reload-or-try-restart. The default behavior is to not execute any commands.
 - **mask**: Whether to mask the unit file by symlinking it to `/dev/null` (analogous to `systemctl mask <name>`). Note that unlike `systemctl mask`, **this will destructively remove any existing unit file** located at `/etc/systemd/system/<unit>`, to ensure that the mask succeeds. The default value is false.
+- **drop-ins**: A list of unit drop-ins with the following fields:
+  - **name**: String representing unit's name. Required.
+  - **content**: Plaintext string representing entire file. Required.
+
 
 **NOTE:** The command field is ignored for all network, netdev, and link units. The systemd-networkd.service unit will be restarted in their place.
 
@@ -161,6 +223,21 @@ coreos:
         ExecStop=/usr/bin/docker stop -t 2 redis_server
 ```
 
+Add the DOCKER_OPTS environment variable to docker.service.
+
+```yaml
+#cloud-config
+
+coreos:
+  units:
+    - name: docker.service
+      drop-ins:
+        - name: 50-insecure-registry.conf
+          content: |
+            [Service]
+            Environment=DOCKER_OPTS='--insecure-registry="10.0.1.0/24"'
+```
+
 Start the built-in `etcd` and `fleet` services:
 
 ```yaml
@@ -214,6 +291,7 @@ All but the `passwd` and `ssh-authorized-keys` fields will be ignored if the use
 - **no-user-group**: Boolean. Skip default group creation.
 - **ssh-authorized-keys**: List of public SSH keys to authorize for this user
 - **coreos-ssh-import-github**: Authorize SSH keys from Github user
+- **coreos-ssh-import-github-users**: Authorize SSH keys from a list of Github users
 - **coreos-ssh-import-url**: Authorize SSH keys imported from a url endpoint.
 - **system**: Create the user as a system user. No home directory will be created.
 - **no-log-init**: Boolean. Skip initialization of lastlog and faillog databases.
@@ -303,11 +381,13 @@ Each item in the list may have the following keys:
 
 - **path**: Absolute location on disk where contents should be written
 - **content**: Data to write at the provided `path`
-- **permissions**: String representing file permissions in octal notation (i.e. '0644')
+- **permissions**: Integer representing file permissions, typically in octal notation (i.e. 0644)
 - **owner**: User and group that should own the file written to disk. This is equivalent to the `<user>:<group>` argument to `chown <user>:<group> <path>`.
+- **encoding**: Optional. The encoding of the data in content. If not specified this defaults to the yaml document encoding (usually utf-8). Supported encoding types are:
+    - **b64, base64**: Base64 encoded content
+    - **gz, gzip**: gzip encoded content, for use with the !!binary tag
+    - **gz+b64, gz+base64, gzip+b64, gzip+base64**: Base64 encoded gzip content
 
-Explicitly not implemented is the **encoding** attribute.
-The **content** field must represent exactly what should be written to disk.
 
 ```yaml
 #cloud-config
@@ -322,6 +402,24 @@ write_files:
     owner: root
     content: |
       Good news, everyone!
+  - path: /tmp/like_this
+    permissions: 0644
+    owner: root
+    encoding: gzip
+    content: !!binary |
+      H4sIAKgdh1QAAwtITM5WyK1USMqvUCjPLMlQSMssS1VIya9KzVPIySwszS9SyCpNLwYARQFQ5CcAAAA=
+  - path: /tmp/or_like_this
+    permissions: 0644
+    owner: root
+    encoding: gzip+base64
+    content: |
+      H4sIAKgdh1QAAwtITM5WyK1USMqvUCjPLMlQSMssS1VIya9KzVPIySwszS9SyCpNLwYARQFQ5CcAAAA=
+  - path: /tmp/todolist
+    permissions: 0644
+    owner: root
+    encoding: base64
+    content: |
+      UGFjayBteSBib3ggd2l0aCBmaXZlIGRvemVuIGxpcXVvciBqdWdz
 ```
 
 ### manage_etc_hosts

Godeps/Godeps.json

@@ -1,6 +1,6 @@
 {
 	"ImportPath": "github.com/coreos/coreos-cloudinit",
-	"GoVersion": "go1.3.1",
+	"GoVersion": "go1.3.3",
 	"Packages": [
 		"./..."
 	],
@@ -13,6 +13,10 @@
 			"ImportPath": "github.com/coreos/go-systemd/dbus",
 			"Rev": "4fbc5060a317b142e6c7bfbedb65596d5f0ab99b"
 		},
+		{
+			"ImportPath": "github.com/coreos/yaml",
+			"Rev": "6b16a5714269b2f70720a45406b1babd947a17ef"
+		},
 		{
 			"ImportPath": "github.com/dotcloud/docker/pkg/netlink",
 			"Comment": "v0.11.1-359-g55d41c3e21e1",
@@ -25,10 +29,6 @@
 		{
 			"ImportPath": "github.com/tarm/goserial",
 			"Rev": "cdabc8d44e8e84f58f18074ae44337e1f2f375b9"
-		},
-		{
-			"ImportPath": "gopkg.in/yaml.v1",
-			"Rev": "feb4ca79644e8e7e39c06095246ee54b1282c118"
 		}
 	]
 }

Godeps/_workspace/src/github.com/coreos/yaml/LICENSE

@@ -1,3 +1,6 @@
+
+Copyright (c) 2011-2014 - Canonical Inc.
+
 This software is licensed under the LGPLv3, included below.
 
 As a special exception to the GNU Lesser General Public License version 3

Godeps/_workspace/src/github.com/coreos/yaml/README.md

@@ -1,3 +1,6 @@
+Note: This is a fork of https://github.com/go-yaml/yaml. The following README
+doesn't necessarily apply to this fork.
+
 # YAML support for the Go language
 
 Introduction
@@ -12,10 +15,10 @@ C library to parse and generate YAML data quickly and reliably.
 Compatibility
 -------------
 
-The yaml package is almost compatible with YAML 1.1, including support for
-anchors, tags, etc. There are still a few missing bits, such as document
-merging, base-60 floats (huh?), and multi-document unmarshalling. These
-features are not hard to add, and will be introduced as necessary.
+The yaml package supports most of YAML 1.1 and 1.2, including support for
+anchors, tags, map merging, etc. Multi-document unmarshalling is not yet
+implemented, and base-60 floats from YAML 1.1 are purposefully not
+supported since they're a poor design and are gone in YAML 1.2.
 
 Installation and usage
 ----------------------

Godeps/_workspace/src/github.com/coreos/yaml/decode.go

@@ -1,6 +1,8 @@
 package yaml
 
 import (
+	"encoding/base64"
+	"fmt"
 	"reflect"
 	"strconv"
 	"time"
@@ -31,10 +33,12 @@ type parser struct {
 	parser    yaml_parser_t
 	event     yaml_event_t
 	doc       *node
+	transform transformString
 }
 
-func newParser(b []byte) *parser {
-	p := parser{}
+func newParser(b []byte, t transformString) *parser {
+	p := parser{transform: t}
+
 	if !yaml_parser_initialize(&p.parser) {
 		panic("Failed to initialize YAML emitter")
 	}
@@ -63,7 +67,7 @@ func (p *parser) destroy() {
 func (p *parser) skip() {
 	if p.event.typ != yaml_NO_EVENT {
 		if p.event.typ == yaml_STREAM_END_EVENT {
-			panic("Attempted to go past the end of stream. Corrupted value?")
+			fail("Attempted to go past the end of stream. Corrupted value?")
 		}
 		yaml_event_delete(&p.event)
 	}
@@ -89,7 +93,7 @@ func (p *parser) fail() {
 	} else {
 		msg = "Unknown problem parsing YAML content"
 	}
-	panic(where + msg)
+	fail(where + msg)
 }
 
 func (p *parser) anchor(n *node, anchor []byte) {
@@ -114,10 +118,9 @@ func (p *parser) parse() *node {
 		// Happens when attempting to decode an empty buffer.
 		return nil
 	default:
-		panic("Attempted to parse unknown event: " +
-			strconv.Itoa(int(p.event.typ)))
+		panic("Attempted to parse unknown event: " + strconv.Itoa(int(p.event.typ)))
 	}
-	panic("Unreachable")
+	panic("unreachable")
 }
 
 func (p *parser) node(kind int) *node {
@@ -135,8 +138,7 @@ func (p *parser) document() *node {
 	p.skip()
 	n.children = append(n.children, p.parse())
 	if p.event.typ != yaml_DOCUMENT_END_EVENT {
-		panic("Expected end of document event but got " +
-			strconv.Itoa(int(p.event.typ)))
+		panic("Expected end of document event but got " + strconv.Itoa(int(p.event.typ)))
 	}
 	p.skip()
 	return n
@@ -175,7 +177,10 @@ func (p *parser) mapping() *node {
 	p.anchor(n, p.event.anchor)
 	p.skip()
 	for p.event.typ != yaml_MAPPING_END_EVENT {
-		n.children = append(n.children, p.parse(), p.parse())
+		key := p.parse()
+		key.value = p.transform(key.value)
+		value := p.parse()
+		n.children = append(n.children, key, value)
 	}
 	p.skip()
 	return n
@@ -218,7 +223,7 @@ func (d *decoder) setter(tag string, out *reflect.Value, good *bool) (set func()
 			var arg interface{}
 			*out = reflect.ValueOf(&arg).Elem()
 			return func() {
-				*good = setter.SetYAML(tag, arg)
+				*good = setter.SetYAML(shortTag(tag), arg)
 			}
 		}
 	}
@@ -226,7 +231,7 @@ func (d *decoder) setter(tag string, out *reflect.Value, good *bool) (set func()
 	for again {
 		again = false
 		setter, _ := (*out).Interface().(Setter)
-		if tag != "!!null" || setter != nil {
+		if tag != yaml_NULL_TAG || setter != nil {
 			if pv := (*out); pv.Kind() == reflect.Ptr {
 				if pv.IsNil() {
 					*out = reflect.New(pv.Type().Elem()).Elem()
@@ -242,7 +247,7 @@ func (d *decoder) setter(tag string, out *reflect.Value, good *bool) (set func()
 			var arg interface{}
 			*out = reflect.ValueOf(&arg).Elem()
 			return func() {
-				*good = setter.SetYAML(tag, arg)
+				*good = setter.SetYAML(shortTag(tag), arg)
 			}
 		}
 	}
@@ -279,10 +284,10 @@ func (d *decoder) document(n *node, out reflect.Value) (good bool) {
 func (d *decoder) alias(n *node, out reflect.Value) (good bool) {
 	an, ok := d.doc.anchors[n.value]
 	if !ok {
-		panic("Unknown anchor '" + n.value + "' referenced")
+		fail("Unknown anchor '" + n.value + "' referenced")
 	}
 	if d.aliases[n.value] {
-		panic("Anchor '" + n.value + "' value contains itself")
+		fail("Anchor '" + n.value + "' value contains itself")
 	}
 	d.aliases[n.value] = true
 	good = d.unmarshal(an, out)
@@ -290,23 +295,50 @@ func (d *decoder) alias(n *node, out reflect.Value) (good bool) {
 	return good
 }
 
+var zeroValue reflect.Value
+
+func resetMap(out reflect.Value) {
+	for _, k := range out.MapKeys() {
+		out.SetMapIndex(k, zeroValue)
+	}
+}
+
 var durationType = reflect.TypeOf(time.Duration(0))
 
 func (d *decoder) scalar(n *node, out reflect.Value) (good bool) {
 	var tag string
 	var resolved interface{}
 	if n.tag == "" && !n.implicit {
-		tag = "!!str"
+		tag = yaml_STR_TAG
 		resolved = n.value
 	} else {
 		tag, resolved = resolve(n.tag, n.value)
+		if tag == yaml_BINARY_TAG {
+			data, err := base64.StdEncoding.DecodeString(resolved.(string))
+			if err != nil {
+				fail("!!binary value contains invalid base64 data")
+			}
+			resolved = string(data)
+		}
 	}
 	if set := d.setter(tag, &out, &good); set != nil {
 		defer set()
 	}
+	if resolved == nil {
+		if out.Kind() == reflect.Map && !out.CanAddr() {
+			resetMap(out)
+		} else {
+			out.Set(reflect.Zero(out.Type()))
+		}
+		good = true
+		return
+	}
 	switch out.Kind() {
 	case reflect.String:
-		if resolved != nil {
+		if tag == yaml_BINARY_TAG {
+			out.SetString(resolved.(string))
+			good = true
+		} else if resolved != nil {
 			out.SetString(n.value)
 			good = true
 		}
@@ -380,11 +412,6 @@ func (d *decoder) scalar(n *node, out reflect.Value) (good bool) {
 			good = true
 		}
 	case reflect.Ptr:
-		switch resolved.(type) {
-		case nil:
-			out.Set(reflect.Zero(out.Type()))
-			good = true
-		default:
 		if out.Type().Elem() == reflect.TypeOf(resolved) {
 			elem := reflect.New(out.Type().Elem())
 			elem.Elem().Set(reflect.ValueOf(resolved))
@@ -392,7 +419,6 @@ func (d *decoder) scalar(n *node, out reflect.Value) (good bool) {
 			good = true
 		}
 	}
-	}
 	return good
 }
 
@@ -404,7 +430,7 @@ func settableValueOf(i interface{}) reflect.Value {
 }
 
 func (d *decoder) sequence(n *node, out reflect.Value) (good bool) {
-	if set := d.setter("!!seq", &out, &good); set != nil {
+	if set := d.setter(yaml_SEQ_TAG, &out, &good); set != nil {
 		defer set()
 	}
 	var iface reflect.Value
@@ -433,7 +459,7 @@ func (d *decoder) sequence(n *node, out reflect.Value) (good bool) {
 }
 
 func (d *decoder) mapping(n *node, out reflect.Value) (good bool) {
-	if set := d.setter("!!map", &out, &good); set != nil {
+	if set := d.setter(yaml_MAP_TAG, &out, &good); set != nil {
 		defer set()
 	}
 	if out.Kind() == reflect.Struct {
@@ -465,6 +491,13 @@ func (d *decoder) mapping(n *node, out reflect.Value) (good bool) {
 		}
 		k := reflect.New(kt).Elem()
 		if d.unmarshal(n.children[i], k) {
+			kkind := k.Kind()
+			if kkind == reflect.Interface {
+				kkind = k.Elem().Kind()
+			}
+			if kkind == reflect.Map || kkind == reflect.Slice {
+				fail(fmt.Sprintf("invalid map key: %#v", k.Interface()))
+			}
 			e := reflect.New(et).Elem()
 			if d.unmarshal(n.children[i+1], e) {
 				out.SetMapIndex(k, e)
@@ -511,7 +544,7 @@ func (d *decoder) merge(n *node, out reflect.Value) {
 	case aliasNode:
 		an, ok := d.doc.anchors[n.value]
 		if ok && an.kind != mappingNode {
-			panic(wantMap)
+			fail(wantMap)
 		}
 		d.unmarshal(n, out)
 	case sequenceNode:
@@ -521,18 +554,18 @@ func (d *decoder) merge(n *node, out reflect.Value) {
 			if ni.kind == aliasNode {
 				an, ok := d.doc.anchors[ni.value]
 				if ok && an.kind != mappingNode {
-					panic(wantMap)
+					fail(wantMap)
 				}
 			} else if ni.kind != mappingNode {
-				panic(wantMap)
+				fail(wantMap)
 			}
 			d.unmarshal(ni, out)
 		}
 	default:
-		panic(wantMap)
+		fail(wantMap)
 	}
 }
 
 func isMerge(n *node) bool {
-	return n.kind == scalarNode && n.value == "<<" && (n.implicit == true || n.tag == "!!merge" || n.tag == "tag:yaml.org,2002:merge")
+	return n.kind == scalarNode && n.value == "<<" && (n.implicit == true || n.tag == yaml_MERGE_TAG)
 }

Godeps/_workspace/src/github.com/coreos/yaml/decode_test.go

@@ -1,10 +1,11 @@
 package yaml_test
 
 import (
+	"github.com/coreos/yaml"
 	. "gopkg.in/check.v1"
-	"github.com/coreos/coreos-cloudinit/Godeps/_workspace/src/gopkg.in/yaml.v1"
 	"math"
 	"reflect"
+	"strings"
 	"time"
 )
 
@@ -316,7 +317,10 @@ var unmarshalTests = []struct {
 		map[string]*string{"foo": new(string)},
 	}, {
 		"foo: null",
-		map[string]string{},
+		map[string]string{"foo": ""},
+	}, {
+		"foo: null",
+		map[string]interface{}{"foo": nil},
 	},
 
 	// Ignored field
@@ -377,6 +381,24 @@ var unmarshalTests = []struct {
 		"a: <foo>",
 		map[string]string{"a": "<foo>"},
 	},
+
+	// Base 60 floats are obsolete and unsupported.
+	{
+		"a: 1:1\n",
+		map[string]string{"a": "1:1"},
+	},
+
+	// Binary data.
+	{
+		"a: !!binary gIGC\n",
+		map[string]string{"a": "\x80\x81\x82"},
+	}, {
+		"a: !!binary |\n  " + strings.Repeat("kJCQ", 17) + "kJ\n  CQ\n",
+		map[string]string{"a": strings.Repeat("\x90", 54)},
+	}, {
+		"a: !!binary |\n  " + strings.Repeat("A", 70) + "\n  ==\n",
+		map[string]string{"a": strings.Repeat("\x00", 52)},
+	},
 }
 
 type inlineB struct {
@@ -424,12 +446,15 @@ func (s *S) TestUnmarshalNaN(c *C) {
 var unmarshalErrorTests = []struct {
 	data, error string
 }{
-	{"v: !!float 'error'", "YAML error: Can't decode !!str 'error' as a !!float"},
+	{"v: !!float 'error'", "YAML error: cannot decode !!str `error` as a !!float"},
 	{"v: [A,", "YAML error: line 1: did not find expected node content"},
 	{"v:\n- [A,", "YAML error: line 2: did not find expected node content"},
 	{"a: *b\n", "YAML error: Unknown anchor 'b' referenced"},
 	{"a: &a\n  b: *a\n", "YAML error: Anchor 'a' value contains itself"},
 	{"value: -", "YAML error: block sequence entries are not allowed in this context"},
+	{"a: !!binary ==", "YAML error: !!binary value contains invalid base64 data"},
+	{"{[.]}", `YAML error: invalid map key: \[\]interface \{\}\{"\."\}`},
+	{"{{.}}", `YAML error: invalid map key: map\[interface\ \{\}\]interface \{\}\{".":interface \{\}\(nil\)\}`},
 }
 
 func (s *S) TestUnmarshalErrors(c *C) {
@@ -532,6 +557,23 @@ func (s *S) TestUnmarshalWithFalseSetterIgnoresValue(c *C) {
 	c.Assert(m["ghi"].value, Equals, 3)
 }
 
+func (s *S) TestUnmarshalWithTransform(c *C) {
+	data := `{a_b: 1, c-d: 2, e-f_g: 3, h_i-j: 4}`
+	expect := map[string]int{
+		"a_b":   1,
+		"c_d":   2,
+		"e_f_g": 3,
+		"h_i_j": 4,
+	}
+	m := map[string]int{}
+	yaml.UnmarshalMappingKeyTransform = func(i string) string {
+		return strings.Replace(i, "-", "_", -1)
+	}
+	err := yaml.Unmarshal([]byte(data), m)
+	c.Assert(err, IsNil)
+	c.Assert(m, DeepEquals, expect)
+}
+
 // From http://yaml.org/type/merge.html
 var mergeTests = `
 anchors:
@@ -624,6 +666,30 @@ func (s *S) TestMergeStruct(c *C) {
 	}
 }
 
+var unmarshalNullTests = []func() interface{}{
+	func() interface{} { var v interface{}; v = "v"; return &v },
+	func() interface{} { var s = "s"; return &s },
+	func() interface{} { var s = "s"; sptr := &s; return &sptr },
+	func() interface{} { var i = 1; return &i },
+	func() interface{} { var i = 1; iptr := &i; return &iptr },
+	func() interface{} { m := map[string]int{"s": 1}; return &m },
+	func() interface{} { m := map[string]int{"s": 1}; return m },
+}
+
+func (s *S) TestUnmarshalNull(c *C) {
+	for _, test := range unmarshalNullTests {
+		item := test()
+		zero := reflect.Zero(reflect.TypeOf(item).Elem()).Interface()
+		err := yaml.Unmarshal([]byte("null"), item)
+		c.Assert(err, IsNil)
+		if reflect.TypeOf(item).Kind() == reflect.Map {
+			c.Assert(reflect.ValueOf(item).Interface(), DeepEquals, reflect.MakeMap(reflect.TypeOf(item)).Interface())
+		} else {
+			c.Assert(reflect.ValueOf(item).Elem().Interface(), DeepEquals, zero)
+		}
+	}
+}
+
 //var data []byte
 //func init() {
 //	var err error

Godeps/_workspace/src/github.com/coreos/yaml/emitterc.go

@@ -973,9 +973,9 @@ func yaml_emitter_analyze_tag(emitter *yaml_emitter_t, tag []byte) bool {
 		if bytes.HasPrefix(tag, tag_directive.prefix) {
 			emitter.tag_data.handle = tag_directive.handle
 			emitter.tag_data.suffix = tag[len(tag_directive.prefix):]
-		}
 			return true
 		}
+	}
 	emitter.tag_data.suffix = tag
 	return true
 }
@@ -1279,6 +1279,9 @@ func yaml_emitter_write_tag_content(emitter *yaml_emitter_t, value []byte, need_
 			for k := 0; k < w; k++ {
 				octet := value[i]
 				i++
+				if !put(emitter, '%') {
+					return false
+				}
 
 				c := octet >> 4
 				if c < 10 {

Godeps/_workspace/src/github.com/coreos/yaml/encode.go

@@ -2,8 +2,10 @@ package yaml
 
 import (
 	"reflect"
+	"regexp"
 	"sort"
 	"strconv"
+	"strings"
 	"time"
 )
 
@@ -50,14 +52,19 @@ func (e *encoder) must(ok bool) {
 		if msg == "" {
 			msg = "Unknown problem generating YAML content"
 		}
-		panic(msg)
+		fail(msg)
 	}
 }
 
 func (e *encoder) marshal(tag string, in reflect.Value) {
+	if !in.IsValid() {
+		e.nilv()
+		return
+	}
 	var value interface{}
 	if getter, ok := in.Interface().(Getter); ok {
 		tag, value = getter.GetYAML()
+		tag = longTag(tag)
 		if value == nil {
 			e.nilv()
 			return
@@ -98,7 +105,7 @@ func (e *encoder) marshal(tag string, in reflect.Value) {
 	case reflect.Bool:
 		e.boolv(tag, in)
 	default:
-		panic("Can't marshal type yet: " + in.Type().String())
+		panic("Can't marshal type: " + in.Type().String())
 	}
 }
 
@@ -167,11 +174,46 @@ func (e *encoder) slicev(tag string, in reflect.Value) {
 	e.emit()
 }
 
+// isBase60 returns whether s is in base 60 notation as defined in YAML 1.1.
+//
+// The base 60 float notation in YAML 1.1 is a terrible idea and is unsupported
+// in YAML 1.2 and by this package, but these should be marshalled quoted for
+// the time being for compatibility with other parsers.
+func isBase60Float(s string) (result bool) {
+	// Fast path.
+	if s == "" {
+		return false
+	}
+	c := s[0]
+	if !(c == '+' || c == '-' || c >= '0' && c <= '9') || strings.IndexByte(s, ':') < 0 {
+		return false
+	}
+	// Do the full match.
+	return base60float.MatchString(s)
+}
+
+// From http://yaml.org/type/float.html, except the regular expression there
+// is bogus. In practice parsers do not enforce the "\.[0-9_]*" suffix.
+var base60float = regexp.MustCompile(`^[-+]?[0-9][0-9_]*(?::[0-5]?[0-9])+(?:\.[0-9_]*)?$`)
+
 func (e *encoder) stringv(tag string, in reflect.Value) {
 	var style yaml_scalar_style_t
 	s := in.String()
-	if rtag, _ := resolve("", s); rtag != "!!str" {
+	rtag, rs := resolve("", s)
+	if rtag == yaml_BINARY_TAG {
+		if tag == "" || tag == yaml_STR_TAG {
+			tag = rtag
+			s = rs.(string)
+		} else if tag == yaml_BINARY_TAG {
+			fail("explicitly tagged !!binary data must be base64-encoded")
+		} else {
+			fail("cannot marshal invalid UTF-8 data as " + shortTag(tag))
+		}
+	}
+	if tag == "" && (rtag != yaml_STR_TAG || isBase60Float(s)) {
 		style = yaml_DOUBLE_QUOTED_SCALAR_STYLE
+	} else if strings.Contains(s, "\n") {
+		style = yaml_LITERAL_SCALAR_STYLE
 	} else {
 		style = yaml_PLAIN_SCALAR_STYLE
 	}
@@ -218,9 +260,6 @@ func (e *encoder) nilv() {
 
 func (e *encoder) emitScalar(value, anchor, tag string, style yaml_scalar_style_t) {
 	implicit := tag == ""
-	if !implicit {
-		style = yaml_PLAIN_SCALAR_STYLE
-	}
 	e.must(yaml_scalar_event_initialize(&e.event, []byte(anchor), []byte(tag), []byte(value), implicit, implicit, style))
 	e.emit()
 }

Godeps/_workspace/src/github.com/coreos/yaml/encode_test.go

@@ -2,12 +2,13 @@ package yaml_test
 
 import (
 	"fmt"
-	"github.com/coreos/coreos-cloudinit/Godeps/_workspace/src/gopkg.in/yaml.v1"
-	. "gopkg.in/check.v1"
 	"math"
 	"strconv"
 	"strings"
 	"time"
+
+	"github.com/coreos/yaml"
+	. "gopkg.in/check.v1"
 )
 
 var marshalIntTest = 123
@@ -17,6 +18,9 @@ var marshalTests = []struct {
 	data  string
 }{
 	{
+		nil,
+		"null\n",
+	}, {
 		&struct{}{},
 		"{}\n",
 	}, {
@@ -87,7 +91,7 @@ var marshalTests = []struct {
 		"v:\n- A\n- B\n",
 	}, {
 		map[string][]string{"v": []string{"A", "B\nC"}},
-		"v:\n- A\n- 'B\n\n  C'\n",
+		"v:\n- A\n- |-\n  B\n  C\n",
 	}, {
 		map[string][]interface{}{"v": []interface{}{"A", 1, map[string][]int{"B": []int{2, 3}}}},
 		"v:\n- A\n- 1\n- B:\n  - 2\n  - 3\n",
@@ -220,11 +224,39 @@ var marshalTests = []struct {
 		"a: 3s\n",
 	},
 
-	// Issue #24.
+	// Issue #24: bug in map merging logic.
 	{
 		map[string]string{"a": "<foo>"},
 		"a: <foo>\n",
 	},
+
+	// Issue #34: marshal unsupported base 60 floats quoted for compatibility
+	// with old YAML 1.1 parsers.
+	{
+		map[string]string{"a": "1:1"},
+		"a: \"1:1\"\n",
+	},
+
+	// Binary data.
+	{
+		map[string]string{"a": "\x00"},
+		"a: \"\\0\"\n",
+	}, {
+		map[string]string{"a": "\x80\x81\x82"},
+		"a: !!binary gIGC\n",
+	}, {
+		map[string]string{"a": strings.Repeat("\x90", 54)},
+		"a: !!binary |\n  " + strings.Repeat("kJCQ", 17) + "kJ\n  CQ\n",
+	}, {
+		map[string]interface{}{"a": typeWithGetter{"!!str", "\x80\x81\x82"}},
+		"a: !!binary gIGC\n",
+	},
+
+	// Escaping of tags.
+	{
+		map[string]interface{}{"a": typeWithGetter{"foo!bar", 1}},
+		"a: !<foo%21bar> 1\n",
+	},
 }
 
 func (s *S) TestMarshal(c *C) {
@@ -238,22 +270,31 @@ func (s *S) TestMarshal(c *C) {
 var marshalErrorTests = []struct {
 	value interface{}
 	error string
-}{
-	{
-		&struct {
+	panic string
+}{{
+	value: &struct {
 		B       int
 		inlineB ",inline"
 	}{1, inlineB{2, inlineC{3}}},
-		`Duplicated key 'b' in struct struct \{ B int; .*`,
-	},
-}
+	panic: `Duplicated key 'b' in struct struct \{ B int; .*`,
+}, {
+	value: typeWithGetter{"!!binary", "\x80"},
+	error: "YAML error: explicitly tagged !!binary data must be base64-encoded",
+}, {
+	value: typeWithGetter{"!!float", "\x80"},
+	error: `YAML error: cannot marshal invalid UTF-8 data as !!float`,
+}}
 
 func (s *S) TestMarshalErrors(c *C) {
 	for _, item := range marshalErrorTests {
+		if item.panic != "" {
+			c.Assert(func() { yaml.Marshal(item.value) }, PanicMatches, item.panic)
+		} else {
 			_, err := yaml.Marshal(item.value)
 			c.Assert(err, ErrorMatches, item.error)
 		}
 	}
+}
 
 var marshalTaggedIfaceTest interface{} = &struct{ A string }{"B"}
 

Godeps/_workspace/src/github.com/coreos/yaml/resolve.go

@@ -0,0 +1,190 @@
+package yaml
+
+import (
+	"encoding/base64"
+	"fmt"
+	"math"
+	"strconv"
+	"strings"
+	"unicode/utf8"
+)
+
+// TODO: merge, timestamps, base 60 floats, omap.
+
+type resolveMapItem struct {
+	value interface{}
+	tag   string
+}
+
+var resolveTable = make([]byte, 256)
+var resolveMap = make(map[string]resolveMapItem)
+
+func init() {
+	t := resolveTable
+	t[int('+')] = 'S' // Sign
+	t[int('-')] = 'S'
+	for _, c := range "0123456789" {
+		t[int(c)] = 'D' // Digit
+	}
+	for _, c := range "yYnNtTfFoO~" {
+		t[int(c)] = 'M' // In map
+	}
+	t[int('.')] = '.' // Float (potentially in map)
+
+	var resolveMapList = []struct {
+		v   interface{}
+		tag string
+		l   []string
+	}{
+		{true, yaml_BOOL_TAG, []string{"y", "Y", "yes", "Yes", "YES"}},
+		{true, yaml_BOOL_TAG, []string{"true", "True", "TRUE"}},
+		{true, yaml_BOOL_TAG, []string{"on", "On", "ON"}},
+		{false, yaml_BOOL_TAG, []string{"n", "N", "no", "No", "NO"}},
+		{false, yaml_BOOL_TAG, []string{"false", "False", "FALSE"}},
+		{false, yaml_BOOL_TAG, []string{"off", "Off", "OFF"}},
+		{nil, yaml_NULL_TAG, []string{"", "~", "null", "Null", "NULL"}},
+		{math.NaN(), yaml_FLOAT_TAG, []string{".nan", ".NaN", ".NAN"}},
+		{math.Inf(+1), yaml_FLOAT_TAG, []string{".inf", ".Inf", ".INF"}},
+		{math.Inf(+1), yaml_FLOAT_TAG, []string{"+.inf", "+.Inf", "+.INF"}},
+		{math.Inf(-1), yaml_FLOAT_TAG, []string{"-.inf", "-.Inf", "-.INF"}},
+		{"<<", yaml_MERGE_TAG, []string{"<<"}},
+	}
+
+	m := resolveMap
+	for _, item := range resolveMapList {
+		for _, s := range item.l {
+			m[s] = resolveMapItem{item.v, item.tag}
+		}
+	}
+}
+
+const longTagPrefix = "tag:yaml.org,2002:"
+
+func shortTag(tag string) string {
+	// TODO This can easily be made faster and produce less garbage.
+	if strings.HasPrefix(tag, longTagPrefix) {
+		return "!!" + tag[len(longTagPrefix):]
+	}
+	return tag
+}
+
+func longTag(tag string) string {
+	if strings.HasPrefix(tag, "!!") {
+		return longTagPrefix + tag[2:]
+	}
+	return tag
+}
+
+func resolvableTag(tag string) bool {
+	switch tag {
+	case "", yaml_STR_TAG, yaml_BOOL_TAG, yaml_INT_TAG, yaml_FLOAT_TAG, yaml_NULL_TAG:
+		return true
+	}
+	return false
+}
+
+func resolve(tag string, in string) (rtag string, out interface{}) {
+	if !resolvableTag(tag) {
+		return tag, in
+	}
+
+	defer func() {
+		switch tag {
+		case "", rtag, yaml_STR_TAG, yaml_BINARY_TAG:
+			return
+		}
+		fail(fmt.Sprintf("cannot decode %s `%s` as a %s", shortTag(rtag), in, shortTag(tag)))
+	}()
+
+	// Any data is accepted as a !!str or !!binary.
+	// Otherwise, the prefix is enough of a hint about what it might be.
+	hint := byte('N')
+	if in != "" {
+		hint = resolveTable[in[0]]
+	}
+	if hint != 0 && tag != yaml_STR_TAG && tag != yaml_BINARY_TAG {
+		// Handle things we can lookup in a map.
+		if item, ok := resolveMap[in]; ok {
+			return item.tag, item.value
+		}
+
+		// Base 60 floats are a bad idea, were dropped in YAML 1.2, and
+		// are purposefully unsupported here. They're still quoted on
+		// the way out for compatibility with other parser, though.
+
+		switch hint {
+		case 'M':
+			// We've already checked the map above.
+
+		case '.':
+			// Not in the map, so maybe a normal float.
+			floatv, err := strconv.ParseFloat(in, 64)
+			if err == nil {
+				return yaml_FLOAT_TAG, floatv
+			}
+
+		case 'D', 'S':
+			// Int, float, or timestamp.
+			plain := strings.Replace(in, "_", "", -1)
+			intv, err := strconv.ParseInt(plain, 0, 64)
+			if err == nil {
+				if intv == int64(int(intv)) {
+					return yaml_INT_TAG, int(intv)
+				} else {
+					return yaml_INT_TAG, intv
+				}
+			}
+			floatv, err := strconv.ParseFloat(plain, 64)
+			if err == nil {
+				return yaml_FLOAT_TAG, floatv
+			}
+			if strings.HasPrefix(plain, "0b") {
+				intv, err := strconv.ParseInt(plain[2:], 2, 64)
+				if err == nil {
+					return yaml_INT_TAG, int(intv)
+				}
+			} else if strings.HasPrefix(plain, "-0b") {
+				intv, err := strconv.ParseInt(plain[3:], 2, 64)
+				if err == nil {
+					return yaml_INT_TAG, -int(intv)
+				}
+			}
+			// XXX Handle timestamps here.
+
+		default:
+			panic("resolveTable item not yet handled: " + string(rune(hint)) + " (with " + in + ")")
+		}
+	}
+	if tag == yaml_BINARY_TAG {
+		return yaml_BINARY_TAG, in
+	}
+	if utf8.ValidString(in) {
+		return yaml_STR_TAG, in
+	}
+	return yaml_BINARY_TAG, encodeBase64(in)
+}
+
+// encodeBase64 encodes s as base64 that is broken up into multiple lines
+// as appropriate for the resulting length.
+func encodeBase64(s string) string {
+	const lineLen = 70
+	encLen := base64.StdEncoding.EncodedLen(len(s))
+	lines := encLen/lineLen + 1
+	buf := make([]byte, encLen*2+lines)
+	in := buf[0:encLen]
+	out := buf[encLen:]
+	base64.StdEncoding.Encode(in, []byte(s))
+	k := 0
+	for i := 0; i < len(in); i += lineLen {
+		j := i + lineLen
+		if j > len(in) {
+			j = len(in)
+		}
+		k += copy(out[k:], in[i:j])
+		if lines > 1 {
+			out[k] = '\n'
+			k++
+		}
+	}
+	return string(out[:k])
+}

Godeps/_workspace/src/github.com/coreos/yaml/yaml.go

@@ -10,23 +10,20 @@ import (
 	"errors"
 	"fmt"
 	"reflect"
-	"runtime"
 	"strings"
 	"sync"
 )
 
+type yamlError string
+
+func fail(msg string) {
+	panic(yamlError(msg))
+}
+
 func handleErr(err *error) {
 	if r := recover(); r != nil {
-		if _, ok := r.(runtime.Error); ok {
-			panic(r)
-		} else if _, ok := r.(*reflect.ValueError); ok {
-			panic(r)
-		} else if _, ok := r.(externalPanic); ok {
-			panic(r)
-		} else if s, ok := r.(string); ok {
-			*err = errors.New("YAML error: " + s)
-		} else if e, ok := r.(error); ok {
-			*err = e
+		if e, ok := r.(yamlError); ok {
+			*err = errors.New("YAML error: " + string(e))
 		} else {
 			panic(r)
 		}
@@ -78,7 +75,7 @@ type Getter interface {
 //         F int `yaml:"a,omitempty"`
 //         B int
 //     }
-//     var T t
+//     var t T
 //     yaml.Unmarshal([]byte("a: 1\nb: 2"), &t)
 //
 // See the documentation of Marshal for the format of tags and a list of
@@ -87,11 +84,15 @@ type Getter interface {
 func Unmarshal(in []byte, out interface{}) (err error) {
 	defer handleErr(&err)
 	d := newDecoder()
-	p := newParser(in)
+	p := newParser(in, UnmarshalMappingKeyTransform)
 	defer p.destroy()
 	node := p.parse()
 	if node != nil {
-		d.unmarshal(node, reflect.ValueOf(out))
+		v := reflect.ValueOf(out)
+		if v.Kind() == reflect.Ptr && !v.IsNil() {
+			v = v.Elem()
+		}
+		d.unmarshal(node, v)
 	}
 	return nil
 }
@@ -145,6 +146,17 @@ func Marshal(in interface{}) (out []byte, err error) {
 	return
 }
 
+// UnmarshalMappingKeyTransform is a string transformation that is applied to
+// each mapping key in a YAML document before it is unmarshalled. By default,
+// UnmarshalMappingKeyTransform is an identity transform (no modification).
+var UnmarshalMappingKeyTransform transformString = identityTransform
+
+type transformString func(in string) (out string)
+
+func identityTransform(in string) (out string) {
+	return in
+}
+
 // --------------------------------------------------------------------------
 // Maintain a mapping of keys to structure field indexes
 
@@ -174,12 +186,6 @@ type fieldInfo struct {
 var structMap = make(map[reflect.Type]*structInfo)
 var fieldMapMutex sync.RWMutex
 
-type externalPanic string
-
-func (e externalPanic) String() string {
-	return string(e)
-}
-
 func getStructInfo(st reflect.Type) (*structInfo, error) {
 	fieldMapMutex.RLock()
 	sinfo, found := structMap[st]
@@ -220,8 +226,7 @@ func getStructInfo(st reflect.Type) (*structInfo, error) {
 				case "inline":
 					inline = true
 				default:
-					msg := fmt.Sprintf("Unsupported flag %q in tag %q of type %s", flag, tag, st)
-					panic(externalPanic(msg))
+					return nil, errors.New(fmt.Sprintf("Unsupported flag %q in tag %q of type %s", flag, tag, st))
 				}
 			}
 			tag = fields[0]
@@ -229,6 +234,7 @@ func getStructInfo(st reflect.Type) (*structInfo, error) {
 
 		if inline {
 			switch field.Type.Kind() {
+			// TODO: Implement support for inline maps.
 			//case reflect.Map:
 			//	if inlineMap >= 0 {
 			//		return nil, errors.New("Multiple ,inline maps in struct " + st.String())
@@ -256,8 +262,8 @@ func getStructInfo(st reflect.Type) (*structInfo, error) {
 					fieldsList = append(fieldsList, finfo)
 				}
 			default:
-				//panic("Option ,inline needs a struct value or map field")
-				panic("Option ,inline needs a struct value field")
+				//return nil, errors.New("Option ,inline needs a struct value or map field")
+				return nil, errors.New("Option ,inline needs a struct value field")
 			}
 			continue
 		}

Godeps/_workspace/src/github.com/coreos/yaml/yamlh.go

@@ -294,6 +294,10 @@ const (
 	yaml_SEQ_TAG = "tag:yaml.org,2002:seq" // The tag !!seq is used to denote sequences.
 	yaml_MAP_TAG = "tag:yaml.org,2002:map" // The tag !!map is used to denote mapping.
 
+	// Not in original libyaml.
+	yaml_BINARY_TAG = "tag:yaml.org,2002:binary"
+	yaml_MERGE_TAG = "tag:yaml.org,2002:merge"
+
 	yaml_DEFAULT_SCALAR_TAG   = yaml_STR_TAG // The default scalar tag is !!str.
 	yaml_DEFAULT_SEQUENCE_TAG = yaml_SEQ_TAG // The default sequence tag is !!seq.
 	yaml_DEFAULT_MAPPING_TAG  = yaml_MAP_TAG // The default mapping tag is !!map.

Godeps/_workspace/src/gopkg.in/yaml.v1/resolve.go

@@ -1,147 +0,0 @@
-package yaml
-
-import (
-	"math"
-	"strconv"
-	"strings"
-)
-
-// TODO: merge, timestamps, base 60 floats, omap.
-
-type resolveMapItem struct {
-	value interface{}
-	tag   string
-}
-
-var resolveTable = make([]byte, 256)
-var resolveMap = make(map[string]resolveMapItem)
-
-func init() {
-	t := resolveTable
-	t[int('+')] = 'S' // Sign
-	t[int('-')] = 'S'
-	for _, c := range "0123456789" {
-		t[int(c)] = 'D' // Digit
-	}
-	for _, c := range "yYnNtTfFoO~" {
-		t[int(c)] = 'M' // In map
-	}
-	t[int('.')] = '.' // Float (potentially in map)
-
-	var resolveMapList = []struct {
-		v   interface{}
-		tag string
-		l   []string
-	}{
-		{true, "!!bool", []string{"y", "Y", "yes", "Yes", "YES"}},
-		{true, "!!bool", []string{"true", "True", "TRUE"}},
-		{true, "!!bool", []string{"on", "On", "ON"}},
-		{false, "!!bool", []string{"n", "N", "no", "No", "NO"}},
-		{false, "!!bool", []string{"false", "False", "FALSE"}},
-		{false, "!!bool", []string{"off", "Off", "OFF"}},
-		{nil, "!!null", []string{"~", "null", "Null", "NULL"}},
-		{math.NaN(), "!!float", []string{".nan", ".NaN", ".NAN"}},
-		{math.Inf(+1), "!!float", []string{".inf", ".Inf", ".INF"}},
-		{math.Inf(+1), "!!float", []string{"+.inf", "+.Inf", "+.INF"}},
-		{math.Inf(-1), "!!float", []string{"-.inf", "-.Inf", "-.INF"}},
-		{"<<", "!!merge", []string{"<<"}},
-	}
-
-	m := resolveMap
-	for _, item := range resolveMapList {
-		for _, s := range item.l {
-			m[s] = resolveMapItem{item.v, item.tag}
-		}
-	}
-}
-
-const longTagPrefix = "tag:yaml.org,2002:"
-
-func shortTag(tag string) string {
-	if strings.HasPrefix(tag, longTagPrefix) {
-		return "!!" + tag[len(longTagPrefix):]
-	}
-	return tag
-}
-
-func resolvableTag(tag string) bool {
-	switch tag {
-	case "", "!!str", "!!bool", "!!int", "!!float", "!!null":
-		return true
-	}
-	return false
-}
-
-func resolve(tag string, in string) (rtag string, out interface{}) {
-	tag = shortTag(tag)
-	if !resolvableTag(tag) {
-		return tag, in
-	}
-
-	defer func() {
-		if tag != "" && tag != rtag {
-			panic("Can't decode " + rtag + " '" + in + "' as a " + tag)
-		}
-	}()
-
-	if in == "" {
-		return "!!null", nil
-	}
-
-	c := resolveTable[in[0]]
-	if c == 0 {
-		// It's a string for sure. Nothing to do.
-		return "!!str", in
-	}
-
-	// Handle things we can lookup in a map.
-	if item, ok := resolveMap[in]; ok {
-		return item.tag, item.value
-	}
-
-	switch c {
-	case 'M':
-		// We've already checked the map above.
-
-	case '.':
-		// Not in the map, so maybe a normal float.
-		floatv, err := strconv.ParseFloat(in, 64)
-		if err == nil {
-			return "!!float", floatv
-		}
-	// XXX Handle base 60 floats here (WTF!)
-
-	case 'D', 'S':
-		// Int, float, or timestamp.
-		plain := strings.Replace(in, "_", "", -1)
-		intv, err := strconv.ParseInt(plain, 0, 64)
-		if err == nil {
-			if intv == int64(int(intv)) {
-				return "!!int", int(intv)
-			} else {
-				return "!!int", intv
-			}
-		}
-		floatv, err := strconv.ParseFloat(plain, 64)
-		if err == nil {
-			return "!!float", floatv
-		}
-		if strings.HasPrefix(plain, "0b") {
-			intv, err := strconv.ParseInt(plain[2:], 2, 64)
-			if err == nil {
-				return "!!int", int(intv)
-			}
-		} else if strings.HasPrefix(plain, "-0b") {
-			intv, err := strconv.ParseInt(plain[3:], 2, 64)
-			if err == nil {
-				return "!!int", -int(intv)
-			}
-		}
-	// XXX Handle timestamps here.
-
-	default:
-		panic("resolveTable item not yet handled: " +
-			string([]byte{c}) + " (with " + in + ")")
-	}
-	return "!!str", in
-}

config/config.go

@@ -18,11 +18,11 @@ package config
 
 import (
 	"fmt"
-	"log"
 	"reflect"
+	"regexp"
 	"strings"
 
-	"github.com/coreos/coreos-cloudinit/Godeps/_workspace/src/gopkg.in/yaml.v1"
+	"github.com/coreos/coreos-cloudinit/Godeps/_workspace/src/github.com/coreos/yaml"
 )
 
 // CloudConfig encapsulates the entire cloud-config configuration file and maps
@@ -30,13 +30,7 @@ import (
 // used for internal use) have the YAML tag '-' so that they aren't marshalled.
 type CloudConfig struct {
 	SSHAuthorizedKeys []string `yaml:"ssh_authorized_keys"`
-	Coreos            struct {
-		Etcd   Etcd   `yaml:"etcd"`
-		Fleet  Fleet  `yaml:"fleet"`
-		OEM    OEM    `yaml:"oem"`
-		Update Update `yaml:"update"`
-		Units  []Unit `yaml:"units"`
-	} `yaml:"coreos"`
+	CoreOS            CoreOS   `yaml:"coreos"`
 	WriteFiles        []File   `yaml:"write_files"`
 	Hostname          string   `yaml:"hostname"`
 	Users             []User   `yaml:"users"`
@@ -45,18 +39,38 @@ type CloudConfig struct {
 	NetworkConfig     string   `yaml:"-"`
 }
 
+type CoreOS struct {
+	Etcd      Etcd      `yaml:"etcd"`
+	Flannel   Flannel   `yaml:"flannel"`
+	Fleet     Fleet     `yaml:"fleet"`
+	Locksmith Locksmith `yaml:"locksmith"`
+	OEM       OEM       `yaml:"oem"`
+	Update    Update    `yaml:"update"`
+	Units     []Unit    `yaml:"units"`
+}
+
+func IsCloudConfig(userdata string) bool {
+	header := strings.SplitN(userdata, "\n", 2)[0]
+
+	// Explicitly trim the header so we can handle user-data from
+	// non-unix operating systems. The rest of the file is parsed
+	// by yaml, which correctly handles CRLF.
+	header = strings.TrimSuffix(header, "\r")
+
+	return (header == "#cloud-config")
+}
+
 // NewCloudConfig instantiates a new CloudConfig from the given contents (a
 // string of YAML), returning any error encountered. It will ignore unknown
 // fields but log encountering them.
 func NewCloudConfig(contents string) (*CloudConfig, error) {
+	yaml.UnmarshalMappingKeyTransform = func(nameIn string) (nameOut string) {
+		return strings.Replace(nameIn, "-", "_", -1)
+	}
 	var cfg CloudConfig
 	err := yaml.Unmarshal([]byte(contents), &cfg)
-	if err != nil {
 	return &cfg, err
 }
-	warnOnUnrecognizedKeys(contents, log.Printf)
-	return &cfg, nil
-}
 
 func (cc CloudConfig) String() string {
 	bytes, err := yaml.Marshal(cc)
@@ -76,10 +90,20 @@ func IsZero(c interface{}) bool {
 	return isZero(reflect.ValueOf(c))
 }
 
-// AssertValid checks the fields in the structure and makes sure that they
-// contain valid values as specified by the 'valid' flag. Empty fields are
+type ErrorValid struct {
+	Value string
+	Valid string
+	Field string
+}
+
+func (e ErrorValid) Error() string {
+	return fmt.Sprintf("invalid value %q for option %q (valid options: %q)", e.Value, e.Field, e.Valid)
+}
+
+// AssertStructValid checks the fields in the structure and makes sure that
+// they contain valid values as specified by the 'valid' flag. Empty fields are
 // implicitly valid.
-func AssertValid(c interface{}) error {
+func AssertStructValid(c interface{}) error {
 	ct := reflect.TypeOf(c)
 	cv := reflect.ValueOf(c)
 	for i := 0; i < ct.NumField(); i++ {
@@ -88,15 +112,32 @@ func AssertValid(c interface{}) error {
 			continue
 		}
 
-		valid := ft.Tag.Get("valid")
-		val := cv.Field(i)
-		if !isValid(val, valid) {
-			return fmt.Errorf("invalid value \"%v\" for option %q (valid options: %q)", val.Interface(), ft.Name, valid)
+		if err := AssertValid(cv.Field(i), ft.Tag.Get("valid")); err != nil {
+			err.Field = ft.Name
+			return err
 		}
 	}
 	return nil
 }
 
+// AssertValid checks to make sure that the given value is in the list of
+// valid values. Zero values are implicitly valid.
+func AssertValid(value reflect.Value, valid string) *ErrorValid {
+	if valid == "" || isZero(value) {
+		return nil
+	}
+
+	vs := fmt.Sprintf("%v", value.Interface())
+	if m, _ := regexp.MatchString(valid, vs); m {
+		return nil
+	}
+
+	return &ErrorValid{
+		Value: vs,
+		Valid: valid,
+	}
+}
+
 func isZero(v reflect.Value) bool {
 	switch v.Kind() {
 	case reflect.Struct:
@@ -115,100 +156,3 @@ func isZero(v reflect.Value) bool {
 func isFieldExported(f reflect.StructField) bool {
 	return f.PkgPath == ""
 }
-
-func isValid(v reflect.Value, valid string) bool {
-	if valid == "" || isZero(v) {
-		return true
-	}
-	vs := fmt.Sprintf("%v", v.Interface())
-	for _, valid := range strings.Split(valid, ",") {
-		if vs == valid {
-			return true
-		}
-	}
-	return false
-}
-
-type warner func(format string, v ...interface{})
-
-// warnOnUnrecognizedKeys parses the contents of a cloud-config file and calls
-// warn(msg, key) for every unrecognized key (i.e. those not present in CloudConfig)
-func warnOnUnrecognizedKeys(contents string, warn warner) {
-	// Generate a map of all understood cloud config options
-	var cc map[string]interface{}
-	b, _ := yaml.Marshal(&CloudConfig{})
-	yaml.Unmarshal(b, &cc)
-
-	// Now unmarshal the entire provided contents
-	var c map[string]interface{}
-	yaml.Unmarshal([]byte(contents), &c)
-
-	// Check that every key in the contents exists in the cloud config
-	for k, _ := range c {
-		if _, ok := cc[k]; !ok {
-			warn("Warning: unrecognized key %q in provided cloud config - ignoring section", k)
-		}
-	}
-
-	// Check for unrecognized coreos options, if any are set
-	if coreos, ok := c["coreos"]; ok {
-		if set, ok := coreos.(map[interface{}]interface{}); ok {
-			known := cc["coreos"].(map[interface{}]interface{})
-			for k, _ := range set {
-				if key, ok := k.(string); ok {
-					if _, ok := known[key]; !ok {
-						warn("Warning: unrecognized key %q in coreos section of provided cloud config - ignoring", key)
-					}
-				} else {
-					warn("Warning: unrecognized key %q in coreos section of provided cloud config - ignoring", k)
-				}
-			}
-		}
-	}
-
-	// Check for any badly-specified users, if any are set
-	if users, ok := c["users"]; ok {
-		var known map[string]interface{}
-		b, _ := yaml.Marshal(&User{})
-		yaml.Unmarshal(b, &known)
-
-		if set, ok := users.([]interface{}); ok {
-			for _, u := range set {
-				if user, ok := u.(map[interface{}]interface{}); ok {
-					for k, _ := range user {
-						if key, ok := k.(string); ok {
-							if _, ok := known[key]; !ok {
-								warn("Warning: unrecognized key %q in user section of cloud config - ignoring", key)
-							}
-						} else {
-							warn("Warning: unrecognized key %q in user section of cloud config - ignoring", k)
-						}
-					}
-				}
-			}
-		}
-	}
-
-	// Check for any badly-specified files, if any are set
-	if files, ok := c["write_files"]; ok {
-		var known map[string]interface{}
-		b, _ := yaml.Marshal(&File{})
-		yaml.Unmarshal(b, &known)
-
-		if set, ok := files.([]interface{}); ok {
-			for _, f := range set {
-				if file, ok := f.(map[interface{}]interface{}); ok {
-					for k, _ := range file {
-						if key, ok := k.(string); ok {
-							if _, ok := known[key]; !ok {
-								warn("Warning: unrecognized key %q in file section of cloud config - ignoring", key)
-							}
-						} else {
-							warn("Warning: unrecognized key %q in file section of cloud config - ignoring", k)
-						}
-					}
-				}
-			}
-		}
-	}
-}

config/config_test.go

@@ -17,16 +17,68 @@
 package config
 
 import (
-	"errors"
-	"fmt"
 	"reflect"
+	"regexp"
 	"strings"
 	"testing"
 )
 
+func TestNewCloudConfig(t *testing.T) {
+	tests := []struct {
+		contents string
+
+		config CloudConfig
+	}{
+		{},
+		{
+			contents: "#cloud-config\nwrite_files:\n  - path: underscore",
+			config:   CloudConfig{WriteFiles: []File{File{Path: "underscore"}}},
+		},
+		{
+			contents: "#cloud-config\nwrite-files:\n  - path: hyphen",
+			config:   CloudConfig{WriteFiles: []File{File{Path: "hyphen"}}},
+		},
+		{
+			contents: "#cloud-config\ncoreos:\n  update:\n    reboot-strategy: off",
+			config:   CloudConfig{CoreOS: CoreOS{Update: Update{RebootStrategy: "off"}}},
+		},
+		{
+			contents: "#cloud-config\ncoreos:\n  update:\n    reboot-strategy: false",
+			config:   CloudConfig{CoreOS: CoreOS{Update: Update{RebootStrategy: "false"}}},
+		},
+		{
+			contents: "#cloud-config\nwrite_files:\n  - permissions: 0744",
+			config:   CloudConfig{WriteFiles: []File{File{RawFilePermissions: "0744"}}},
+		},
+		{
+			contents: "#cloud-config\nwrite_files:\n  - permissions: 744",
+			config:   CloudConfig{WriteFiles: []File{File{RawFilePermissions: "744"}}},
+		},
+		{
+			contents: "#cloud-config\nwrite_files:\n  - permissions: '0744'",
+			config:   CloudConfig{WriteFiles: []File{File{RawFilePermissions: "0744"}}},
+		},
+		{
+			contents: "#cloud-config\nwrite_files:\n  - permissions: '744'",
+			config:   CloudConfig{WriteFiles: []File{File{RawFilePermissions: "744"}}},
+		},
+	}
+
+	for i, tt := range tests {
+		config, err := NewCloudConfig(tt.contents)
+		if err != nil {
+			t.Errorf("bad error (test case #%d): want %v, got %s", i, nil, err)
+		}
+		if !reflect.DeepEqual(&tt.config, config) {
+			t.Errorf("bad config (test case #%d): want %#v, got %#v", i, tt.config, config)
+		}
+	}
+}
+
 func TestIsZero(t *testing.T) {
-	for _, tt := range []struct {
+	tests := []struct {
 		c interface{}
+
 		empty bool
 	}{
 		{struct{}{}, true},
@@ -36,74 +88,78 @@ func TestIsZero(t *testing.T) {
 		{struct{ A string }{A: "hello"}, false},
 		{struct{ A int }{}, true},
 		{struct{ A int }{A: 1}, false},
-	} {
+	}
+
+	for _, tt := range tests {
 		if empty := IsZero(tt.c); tt.empty != empty {
 			t.Errorf("bad result (%q): want %t, got %t", tt.c, tt.empty, empty)
 		}
 	}
 }
 
-func TestAssertValid(t *testing.T) {
-	for _, tt := range []struct {
+func TestAssertStructValid(t *testing.T) {
+	tests := []struct {
 		c interface{}
+
 		err error
 	}{
 		{struct{}{}, nil},
 		{struct {
-			A, b string `valid:"1,2"`
+			A, b string `valid:"^1|2$"`
 		}{}, nil},
 		{struct {
-			A, b string `valid:"1,2"`
+			A, b string `valid:"^1|2$"`
 		}{A: "1", b: "2"}, nil},
 		{struct {
-			A, b string `valid:"1,2"`
+			A, b string `valid:"^1|2$"`
 		}{A: "1", b: "hello"}, nil},
 		{struct {
-			A, b string `valid:"1,2"`
-		}{A: "hello", b: "2"}, errors.New("invalid value \"hello\" for option \"A\" (valid options: \"1,2\")")},
+			A, b string `valid:"^1|2$"`
+		}{A: "hello", b: "2"}, &ErrorValid{Value: "hello", Field: "A", Valid: "^1|2$"}},
 		{struct {
-			A, b int `valid:"1,2"`
+			A, b int `valid:"^1|2$"`
 		}{}, nil},
 		{struct {
-			A, b int `valid:"1,2"`
+			A, b int `valid:"^1|2$"`
 		}{A: 1, b: 2}, nil},
 		{struct {
-			A, b int `valid:"1,2"`
+			A, b int `valid:"^1|2$"`
 		}{A: 1, b: 9}, nil},
 		{struct {
-			A, b int `valid:"1,2"`
-		}{A: 9, b: 2}, errors.New("invalid value \"9\" for option \"A\" (valid options: \"1,2\")")},
-	} {
-		if err := AssertValid(tt.c); !reflect.DeepEqual(tt.err, err) {
+			A, b int `valid:"^1|2$"`
+		}{A: 9, b: 2}, &ErrorValid{Value: "9", Field: "A", Valid: "^1|2$"}},
+	}
+
+	for _, tt := range tests {
+		if err := AssertStructValid(tt.c); !reflect.DeepEqual(tt.err, err) {
 			t.Errorf("bad result (%q): want %q, got %q", tt.c, tt.err, err)
 		}
 	}
 }
 
-func TestCloudConfigInvalidKeys(t *testing.T) {
-	defer func() {
-		if r := recover(); r != nil {
-			t.Fatalf("panic while instantiating CloudConfig with nil keys: %v", r)
+func TestConfigCompile(t *testing.T) {
+	tests := []interface{}{
+		Etcd{},
+		File{},
+		Flannel{},
+		Fleet{},
+		Locksmith{},
+		OEM{},
+		Unit{},
+		Update{},
 	}
-	}()
 
-	for _, tt := range []struct {
-		contents string
-	}{
-		{"coreos:"},
-		{"ssh_authorized_keys:"},
-		{"ssh_authorized_keys:\n  -"},
-		{"ssh_authorized_keys:\n  - 0:"},
-		{"write_files:"},
-		{"write_files:\n  -"},
-		{"write_files:\n  - 0:"},
-		{"users:"},
-		{"users:\n  -"},
-		{"users:\n  - 0:"},
-	} {
-		_, err := NewCloudConfig(tt.contents)
-		if err != nil {
-			t.Fatalf("error instantiating CloudConfig with invalid keys: %v", err)
+	for _, tt := range tests {
+		ttt := reflect.TypeOf(tt)
+		for i := 0; i < ttt.NumField(); i++ {
+			ft := ttt.Field(i)
+			if !isFieldExported(ft) {
+				continue
+			}
+
+			if _, err := regexp.Compile(ft.Tag.Get("valid")); err != nil {
+				t.Errorf("bad regexp(%s.%s): want %v, got %s", ttt.Name(), ft.Name, nil, err)
+			}
 		}
 	}
 }
@@ -138,7 +194,7 @@ hostname:
 	if cfg.Hostname != "foo" {
 		t.Fatalf("hostname not correctly set when invalid keys are present")
 	}
-	if cfg.Coreos.Etcd.Discovery != "https://discovery.etcd.io/827c73219eeb2fa5530027c37bf18877" {
+	if cfg.CoreOS.Etcd.Discovery != "https://discovery.etcd.io/827c73219eeb2fa5530027c37bf18877" {
 		t.Fatalf("etcd section not correctly set when invalid keys are present")
 	}
 	if len(cfg.WriteFiles) < 1 || cfg.WriteFiles[0].Content != "fun" || cfg.WriteFiles[0].Path != "/var/party" {
@@ -147,29 +203,6 @@ hostname:
 	if len(cfg.Users) < 1 || cfg.Users[0].Name != "fry" || cfg.Users[0].PasswordHash != "somehash" {
 		t.Fatalf("users section not correctly set when invalid keys are present")
 	}
-
-	var warnings string
-	catchWarn := func(f string, v ...interface{}) {
-		warnings += fmt.Sprintf(f, v...)
-	}
-
-	warnOnUnrecognizedKeys(contents, catchWarn)
-
-	if !strings.Contains(warnings, "coreos_unknown") {
-		t.Errorf("warnings did not catch unrecognized coreos option coreos_unknown")
-	}
-	if !strings.Contains(warnings, "bare_unknown") {
-		t.Errorf("warnings did not catch unrecognized key bare_unknown")
-	}
-	if !strings.Contains(warnings, "section_unknown") {
-		t.Errorf("warnings did not catch unrecognized key section_unknown")
-	}
-	if !strings.Contains(warnings, "user_unknown") {
-		t.Errorf("warnings did not catch unrecognized user key user_unknown")
-	}
-	if !strings.Contains(warnings, "file_unknown") {
-		t.Errorf("warnings did not catch unrecognized file key file_unknown")
-	}
 }
 
 // Assert that the parsing of a cloud config file "generally works"
@@ -200,7 +233,7 @@ coreos:
   etcd:
     discovery: "https://discovery.etcd.io/827c73219eeb2fa5530027c37bf18877"
   update:
-    reboot-strategy: reboot
+    reboot_strategy: reboot
   units:
     - name: 50-eth0.network
       runtime: yes
@@ -217,9 +250,9 @@ coreos:
   oem:
     id: rackspace
     name: Rackspace Cloud Servers
-    version-id: 168.0.0
-    home-url: https://www.rackspace.com/cloud/servers/
-    bug-report-url: https://github.com/coreos/coreos-overlay
+    version_id: 168.0.0
+    home_url: https://www.rackspace.com/cloud/servers/
+    bug_report_url: https://github.com/coreos/coreos-overlay
 ssh_authorized_keys:
   - foobar
   - foobaz
@@ -267,10 +300,10 @@ hostname: trontastic
 		}
 	}
 
-	if len(cfg.Coreos.Units) != 1 {
+	if len(cfg.CoreOS.Units) != 1 {
 		t.Error("Failed to parse correct number of units")
 	} else {
-		u := cfg.Coreos.Units[0]
+		u := cfg.CoreOS.Units[0]
 		expect := `[Match]
 Name=eth47
 
@@ -286,19 +319,16 @@ Address=10.209.171.177/19
 		if u.Name != "50-eth0.network" {
 			t.Errorf("Unit has incorrect name %s", u.Name)
 		}
-		if u.Type() != "network" {
-			t.Errorf("Unit has incorrect type '%s'", u.Type())
-		}
 	}
 
-	if cfg.Coreos.OEM.ID != "rackspace" {
-		t.Errorf("Failed parsing coreos.oem. Expected ID 'rackspace', got %q.", cfg.Coreos.OEM.ID)
+	if cfg.CoreOS.OEM.ID != "rackspace" {
+		t.Errorf("Failed parsing coreos.oem. Expected ID 'rackspace', got %q.", cfg.CoreOS.OEM.ID)
 	}
 
 	if cfg.Hostname != "trontastic" {
 		t.Errorf("Failed to parse hostname")
 	}
-	if cfg.Coreos.Update.RebootStrategy != "reboot" {
+	if cfg.CoreOS.Update.RebootStrategy != "reboot" {
 		t.Errorf("Failed to parse locksmith strategy")
 	}
 }
@@ -329,43 +359,23 @@ func TestCloudConfigSerializationHeader(t *testing.T) {
 	}
 }
 
-// TestDropInIgnored asserts that users are unable to set DropIn=True on units
-func TestDropInIgnored(t *testing.T) {
-	contents := `
-coreos:
-  units:
-    - name: test
-      dropin: true
-`
-	cfg, err := NewCloudConfig(contents)
-	if err != nil || len(cfg.Coreos.Units) != 1 {
-		t.Fatalf("Encountered unexpected error: %v", err)
-	}
-	if len(cfg.Coreos.Units) != 1 || cfg.Coreos.Units[0].Name != "test" {
-		t.Fatalf("Expected 1 unit, but got %d: %v", len(cfg.Coreos.Units), cfg.Coreos.Units)
-	}
-	if cfg.Coreos.Units[0].DropIn {
-		t.Errorf("dropin option on unit in cloud-config was not ignored!")
-	}
-}
-
 func TestCloudConfigUsers(t *testing.T) {
 	contents := `
 users:
   - name: elroy
     passwd: somehash
-    ssh-authorized-keys:
+    ssh_authorized_keys:
       - somekey
     gecos: arbitrary comment
     homedir: /home/place
-    no-create-home: yes
-    primary-group: things
+    no_create_home: yes
+    primary_group: things
     groups:
       - ping
       - pong
-    no-user-group: true
+    no_user_group: true
     system: y
-    no-log-init: True
+    no_log_init: True
 `
 	cfg, err := NewCloudConfig(contents)
 	if err != nil {
@@ -404,11 +414,11 @@ users:
 	}
 
 	if !user.NoCreateHome {
-		t.Errorf("Failed to parse no-create-home field")
+		t.Errorf("Failed to parse no_create_home field")
 	}
 
 	if user.PrimaryGroup != "things" {
-		t.Errorf("Failed to parse primary-group field, got %q", user.PrimaryGroup)
+		t.Errorf("Failed to parse primary_group field, got %q", user.PrimaryGroup)
 	}
 
 	if len(user.Groups) != 2 {
@@ -423,7 +433,7 @@ users:
 	}
 
 	if !user.NoUserGroup {
-		t.Errorf("Failed to parse no-user-group field")
+		t.Errorf("Failed to parse no_user_group field")
 	}
 
 	if !user.System {
@@ -431,7 +441,7 @@ users:
 	}
 
 	if !user.NoLogInit {
-		t.Errorf("Failed to parse no-log-init field")
+		t.Errorf("Failed to parse no_log_init field")
 	}
 }
 
@@ -440,7 +450,7 @@ func TestCloudConfigUsersGithubUser(t *testing.T) {
 	contents := `
 users:
   - name: elroy
-    coreos-ssh-import-github: bcwaldon
+    coreos_ssh_import_github: bcwaldon
 `
 	cfg, err := NewCloudConfig(contents)
 	if err != nil {
@@ -466,7 +476,7 @@ func TestCloudConfigUsersSSHImportURL(t *testing.T) {
 	contents := `
 users:
   - name: elroy
-    coreos-ssh-import-url: https://token:x-auth-token@github.enterprise.com/api/v3/polvi/keys
+    coreos_ssh_import_url: https://token:x-auth-token@github.enterprise.com/api/v3/polvi/keys
 `
 	cfg, err := NewCloudConfig(contents)
 	if err != nil {

config/decode.go

@@ -0,0 +1,56 @@
+package config
+
+import (
+	"bytes"
+	"compress/gzip"
+	"encoding/base64"
+	"fmt"
+)
+
+func DecodeBase64Content(content string) ([]byte, error) {
+	output, err := base64.StdEncoding.DecodeString(content)
+
+	if err != nil {
+		return nil, fmt.Errorf("Unable to decode base64: %q", err)
+	}
+
+	return output, nil
+}
+
+func DecodeGzipContent(content string) ([]byte, error) {
+	gzr, err := gzip.NewReader(bytes.NewReader([]byte(content)))
+
+	if err != nil {
+		return nil, fmt.Errorf("Unable to decode gzip: %q", err)
+	}
+	defer gzr.Close()
+
+	buf := new(bytes.Buffer)
+	buf.ReadFrom(gzr)
+
+	return buf.Bytes(), nil
+}
+
+func DecodeContent(content string, encoding string) ([]byte, error) {
+	switch encoding {
+	case "":
+		return []byte(content), nil
+
+	case "b64", "base64":
+		return DecodeBase64Content(content)
+
+	case "gz", "gzip":
+		return DecodeGzipContent(content)
+
+	case "gz+base64", "gzip+base64", "gz+b64", "gzip+b64":
+		gz, err := DecodeBase64Content(content)
+
+		if err != nil {
+			return nil, err
+		}
+
+		return DecodeGzipContent(string(gz))
+	}
+
+	return nil, fmt.Errorf("Unsupported encoding %q", encoding)
+}

config/etcd.go

@@ -18,31 +18,36 @@ package config
 
 type Etcd struct {
 	Addr                  string  `yaml:"addr"                    env:"ETCD_ADDR"`
-	BindAddr            string `yaml:"bind-addr"             env:"ETCD_BIND_ADDR"`
-	CAFile              string `yaml:"ca-file"               env:"ETCD_CA_FILE"`
-	CertFile            string `yaml:"cert-file"             env:"ETCD_CERT_FILE"`
-	ClusterActiveSize   string `yaml:"cluster-active-size"   env:"ETCD_CLUSTER_ACTIVE_SIZE"`
-	ClusterRemoveDelay  string `yaml:"cluster-remove-delay"  env:"ETCD_CLUSTER_REMOVE_DELAY"`
-	ClusterSyncInterval string `yaml:"cluster-sync-interval" env:"ETCD_CLUSTER_SYNC_INTERVAL"`
-	Cors                string `yaml:"cors"                  env:"ETCD_CORS"`
-	CPUProfileFile      string `yaml:"cpu-profile-file"      env:"ETCD_CPU_PROFILE_FILE"`
-	DataDir             string `yaml:"data-dir"              env:"ETCD_DATA_DIR"`
+	BindAddr              string  `yaml:"bind_addr"               env:"ETCD_BIND_ADDR"`
+	CAFile                string  `yaml:"ca_file"                 env:"ETCD_CA_FILE"`
+	CertFile              string  `yaml:"cert_file"               env:"ETCD_CERT_FILE"`
+	ClusterActiveSize     int     `yaml:"cluster_active_size"     env:"ETCD_CLUSTER_ACTIVE_SIZE"`
+	ClusterRemoveDelay    float64 `yaml:"cluster_remove_delay"    env:"ETCD_CLUSTER_REMOVE_DELAY"`
+	ClusterSyncInterval   float64 `yaml:"cluster_sync_interval"   env:"ETCD_CLUSTER_SYNC_INTERVAL"`
+	CorsOrigins           string  `yaml:"cors"                    env:"ETCD_CORS"`
+	DataDir               string  `yaml:"data_dir"                env:"ETCD_DATA_DIR"`
 	Discovery             string  `yaml:"discovery"               env:"ETCD_DISCOVERY"`
-	HTTPReadTimeout     string `yaml:"http-read-timeout"     env:"ETCD_HTTP_READ_TIMEOUT"`
-	HTTPWriteTimeout    string `yaml:"http-write-timeout"    env:"ETCD_HTTP_WRITE_TIMEOUT"`
-	KeyFile             string `yaml:"key-file"              env:"ETCD_KEY_FILE"`
-	MaxClusterSize      string `yaml:"max-cluster-size"      env:"ETCD_MAX_CLUSTER_SIZE"`
-	MaxResultBuffer     string `yaml:"max-result-buffer"     env:"ETCD_MAX_RESULT_BUFFER"`
-	MaxRetryAttempts    string `yaml:"max-retry-attempts"    env:"ETCD_MAX_RETRY_ATTEMPTS"`
+	GraphiteHost          string  `yaml:"graphite_host"           env:"ETCD_GRAPHITE_HOST"`
+	HTTPReadTimeout       float64 `yaml:"http_read_timeout"       env:"ETCD_HTTP_READ_TIMEOUT"`
+	HTTPWriteTimeout      float64 `yaml:"http_write_timeout"      env:"ETCD_HTTP_WRITE_TIMEOUT"`
+	KeyFile               string  `yaml:"key_file"                env:"ETCD_KEY_FILE"`
+	MaxResultBuffer       int     `yaml:"max_result_buffer"       env:"ETCD_MAX_RESULT_BUFFER"`
+	MaxRetryAttempts      int     `yaml:"max_retry_attempts"      env:"ETCD_MAX_RETRY_ATTEMPTS"`
 	Name                  string  `yaml:"name"                    env:"ETCD_NAME"`
-	PeerAddr            string `yaml:"peer-addr"             env:"ETCD_PEER_ADDR"`
-	PeerBindAddr        string `yaml:"peer-bind-addr"        env:"ETCD_PEER_BIND_ADDR"`
-	PeerCAFile          string `yaml:"peer-ca-file"          env:"ETCD_PEER_CA_FILE"`
-	PeerCertFile        string `yaml:"peer-cert-file"        env:"ETCD_PEER_CERT_FILE"`
-	PeerKeyFile         string `yaml:"peer-key-file"         env:"ETCD_PEER_KEY_FILE"`
+	PeerAddr              string  `yaml:"peer_addr"               env:"ETCD_PEER_ADDR"`
+	PeerBindAddr          string  `yaml:"peer_bind_addr"          env:"ETCD_PEER_BIND_ADDR"`
+	PeerCAFile            string  `yaml:"peer_ca_file"            env:"ETCD_PEER_CA_FILE"`
+	PeerCertFile          string  `yaml:"peer_cert_file"          env:"ETCD_PEER_CERT_FILE"`
+	PeerElectionTimeout   int     `yaml:"peer_election_timeout"   env:"ETCD_PEER_ELECTION_TIMEOUT"`
+	PeerHeartbeatInterval int     `yaml:"peer_heartbeat_interval" env:"ETCD_PEER_HEARTBEAT_INTERVAL"`
+	PeerKeyFile           string  `yaml:"peer_key_file"           env:"ETCD_PEER_KEY_FILE"`
 	Peers                 string  `yaml:"peers"                   env:"ETCD_PEERS"`
-	PeersFile           string `yaml:"peers-file"            env:"ETCD_PEERS_FILE"`
-	Snapshot            string `yaml:"snapshot"              env:"ETCD_SNAPSHOT"`
-	Verbose             string `yaml:"verbose"               env:"ETCD_VERBOSE"`
-	VeryVerbose         string `yaml:"very-verbose"          env:"ETCD_VERY_VERBOSE"`
+	PeersFile             string  `yaml:"peers_file"              env:"ETCD_PEERS_FILE"`
+	RetryInterval         float64 `yaml:"retry_interval"          env:"ETCD_RETRY_INTERVAL"`
+	Snapshot              bool    `yaml:"snapshot"                env:"ETCD_SNAPSHOT"`
+	SnapshotCount         int     `yaml:"snapshot_count"          env:"ETCD_SNAPSHOTCOUNT"`
+	StrTrace              string  `yaml:"trace"                   env:"ETCD_TRACE"`
+	Verbose               bool    `yaml:"verbose"                 env:"ETCD_VERBOSE"`
+	VeryVerbose           bool    `yaml:"very_verbose"            env:"ETCD_VERY_VERBOSE"`
+	VeryVeryVerbose       bool    `yaml:"very_very_verbose"       env:"ETCD_VERY_VERY_VERBOSE"`
 }

config/file.go

@@ -17,9 +17,9 @@
 package config
 
 type File struct {
-	Encoding           string `yaml:"-"`
+	Encoding           string `yaml:"encoding" valid:"^(base64|b64|gz|gzip|gz\\+base64|gzip\\+base64|gz\\+b64|gzip\\+b64)$"`
 	Content            string `yaml:"content"`
 	Owner              string `yaml:"owner"`
 	Path               string `yaml:"path"`
-	RawFilePermissions string `yaml:"permissions"`
+	RawFilePermissions string `yaml:"permissions" valid:"^0?[0-7]{3,4}$"`
 }

config/file_test.go

@@ -0,0 +1,71 @@
+/*
+   Copyright 2014 CoreOS, Inc.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package config
+
+import (
+	"testing"
+)
+
+func TestEncodingValid(t *testing.T) {
+	tests := []struct {
+		value string
+
+		isValid bool
+	}{
+		{value: "base64", isValid: true},
+		{value: "b64", isValid: true},
+		{value: "gz", isValid: true},
+		{value: "gzip", isValid: true},
+		{value: "gz+base64", isValid: true},
+		{value: "gzip+base64", isValid: true},
+		{value: "gz+b64", isValid: true},
+		{value: "gzip+b64", isValid: true},
+		{value: "gzzzzbase64", isValid: false},
+		{value: "gzipppbase64", isValid: false},
+		{value: "unknown", isValid: false},
+	}
+
+	for _, tt := range tests {
+		isValid := (nil == AssertStructValid(File{Encoding: tt.value}))
+		if tt.isValid != isValid {
+			t.Errorf("bad assert (%s): want %t, got %t", tt.value, tt.isValid, isValid)
+		}
+	}
+}
+
+func TestRawFilePermissionsValid(t *testing.T) {
+	tests := []struct {
+		value string
+
+		isValid bool
+	}{
+		{value: "744", isValid: true},
+		{value: "0744", isValid: true},
+		{value: "1744", isValid: true},
+		{value: "01744", isValid: true},
+		{value: "11744", isValid: false},
+		{value: "rwxr--r--", isValid: false},
+		{value: "800", isValid: false},
+	}
+
+	for _, tt := range tests {
+		isValid := (nil == AssertStructValid(File{RawFilePermissions: tt.value}))
+		if tt.isValid != isValid {
+			t.Errorf("bad assert (%s): want %t, got %t", tt.value, tt.isValid, isValid)
+		}
+	}
+}

config/flannel.go

@@ -0,0 +1,12 @@
+package config
+
+type Flannel struct {
+	EtcdEndpoints string `yaml:"etcd_endpoints" env:"FLANNELD_ETCD_ENDPOINTS"`
+	EtcdCAFile    string `yaml:"etcd_cafile"    env:"FLANNELD_ETCD_CAFILE"`
+	EtcdCertFile  string `yaml:"etcd_certfile"  env:"FLANNELD_ETCD_CERTFILE"`
+	EtcdKeyFile   string `yaml:"etcd_keyfile"   env:"FLANNELD_ETCD_KEYFILE"`
+	EtcdPrefix    string `yaml:"etcd_prefix"    env:"FLANNELD_ETCD_PREFIX"`
+	IPMasq        string `yaml:"ip_masq"        env:"FLANNELD_IP_MASQ"`
+	SubnetFile    string `yaml:"subnet_file"    env:"FLANNELD_SUBNET_FILE"`
+	Iface         string `yaml:"interface"      env:"FLANNELD_IFACE"`
+}

config/fleet.go

@@ -17,14 +17,15 @@
 package config
 
 type Fleet struct {
-	AgentTTL                string `yaml:"agent-ttl"                 env:"FLEET_AGENT_TTL"`
-	EngineReconcileInterval string `yaml:"engine-reconcile-interval" env:"FLEET_ENGINE_RECONCILE_INTERVAL"`
-	EtcdCAFile              string `yaml:"etcd-cafile"               env:"FLEET_ETCD_CAFILE"`
-	EtcdCertFile            string `yaml:"etcd-certfile"             env:"FLEET_ETCD_CERTFILE"`
-	EtcdKeyFile             string `yaml:"etcd-keyfile"              env:"FLEET_ETCD_KEYFILE"`
-	EtcdRequestTimeout      string `yaml:"etcd-request-timeout"      env:"FLEET_ETCD_REQUEST_TIMEOUT"`
-	EtcdServers             string `yaml:"etcd-servers"              env:"FLEET_ETCD_SERVERS"`
+	AgentTTL                string  `yaml:"agent_ttl"                 env:"FLEET_AGENT_TTL"`
+	EngineReconcileInterval float64 `yaml:"engine_reconcile_interval" env:"FLEET_ENGINE_RECONCILE_INTERVAL"`
+	EtcdCAFile              string  `yaml:"etcd_cafile"               env:"FLEET_ETCD_CAFILE"`
+	EtcdCertFile            string  `yaml:"etcd_certfile"             env:"FLEET_ETCD_CERTFILE"`
+	EtcdKeyFile             string  `yaml:"etcd_keyfile"              env:"FLEET_ETCD_KEYFILE"`
+	EtcdKeyPrefix           string  `yaml:"etcd_key_prefix"           env:"FLEET_ETCD_KEY_PREFIX"`
+	EtcdRequestTimeout      float64 `yaml:"etcd_request_timeout"      env:"FLEET_ETCD_REQUEST_TIMEOUT"`
+	EtcdServers             string  `yaml:"etcd_servers"              env:"FLEET_ETCD_SERVERS"`
 	Metadata                string  `yaml:"metadata"                  env:"FLEET_METADATA"`
-	PublicIP                string `yaml:"public-ip"                 env:"FLEET_PUBLIC_IP"`
-	Verbosity               string `yaml:"verbosity"                 env:"FLEET_VERBOSITY"`
+	PublicIP                string  `yaml:"public_ip"                 env:"FLEET_PUBLIC_IP"`
+	Verbosity               int     `yaml:"verbosity"                 env:"FLEET_VERBOSITY"`
 }

config/locksmith.go

@@ -0,0 +1,8 @@
+package config
+
+type Locksmith struct {
+	Endpoint     string `yaml:"endpoint"      env:"LOCKSMITHD_ENDPOINT"`
+	EtcdCAFile   string `yaml:"etcd_cafile"   env:"LOCKSMITHD_ETCD_CAFILE"`
+	EtcdCertFile string `yaml:"etcd_certfile" env:"LOCKSMITHD_ETCD_CERTFILE"`
+	EtcdKeyFile  string `yaml:"etcd_keyfile"  env:"LOCKSMITHD_ETCD_KEYFILE"`
+}

config/oem.go

@@ -19,7 +19,7 @@ package config
 type OEM struct {
 	ID           string `yaml:"id"`
 	Name         string `yaml:"name"`
-	VersionID    string `yaml:"version-id"`
-	HomeURL      string `yaml:"home-url"`
-	BugReportURL string `yaml:"bug-report-url"`
+	VersionID    string `yaml:"version_id"`
+	HomeURL      string `yaml:"home_url"`
+	BugReportURL string `yaml:"bug_report_url"`
 }

config/script.go

@@ -0,0 +1,32 @@
+/*
+   Copyright 2014 CoreOS, Inc.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package config
+
+import (
+	"strings"
+)
+
+type Script []byte
+
+func IsScript(userdata string) bool {
+	header := strings.SplitN(userdata, "\n", 2)[0]
+	return strings.HasPrefix(header, "#!")
+}
+
+func NewScript(userdata string) (Script, error) {
+	return Script(userdata), nil
+}

config/unit.go

@@ -16,35 +16,17 @@
 
 package config
 
-import (
-	"path/filepath"
-	"strings"
-)
-
 type Unit struct {
 	Name    string       `yaml:"name"`
 	Mask    bool         `yaml:"mask"`
 	Enable  bool         `yaml:"enable"`
 	Runtime bool         `yaml:"runtime"`
 	Content string       `yaml:"content"`
-	Command string `yaml:"command"`
-
-	// For drop-in units, a cloudinit.conf is generated.
-	// This is currently unbound in YAML (and hence unsettable in cloud-config files)
-	// until the correct behaviour for multiple drop-in units is determined.
-	DropIn bool `yaml:"-"`
+	Command string       `yaml:"command" valid:"^(start|stop|restart|reload|try-restart|reload-or-restart|reload-or-try-restart)$"`
+	DropIns []UnitDropIn `yaml:"drop_ins"`
 }
 
-func (u *Unit) Type() string {
-	ext := filepath.Ext(u.Name)
-	return strings.TrimLeft(ext, ".")
-}
-
-func (u *Unit) Group() string {
-	switch u.Type() {
-	case "network", "netdev", "link":
-		return "network"
-	default:
-		return "system"
-	}
+type UnitDropIn struct {
+	Name    string `yaml:"name"`
+	Content string `yaml:"content"`
 }

config/unit_test.go

@@ -0,0 +1,46 @@
+/*
+   Copyright 2014 CoreOS, Inc.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package config
+
+import (
+	"testing"
+)
+
+func TestCommandValid(t *testing.T) {
+	tests := []struct {
+		value string
+
+		isValid bool
+	}{
+		{value: "start", isValid: true},
+		{value: "stop", isValid: true},
+		{value: "restart", isValid: true},
+		{value: "reload", isValid: true},
+		{value: "try-restart", isValid: true},
+		{value: "reload-or-restart", isValid: true},
+		{value: "reload-or-try-restart", isValid: true},
+		{value: "tryrestart", isValid: false},
+		{value: "unknown", isValid: false},
+	}
+
+	for _, tt := range tests {
+		isValid := (nil == AssertStructValid(Unit{Command: tt.value}))
+		if tt.isValid != isValid {
+			t.Errorf("bad assert (%s): want %t, got %t", tt.value, tt.isValid, isValid)
+		}
+	}
+}

config/update.go

@@ -17,7 +17,7 @@
 package config
 
 type Update struct {
-	RebootStrategy string `yaml:"reboot-strategy" env:"REBOOT_STRATEGY" valid:"best-effort,etcd-lock,reboot,off"`
+	RebootStrategy string `yaml:"reboot_strategy" env:"REBOOT_STRATEGY" valid:"^(best-effort|etcd-lock|reboot|off)$"`
 	Group          string `yaml:"group"           env:"GROUP"`
 	Server         string `yaml:"server"          env:"SERVER"`
 }

config/update_test.go

@@ -0,0 +1,43 @@
+/*
+   Copyright 2014 CoreOS, Inc.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package config
+
+import (
+	"testing"
+)
+
+func TestRebootStrategyValid(t *testing.T) {
+	tests := []struct {
+		value string
+
+		isValid bool
+	}{
+		{value: "best-effort", isValid: true},
+		{value: "etcd-lock", isValid: true},
+		{value: "reboot", isValid: true},
+		{value: "off", isValid: true},
+		{value: "besteffort", isValid: false},
+		{value: "unknown", isValid: false},
+	}
+
+	for _, tt := range tests {
+		isValid := (nil == AssertStructValid(Update{RebootStrategy: tt.value}))
+		if tt.isValid != isValid {
+			t.Errorf("bad assert (%s): want %t, got %t", tt.value, tt.isValid, isValid)
+		}
+	}
+}

config/user.go

@@ -19,15 +19,16 @@ package config
 type User struct {
 	Name                 string   `yaml:"name"`
 	PasswordHash         string   `yaml:"passwd"`
-	SSHAuthorizedKeys   []string `yaml:"ssh-authorized-keys"`
-	SSHImportGithubUser string   `yaml:"coreos-ssh-import-github"`
-	SSHImportURL        string   `yaml:"coreos-ssh-import-url"`
+	SSHAuthorizedKeys    []string `yaml:"ssh_authorized_keys"`
+	SSHImportGithubUser  string   `yaml:"coreos_ssh_import_github"`
+	SSHImportGithubUsers []string `yaml:"coreos_ssh_import_github_users"`
+	SSHImportURL         string   `yaml:"coreos_ssh_import_url"`
 	GECOS                string   `yaml:"gecos"`
 	Homedir              string   `yaml:"homedir"`
-	NoCreateHome        bool     `yaml:"no-create-home"`
-	PrimaryGroup        string   `yaml:"primary-group"`
+	NoCreateHome         bool     `yaml:"no_create_home"`
+	PrimaryGroup         string   `yaml:"primary_group"`
 	Groups               []string `yaml:"groups"`
-	NoUserGroup         bool     `yaml:"no-user-group"`
+	NoUserGroup          bool     `yaml:"no_user_group"`
 	System               bool     `yaml:"system"`
-	NoLogInit           bool     `yaml:"no-log-init"`
+	NoLogInit            bool     `yaml:"no_log_init"`
 }

config/validate/context.go

@@ -0,0 +1,54 @@
+/*
+   Copyright 2014 CoreOS, Inc.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package validate
+
+import (
+	"strings"
+)
+
+// context represents the current position within a newline-delimited string.
+// Each line is loaded, one by one, into currentLine (newline omitted) and
+// lineNumber keeps track of its position within the original string.
+type context struct {
+	currentLine    string
+	remainingLines string
+	lineNumber     int
+}
+
+// Increment moves the context to the next line (if available).
+func (c *context) Increment() {
+	if c.currentLine == "" && c.remainingLines == "" {
+		return
+	}
+
+	lines := strings.SplitN(c.remainingLines, "\n", 2)
+	c.currentLine = lines[0]
+	if len(lines) == 2 {
+		c.remainingLines = lines[1]
+	} else {
+		c.remainingLines = ""
+	}
+	c.lineNumber++
+}
+
+// NewContext creates a context from the provided data. It strips out all
+// carriage returns and moves to the first line (if available).
+func NewContext(content []byte) context {
+	c := context{remainingLines: strings.Replace(string(content), "\r", "", -1)}
+	c.Increment()
+	return c
+}

config/validate/context_test.go

@@ -0,0 +1,133 @@
+/*
+   Copyright 2014 CoreOS, Inc.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package validate
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestNewContext(t *testing.T) {
+	tests := []struct {
+		in string
+
+		out context
+	}{
+		{
+			out: context{
+				currentLine:    "",
+				remainingLines: "",
+				lineNumber:     0,
+			},
+		},
+		{
+			in: "this\r\nis\r\na\r\ntest",
+			out: context{
+				currentLine:    "this",
+				remainingLines: "is\na\ntest",
+				lineNumber:     1,
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		if out := NewContext([]byte(tt.in)); !reflect.DeepEqual(tt.out, out) {
+			t.Errorf("bad context (%q): want %#v, got %#v", tt.in, tt.out, out)
+		}
+	}
+}
+
+func TestIncrement(t *testing.T) {
+	tests := []struct {
+		init context
+		op   func(c *context)
+
+		res context
+	}{
+		{
+			init: context{
+				currentLine:    "",
+				remainingLines: "",
+				lineNumber:     0,
+			},
+			res: context{
+				currentLine:    "",
+				remainingLines: "",
+				lineNumber:     0,
+			},
+			op: func(c *context) {
+				c.Increment()
+			},
+		},
+		{
+			init: context{
+				currentLine:    "test",
+				remainingLines: "",
+				lineNumber:     1,
+			},
+			res: context{
+				currentLine:    "",
+				remainingLines: "",
+				lineNumber:     2,
+			},
+			op: func(c *context) {
+				c.Increment()
+				c.Increment()
+				c.Increment()
+			},
+		},
+		{
+			init: context{
+				currentLine:    "this",
+				remainingLines: "is\na\ntest",
+				lineNumber:     1,
+			},
+			res: context{
+				currentLine:    "is",
+				remainingLines: "a\ntest",
+				lineNumber:     2,
+			},
+			op: func(c *context) {
+				c.Increment()
+			},
+		},
+		{
+			init: context{
+				currentLine:    "this",
+				remainingLines: "is\na\ntest",
+				lineNumber:     1,
+			},
+			res: context{
+				currentLine:    "test",
+				remainingLines: "",
+				lineNumber:     4,
+			},
+			op: func(c *context) {
+				c.Increment()
+				c.Increment()
+				c.Increment()
+			},
+		},
+	}
+
+	for i, tt := range tests {
+		res := tt.init
+		if tt.op(&res); !reflect.DeepEqual(tt.res, res) {
+			t.Errorf("bad context (%d, %#v): want %#v, got %#v", i, tt.init, tt.res, res)
+		}
+	}
+}

config/validate/node.go

@@ -0,0 +1,159 @@
+/*
+   Copyright 2014 CoreOS, Inc.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package validate
+
+import (
+	"fmt"
+	"reflect"
+	"regexp"
+)
+
+var (
+	yamlKey  = regexp.MustCompile(`^ *-? ?(?P<key>.*?):`)
+	yamlElem = regexp.MustCompile(`^ *-`)
+)
+
+type node struct {
+	name     string
+	line     int
+	children []node
+	field    reflect.StructField
+	reflect.Value
+}
+
+// Child attempts to find the child with the given name in the node's list of
+// children. If no such child is found, an invalid node is returned.
+func (n node) Child(name string) node {
+	for _, c := range n.children {
+		if c.name == name {
+			return c
+		}
+	}
+	return node{}
+}
+
+// HumanType returns the human-consumable string representation of the type of
+// the node.
+func (n node) HumanType() string {
+	switch k := n.Kind(); k {
+	case reflect.Slice:
+		c := n.Type().Elem()
+		return "[]" + node{Value: reflect.New(c).Elem()}.HumanType()
+	default:
+		return k.String()
+	}
+}
+
+// NewNode returns the node representation of the given value. The context
+// will be used in an attempt to determine line numbers for the given value.
+func NewNode(value interface{}, context context) node {
+	var n node
+	toNode(value, context, &n)
+	return n
+}
+
+// toNode converts the given value into a node and then recursively processes
+// each of the nodes components (e.g. fields, array elements, keys).
+func toNode(v interface{}, c context, n *node) {
+	vv := reflect.ValueOf(v)
+	if !vv.IsValid() {
+		return
+	}
+
+	n.Value = vv
+	switch vv.Kind() {
+	case reflect.Struct:
+		// Walk over each field in the structure, skipping unexported fields,
+		// and create a node for it.
+		for i := 0; i < vv.Type().NumField(); i++ {
+			ft := vv.Type().Field(i)
+			k := ft.Tag.Get("yaml")
+			if k == "-" || k == "" {
+				continue
+			}
+
+			cn := node{name: k, field: ft}
+			c, ok := findKey(cn.name, c)
+			if ok {
+				cn.line = c.lineNumber
+			}
+			toNode(vv.Field(i).Interface(), c, &cn)
+			n.children = append(n.children, cn)
+		}
+	case reflect.Map:
+		// Walk over each key in the map and create a node for it.
+		v := v.(map[interface{}]interface{})
+		for k, cv := range v {
+			cn := node{name: fmt.Sprintf("%s", k)}
+			c, ok := findKey(cn.name, c)
+			if ok {
+				cn.line = c.lineNumber
+			}
+			toNode(cv, c, &cn)
+			n.children = append(n.children, cn)
+		}
+	case reflect.Slice:
+		// Walk over each element in the slice and create a node for it.
+		// While iterating over the slice, preserve the context after it
+		// is modified. This allows the line numbers to reflect the current
+		// element instead of the first.
+		for i := 0; i < vv.Len(); i++ {
+			cn := node{
+				name:  fmt.Sprintf("%s[%d]", n.name, i),
+				field: n.field,
+			}
+			var ok bool
+			c, ok = findElem(c)
+			if ok {
+				cn.line = c.lineNumber
+			}
+			toNode(vv.Index(i).Interface(), c, &cn)
+			n.children = append(n.children, cn)
+			c.Increment()
+		}
+	case reflect.String, reflect.Int, reflect.Bool, reflect.Float64:
+	default:
+		panic(fmt.Sprintf("toNode(): unhandled kind %s", vv.Kind()))
+	}
+}
+
+// findKey attempts to find the requested key within the provided context.
+// A modified copy of the context is returned with every line up to the key
+// incremented past. A boolean, true if the key was found, is also returned.
+func findKey(key string, context context) (context, bool) {
+	return find(yamlKey, key, context)
+}
+
+// findElem attempts to find an array element within the provided context.
+// A modified copy of the context is returned with every line up to the array
+// element incremented past. A boolean, true if the key was found, is also
+// returned.
+func findElem(context context) (context, bool) {
+	return find(yamlElem, "", context)
+}
+
+func find(exp *regexp.Regexp, key string, context context) (context, bool) {
+	for len(context.currentLine) > 0 || len(context.remainingLines) > 0 {
+		matches := exp.FindStringSubmatch(context.currentLine)
+		if len(matches) > 0 && (key == "" || matches[1] == key) {
+			return context, true
+		}
+
+		context.Increment()
+	}
+	return context, false
+}

config/validate/node_test.go

@@ -0,0 +1,286 @@
+/*
+   Copyright 2014 CoreOS, Inc.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package validate
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestChild(t *testing.T) {
+	tests := []struct {
+		parent node
+		name   string
+
+		child node
+	}{
+		{},
+		{
+			name: "c1",
+		},
+		{
+			parent: node{
+				children: []node{
+					node{name: "c1"},
+					node{name: "c2"},
+					node{name: "c3"},
+				},
+			},
+		},
+		{
+			parent: node{
+				children: []node{
+					node{name: "c1"},
+					node{name: "c2"},
+					node{name: "c3"},
+				},
+			},
+			name:  "c2",
+			child: node{name: "c2"},
+		},
+	}
+
+	for _, tt := range tests {
+		if child := tt.parent.Child(tt.name); !reflect.DeepEqual(tt.child, child) {
+			t.Errorf("bad child (%q): want %#v, got %#v", tt.name, tt.child, child)
+		}
+	}
+}
+
+func TestHumanType(t *testing.T) {
+	tests := []struct {
+		node node
+
+		humanType string
+	}{
+		{
+			humanType: "invalid",
+		},
+		{
+			node:      node{Value: reflect.ValueOf("hello")},
+			humanType: "string",
+		},
+		{
+			node: node{
+				Value: reflect.ValueOf([]int{1, 2}),
+				children: []node{
+					node{Value: reflect.ValueOf(1)},
+					node{Value: reflect.ValueOf(2)},
+				}},
+			humanType: "[]int",
+		},
+	}
+
+	for _, tt := range tests {
+		if humanType := tt.node.HumanType(); tt.humanType != humanType {
+			t.Errorf("bad type (%q): want %q, got %q", tt.node, tt.humanType, humanType)
+		}
+	}
+}
+
+func TestToNode(t *testing.T) {
+	tests := []struct {
+		value   interface{}
+		context context
+
+		node node
+	}{
+		{},
+		{
+			value: struct{}{},
+			node:  node{Value: reflect.ValueOf(struct{}{})},
+		},
+		{
+			value: struct {
+				A int `yaml:"a"`
+			}{},
+			node: node{
+				children: []node{
+					node{
+						name: "a",
+						field: reflect.TypeOf(struct {
+							A int `yaml:"a"`
+						}{}).Field(0),
+					},
+				},
+			},
+		},
+		{
+			value: struct {
+				A []int `yaml:"a"`
+			}{},
+			node: node{
+				children: []node{
+					node{
+						name: "a",
+						field: reflect.TypeOf(struct {
+							A []int `yaml:"a"`
+						}{}).Field(0),
+					},
+				},
+			},
+		},
+		{
+			value: map[interface{}]interface{}{
+				"a": map[interface{}]interface{}{
+					"b": 2,
+				},
+			},
+			context: NewContext([]byte("a:\n  b: 2")),
+			node: node{
+				children: []node{
+					node{
+						line: 1,
+						name: "a",
+						children: []node{
+							node{name: "b", line: 2},
+						},
+					},
+				},
+			},
+		},
+		{
+			value: struct {
+				A struct {
+					Jon bool `yaml:"b"`
+				} `yaml:"a"`
+			}{},
+			node: node{
+				children: []node{
+					node{
+						name: "a",
+						children: []node{
+							node{
+								name: "b",
+								field: reflect.TypeOf(struct {
+									Jon bool `yaml:"b"`
+								}{}).Field(0),
+								Value: reflect.ValueOf(false),
+							},
+						},
+						field: reflect.TypeOf(struct {
+							A struct {
+								Jon bool `yaml:"b"`
+							} `yaml:"a"`
+						}{}).Field(0),
+						Value: reflect.ValueOf(struct {
+							Jon bool `yaml:"b"`
+						}{}),
+					},
+				},
+				Value: reflect.ValueOf(struct {
+					A struct {
+						Jon bool `yaml:"b"`
+					} `yaml:"a"`
+				}{}),
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		var node node
+		toNode(tt.value, tt.context, &node)
+		if !nodesEqual(tt.node, node) {
+			t.Errorf("bad node (%#v): want %#v, got %#v", tt.value, tt.node, node)
+		}
+	}
+}
+
+func TestFindKey(t *testing.T) {
+	tests := []struct {
+		key     string
+		context context
+
+		found bool
+	}{
+		{},
+		{
+			key:     "key1",
+			context: NewContext([]byte("key1: hi")),
+			found:   true,
+		},
+		{
+			key:     "key2",
+			context: NewContext([]byte("key1: hi")),
+			found:   false,
+		},
+		{
+			key:     "key3",
+			context: NewContext([]byte("key1:\n  key2:\n    key3: hi")),
+			found:   true,
+		},
+		{
+			key:     "key4",
+			context: NewContext([]byte("key1:\n  - key4: hi")),
+			found:   true,
+		},
+		{
+			key:     "key5",
+			context: NewContext([]byte("#key5")),
+			found:   false,
+		},
+	}
+
+	for _, tt := range tests {
+		if _, found := findKey(tt.key, tt.context); tt.found != found {
+			t.Errorf("bad find (%q): want %t, got %t", tt.key, tt.found, found)
+		}
+	}
+}
+
+func TestFindElem(t *testing.T) {
+	tests := []struct {
+		context context
+
+		found bool
+	}{
+		{},
+		{
+			context: NewContext([]byte("test: hi")),
+			found:   false,
+		},
+		{
+			context: NewContext([]byte("test:\n  - a\n  -b")),
+			found:   true,
+		},
+		{
+			context: NewContext([]byte("test:\n  -\n    a")),
+			found:   true,
+		},
+	}
+
+	for _, tt := range tests {
+		if _, found := findElem(tt.context); tt.found != found {
+			t.Errorf("bad find (%q): want %t, got %t", tt.context, tt.found, found)
+		}
+	}
+}
+
+func nodesEqual(a, b node) bool {
+	if a.name != b.name ||
+		a.line != b.line ||
+		!reflect.DeepEqual(a.field, b.field) ||
+		len(a.children) != len(b.children) {
+		return false
+	}
+	for i := 0; i < len(a.children); i++ {
+		if !nodesEqual(a.children[i], b.children[i]) {
+			return false
+		}
+	}
+	return true
+}

config/validate/report.go

@@ -0,0 +1,90 @@
+/*
+   Copyright 2014 CoreOS, Inc.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package validate
+
+import (
+	"encoding/json"
+	"fmt"
+)
+
+// Report represents the list of entries resulting from validation.
+type Report struct {
+	entries []Entry
+}
+
+// Error adds an error entry to the report.
+func (r *Report) Error(line int, message string) {
+	r.entries = append(r.entries, Entry{entryError, message, line})
+}
+
+// Warning adds a warning entry to the report.
+func (r *Report) Warning(line int, message string) {
+	r.entries = append(r.entries, Entry{entryWarning, message, line})
+}
+
+// Info adds an info entry to the report.
+func (r *Report) Info(line int, message string) {
+	r.entries = append(r.entries, Entry{entryInfo, message, line})
+}
+
+// Entries returns the list of entries in the report.
+func (r *Report) Entries() []Entry {
+	return r.entries
+}
+
+// Entry represents a single generic item in the report.
+type Entry struct {
+	kind    entryKind
+	message string
+	line    int
+}
+
+// String returns a human-readable representation of the entry.
+func (e Entry) String() string {
+	return fmt.Sprintf("line %d: %s: %s", e.line, e.kind, e.message)
+}
+
+// MarshalJSON satisfies the json.Marshaler interface, returning the entry
+// encoded as a JSON object.
+func (e Entry) MarshalJSON() ([]byte, error) {
+	return json.Marshal(map[string]interface{}{
+		"kind":    e.kind.String(),
+		"message": e.message,
+		"line":    e.line,
+	})
+}
+
+type entryKind int
+
+const (
+	entryError entryKind = iota
+	entryWarning
+	entryInfo
+)
+
+func (k entryKind) String() string {
+	switch k {
+	case entryError:
+		return "error"
+	case entryWarning:
+		return "warning"
+	case entryInfo:
+		return "info"
+	default:
+		panic(fmt.Sprintf("invalid kind %d", k))
+	}
+}

config/validate/report_test.go

@@ -0,0 +1,98 @@
+/*
+   Copyright 2014 CoreOS, Inc.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package validate
+
+import (
+	"bytes"
+	"reflect"
+	"testing"
+)
+
+func TestEntry(t *testing.T) {
+	tests := []struct {
+		entry Entry
+
+		str  string
+		json []byte
+	}{
+		{
+			Entry{entryInfo, "test info", 1},
+			"line 1: info: test info",
+			[]byte(`{"kind":"info","line":1,"message":"test info"}`),
+		},
+		{
+			Entry{entryWarning, "test warning", 1},
+			"line 1: warning: test warning",
+			[]byte(`{"kind":"warning","line":1,"message":"test warning"}`),
+		},
+		{
+			Entry{entryError, "test error", 2},
+			"line 2: error: test error",
+			[]byte(`{"kind":"error","line":2,"message":"test error"}`),
+		},
+	}
+
+	for _, tt := range tests {
+		if str := tt.entry.String(); tt.str != str {
+			t.Errorf("bad string (%q): want %q, got %q", tt.entry, tt.str, str)
+		}
+		json, err := tt.entry.MarshalJSON()
+		if err != nil {
+			t.Errorf("bad error (%q): want %v, got %q", tt.entry, nil, err)
+		}
+		if !bytes.Equal(tt.json, json) {
+			t.Errorf("bad JSON (%q): want %q, got %q", tt.entry, tt.json, json)
+		}
+	}
+}
+
+func TestReport(t *testing.T) {
+	type reportFunc struct {
+		fn      func(*Report, int, string)
+		line    int
+		message string
+	}
+
+	tests := []struct {
+		fs []reportFunc
+
+		es []Entry
+	}{
+		{
+			[]reportFunc{
+				{(*Report).Warning, 1, "test warning 1"},
+				{(*Report).Error, 2, "test error 2"},
+				{(*Report).Info, 10, "test info 10"},
+			},
+			[]Entry{
+				Entry{entryWarning, "test warning 1", 1},
+				Entry{entryError, "test error 2", 2},
+				Entry{entryInfo, "test info 10", 10},
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		r := Report{}
+		for _, f := range tt.fs {
+			f.fn(&r, f.line, f.message)
+		}
+		if es := r.Entries(); !reflect.DeepEqual(tt.es, es) {
+			t.Errorf("bad entries (%v): want %#v, got %#v", tt.fs, tt.es, es)
+		}
+	}
+}

config/validate/rules.go

@@ -0,0 +1,179 @@
+/*
+   Copyright 2014 CoreOS, Inc.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package validate
+
+import (
+	"fmt"
+	"net/url"
+	"path"
+	"reflect"
+	"strings"
+
+	"github.com/coreos/coreos-cloudinit/config"
+)
+
+type rule func(config node, report *Report)
+
+// Rules contains all of the validation rules.
+var Rules []rule = []rule{
+	checkDiscoveryUrl,
+	checkEncoding,
+	checkStructure,
+	checkValidity,
+	checkWriteFiles,
+	checkWriteFilesUnderCoreos,
+}
+
+// checkDiscoveryUrl verifies that the string is a valid url.
+func checkDiscoveryUrl(cfg node, report *Report) {
+	c := cfg.Child("coreos").Child("etcd").Child("discovery")
+	if !c.IsValid() {
+		return
+	}
+
+	if _, err := url.ParseRequestURI(c.String()); err != nil {
+		report.Warning(c.line, "discovery URL is not valid")
+	}
+}
+
+// checkEncoding validates that, for each file under 'write_files', the
+// content can be decoded given the specified encoding.
+func checkEncoding(cfg node, report *Report) {
+	for _, f := range cfg.Child("write_files").children {
+		e := f.Child("encoding")
+		if !e.IsValid() {
+			continue
+		}
+
+		c := f.Child("contents")
+		if _, err := config.DecodeContent(c.String(), e.String()); err != nil {
+			report.Error(c.line, fmt.Sprintf("contents cannot be decoded as %q", e.String()))
+		}
+	}
+}
+
+// checkStructure compares the provided config to the empty config.CloudConfig
+// structure. Each node is checked to make sure that it exists in the known
+// structure and that its type is compatible.
+func checkStructure(cfg node, report *Report) {
+	g := NewNode(config.CloudConfig{}, NewContext([]byte{}))
+	checkNodeStructure(cfg, g, report)
+}
+
+func checkNodeStructure(n, g node, r *Report) {
+	if !isCompatible(n.Kind(), g.Kind()) {
+		r.Warning(n.line, fmt.Sprintf("incorrect type for %q (want %s)", n.name, g.HumanType()))
+		return
+	}
+
+	switch g.Kind() {
+	case reflect.Struct:
+		for _, cn := range n.children {
+			if cg := g.Child(cn.name); cg.IsValid() {
+				checkNodeStructure(cn, cg, r)
+			} else {
+				r.Warning(cn.line, fmt.Sprintf("unrecognized key %q", cn.name))
+			}
+		}
+	case reflect.Slice:
+		for _, cn := range n.children {
+			var cg node
+			c := g.Type().Elem()
+			toNode(reflect.New(c).Elem().Interface(), context{}, &cg)
+			checkNodeStructure(cn, cg, r)
+		}
+	case reflect.String, reflect.Int, reflect.Float64, reflect.Bool:
+	default:
+		panic(fmt.Sprintf("checkNodeStructure(): unhandled kind %s", g.Kind()))
+	}
+}
+
+// isCompatible determines if the type of kind n can be converted to the type
+// of kind g in the context of YAML. This is not an exhaustive list, but its
+// enough for the purposes of cloud-config validation.
+func isCompatible(n, g reflect.Kind) bool {
+	switch g {
+	case reflect.String:
+		return n == reflect.String || n == reflect.Int || n == reflect.Float64 || n == reflect.Bool
+	case reflect.Struct:
+		return n == reflect.Struct || n == reflect.Map
+	case reflect.Float64:
+		return n == reflect.Float64 || n == reflect.Int
+	case reflect.Bool, reflect.Slice, reflect.Int:
+		return n == g
+	default:
+		panic(fmt.Sprintf("isCompatible(): unhandled kind %s", g))
+	}
+}
+
+// checkValidity checks the value of every node in the provided config by
+// running config.AssertValid() on it.
+func checkValidity(cfg node, report *Report) {
+	g := NewNode(config.CloudConfig{}, NewContext([]byte{}))
+	checkNodeValidity(cfg, g, report)
+}
+
+func checkNodeValidity(n, g node, r *Report) {
+	if err := config.AssertValid(n.Value, g.field.Tag.Get("valid")); err != nil {
+		r.Error(n.line, fmt.Sprintf("invalid value %v", n.Value.Interface()))
+	}
+	switch g.Kind() {
+	case reflect.Struct:
+		for _, cn := range n.children {
+			if cg := g.Child(cn.name); cg.IsValid() {
+				checkNodeValidity(cn, cg, r)
+			}
+		}
+	case reflect.Slice:
+		for _, cn := range n.children {
+			var cg node
+			c := g.Type().Elem()
+			toNode(reflect.New(c).Elem().Interface(), context{}, &cg)
+			checkNodeValidity(cn, cg, r)
+		}
+	case reflect.String, reflect.Int, reflect.Float64, reflect.Bool:
+	default:
+		panic(fmt.Sprintf("checkNodeValidity(): unhandled kind %s", g.Kind()))
+	}
+}
+
+// checkWriteFiles checks to make sure that the target file can actually be
+// written. Note that this check is approximate (it only checks to see if the file
+// is under /usr).
+func checkWriteFiles(cfg node, report *Report) {
+	for _, f := range cfg.Child("write_files").children {
+		c := f.Child("path")
+		if !c.IsValid() {
+			continue
+		}
+
+		d := path.Dir(c.String())
+		switch {
+		case strings.HasPrefix(d, "/usr"):
+			report.Error(c.line, "file cannot be written to a read-only filesystem")
+		}
+	}
+}
+
+// checkWriteFilesUnderCoreos checks to see if the 'write_files' node is a
+// child of 'coreos' (it shouldn't be).
+func checkWriteFilesUnderCoreos(cfg node, report *Report) {
+	c := cfg.Child("coreos").Child("write_files")
+	if c.IsValid() {
+		report.Info(c.line, "write_files doesn't belong under coreos")
+	}
+}

config/validate/rules_test.go

@@ -0,0 +1,401 @@
+/*
+   Copyright 2014 CoreOS, Inc.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package validate
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestCheckDiscoveryUrl(t *testing.T) {
+	tests := []struct {
+		config string
+
+		entries []Entry
+	}{
+		{},
+		{
+			config: "coreos:\n  etcd:\n    discovery: https://discovery.etcd.io/00000000000000000000000000000000",
+		},
+		{
+			config: "coreos:\n  etcd:\n    discovery: http://custom.domain/mytoken",
+		},
+		{
+			config:  "coreos:\n  etcd:\n    discovery: disco",
+			entries: []Entry{{entryWarning, "discovery URL is not valid", 3}},
+		},
+	}
+
+	for i, tt := range tests {
+		r := Report{}
+		n, err := parseCloudConfig([]byte(tt.config), &r)
+		if err != nil {
+			panic(err)
+		}
+		checkDiscoveryUrl(n, &r)
+
+		if e := r.Entries(); !reflect.DeepEqual(tt.entries, e) {
+			t.Errorf("bad report (%d, %q): want %#v, got %#v", i, tt.config, tt.entries, e)
+		}
+	}
+}
+
+func TestCheckEncoding(t *testing.T) {
+	tests := []struct {
+		config string
+
+		entries []Entry
+	}{
+		{},
+		{
+			config: "write_files:\n  - encoding: base64\n    contents: aGVsbG8K",
+		},
+		{
+			config: "write_files:\n  - contents: !!binary aGVsbG8K",
+		},
+		{
+			config:  "write_files:\n  - encoding: base64\n    contents: !!binary aGVsbG8K",
+			entries: []Entry{{entryError, `contents cannot be decoded as "base64"`, 3}},
+		},
+		{
+			config: "write_files:\n  - encoding: base64\n    contents: !!binary YUdWc2JHOEsK",
+		},
+		{
+			config: "write_files:\n  - encoding: gzip\n    contents: !!binary H4sIAOC3tVQAA8tIzcnJ5wIAIDA6NgYAAAA=",
+		},
+		{
+			config: "write_files:\n  - encoding: gzip+base64\n    contents: H4sIAOC3tVQAA8tIzcnJ5wIAIDA6NgYAAAA=",
+		},
+		{
+			config:  "write_files:\n  - encoding: custom\n    contents: hello",
+			entries: []Entry{{entryError, `contents cannot be decoded as "custom"`, 3}},
+		},
+	}
+
+	for i, tt := range tests {
+		r := Report{}
+		n, err := parseCloudConfig([]byte(tt.config), &r)
+		if err != nil {
+			panic(err)
+		}
+		checkEncoding(n, &r)
+
+		if e := r.Entries(); !reflect.DeepEqual(tt.entries, e) {
+			t.Errorf("bad report (%d, %q): want %#v, got %#v", i, tt.config, tt.entries, e)
+		}
+	}
+}
+
+func TestCheckStructure(t *testing.T) {
+	tests := []struct {
+		config string
+
+		entries []Entry
+	}{
+		{},
+
+		// Test for unrecognized keys
+		{
+			config:  "test:",
+			entries: []Entry{{entryWarning, "unrecognized key \"test\"", 1}},
+		},
+		{
+			config:  "coreos:\n  etcd:\n    bad:",
+			entries: []Entry{{entryWarning, "unrecognized key \"bad\"", 3}},
+		},
+		{
+			config: "coreos:\n  etcd:\n    discovery: good",
+		},
+
+		// Test for error on list of nodes
+		{
+			config: "coreos:\n  units:\n    - hello\n    - goodbye",
+			entries: []Entry{
+				{entryWarning, "incorrect type for \"units[0]\" (want struct)", 3},
+				{entryWarning, "incorrect type for \"units[1]\" (want struct)", 4},
+			},
+		},
+
+		// Test for incorrect types
+		// Want boolean
+		{
+			config: "coreos:\n  units:\n    - enable: true",
+		},
+		{
+			config:  "coreos:\n  units:\n    - enable: 4",
+			entries: []Entry{{entryWarning, "incorrect type for \"enable\" (want bool)", 3}},
+		},
+		{
+			config:  "coreos:\n  units:\n    - enable: bad",
+			entries: []Entry{{entryWarning, "incorrect type for \"enable\" (want bool)", 3}},
+		},
+		{
+			config:  "coreos:\n  units:\n    - enable:\n        bad:",
+			entries: []Entry{{entryWarning, "incorrect type for \"enable\" (want bool)", 3}},
+		},
+		{
+			config:  "coreos:\n  units:\n    - enable:\n      - bad",
+			entries: []Entry{{entryWarning, "incorrect type for \"enable\" (want bool)", 3}},
+		},
+		// Want string
+		{
+			config: "hostname: true",
+		},
+		{
+			config: "hostname: 4",
+		},
+		{
+			config: "hostname: host",
+		},
+		{
+			config:  "hostname:\n  name:",
+			entries: []Entry{{entryWarning, "incorrect type for \"hostname\" (want string)", 1}},
+		},
+		{
+			config:  "hostname:\n  - name",
+			entries: []Entry{{entryWarning, "incorrect type for \"hostname\" (want string)", 1}},
+		},
+		// Want struct
+		{
+			config:  "coreos: true",
+			entries: []Entry{{entryWarning, "incorrect type for \"coreos\" (want struct)", 1}},
+		},
+		{
+			config:  "coreos: 4",
+			entries: []Entry{{entryWarning, "incorrect type for \"coreos\" (want struct)", 1}},
+		},
+		{
+			config:  "coreos: hello",
+			entries: []Entry{{entryWarning, "incorrect type for \"coreos\" (want struct)", 1}},
+		},
+		{
+			config: "coreos:\n  etcd:\n    discovery: fire in the disco",
+		},
+		{
+			config:  "coreos:\n  - hello",
+			entries: []Entry{{entryWarning, "incorrect type for \"coreos\" (want struct)", 1}},
+		},
+		// Want []string
+		{
+			config:  "ssh_authorized_keys: true",
+			entries: []Entry{{entryWarning, "incorrect type for \"ssh_authorized_keys\" (want []string)", 1}},
+		},
+		{
+			config:  "ssh_authorized_keys: 4",
+			entries: []Entry{{entryWarning, "incorrect type for \"ssh_authorized_keys\" (want []string)", 1}},
+		},
+		{
+			config:  "ssh_authorized_keys: key",
+			entries: []Entry{{entryWarning, "incorrect type for \"ssh_authorized_keys\" (want []string)", 1}},
+		},
+		{
+			config:  "ssh_authorized_keys:\n  key: value",
+			entries: []Entry{{entryWarning, "incorrect type for \"ssh_authorized_keys\" (want []string)", 1}},
+		},
+		{
+			config: "ssh_authorized_keys:\n  - key",
+		},
+		{
+			config:  "ssh_authorized_keys:\n  - key: value",
+			entries: []Entry{{entryWarning, "incorrect type for \"ssh_authorized_keys[0]\" (want string)", 2}},
+		},
+		// Want []struct
+		{
+			config:  "users:\n  true",
+			entries: []Entry{{entryWarning, "incorrect type for \"users\" (want []struct)", 1}},
+		},
+		{
+			config:  "users:\n  4",
+			entries: []Entry{{entryWarning, "incorrect type for \"users\" (want []struct)", 1}},
+		},
+		{
+			config:  "users:\n  bad",
+			entries: []Entry{{entryWarning, "incorrect type for \"users\" (want []struct)", 1}},
+		},
+		{
+			config:  "users:\n  bad:",
+			entries: []Entry{{entryWarning, "incorrect type for \"users\" (want []struct)", 1}},
+		},
+		{
+			config: "users:\n  - name: good",
+		},
+		// Want struct within array
+		{
+			config:  "users:\n  - true",
+			entries: []Entry{{entryWarning, "incorrect type for \"users[0]\" (want struct)", 2}},
+		},
+		{
+			config:  "users:\n  - name: hi\n  - true",
+			entries: []Entry{{entryWarning, "incorrect type for \"users[1]\" (want struct)", 3}},
+		},
+		{
+			config:  "users:\n  - 4",
+			entries: []Entry{{entryWarning, "incorrect type for \"users[0]\" (want struct)", 2}},
+		},
+		{
+			config:  "users:\n  - bad",
+			entries: []Entry{{entryWarning, "incorrect type for \"users[0]\" (want struct)", 2}},
+		},
+		{
+			config:  "users:\n  - - bad",
+			entries: []Entry{{entryWarning, "incorrect type for \"users[0]\" (want struct)", 2}},
+		},
+	}
+
+	for i, tt := range tests {
+		r := Report{}
+		n, err := parseCloudConfig([]byte(tt.config), &r)
+		if err != nil {
+			panic(err)
+		}
+		checkStructure(n, &r)
+
+		if e := r.Entries(); !reflect.DeepEqual(tt.entries, e) {
+			t.Errorf("bad report (%d, %q): want %#v, got %#v", i, tt.config, tt.entries, e)
+		}
+	}
+}
+
+func TestCheckValidity(t *testing.T) {
+	tests := []struct {
+		config string
+
+		entries []Entry
+	}{
+		// string
+		{
+			config: "hostname: test",
+		},
+
+		// int
+		{
+			config: "coreos:\n  fleet:\n    verbosity: 2",
+		},
+
+		// bool
+		{
+			config: "coreos:\n  units:\n    - enable: true",
+		},
+
+		// slice
+		{
+			config: "coreos:\n  units:\n    - command: start\n    - name: stop",
+		},
+		{
+			config:  "coreos:\n  units:\n    - command: lol",
+			entries: []Entry{{entryError, "invalid value lol", 3}},
+		},
+
+		// struct
+		{
+			config: "coreos:\n  update:\n    reboot_strategy: off",
+		},
+		{
+			config:  "coreos:\n  update:\n    reboot_strategy: always",
+			entries: []Entry{{entryError, "invalid value always", 3}},
+		},
+
+		// unknown
+		{
+			config: "unknown: hi",
+		},
+	}
+
+	for i, tt := range tests {
+		r := Report{}
+		n, err := parseCloudConfig([]byte(tt.config), &r)
+		if err != nil {
+			panic(err)
+		}
+		checkValidity(n, &r)
+
+		if e := r.Entries(); !reflect.DeepEqual(tt.entries, e) {
+			t.Errorf("bad report (%d, %q): want %#v, got %#v", i, tt.config, tt.entries, e)
+		}
+	}
+}
+
+func TestCheckWriteFiles(t *testing.T) {
+	tests := []struct {
+		config string
+
+		entries []Entry
+	}{
+		{},
+		{
+			config: "write_files:\n  - path: /valid",
+		},
+		{
+			config: "write_files:\n  - path: /tmp/usr/valid",
+		},
+		{
+			config:  "write_files:\n  - path: /usr/invalid",
+			entries: []Entry{{entryError, "file cannot be written to a read-only filesystem", 2}},
+		},
+		{
+			config:  "write-files:\n  - path: /tmp/../usr/invalid",
+			entries: []Entry{{entryError, "file cannot be written to a read-only filesystem", 2}},
+		},
+	}
+
+	for i, tt := range tests {
+		r := Report{}
+		n, err := parseCloudConfig([]byte(tt.config), &r)
+		if err != nil {
+			panic(err)
+		}
+		checkWriteFiles(n, &r)
+
+		if e := r.Entries(); !reflect.DeepEqual(tt.entries, e) {
+			t.Errorf("bad report (%d, %q): want %#v, got %#v", i, tt.config, tt.entries, e)
+		}
+	}
+}
+
+func TestCheckWriteFilesUnderCoreos(t *testing.T) {
+	tests := []struct {
+		config string
+
+		entries []Entry
+	}{
+		{},
+		{
+			config: "write_files:\n  - path: /hi",
+		},
+		{
+			config:  "coreos:\n  write_files:\n    - path: /hi",
+			entries: []Entry{{entryInfo, "write_files doesn't belong under coreos", 2}},
+		},
+		{
+			config:  "coreos:\n  write-files:\n    - path: /hyphen",
+			entries: []Entry{{entryInfo, "write_files doesn't belong under coreos", 2}},
+		},
+	}
+
+	for i, tt := range tests {
+		r := Report{}
+		n, err := parseCloudConfig([]byte(tt.config), &r)
+		if err != nil {
+			panic(err)
+		}
+		checkWriteFilesUnderCoreos(n, &r)
+
+		if e := r.Entries(); !reflect.DeepEqual(tt.entries, e) {
+			t.Errorf("bad report (%d, %q): want %#v, got %#v", i, tt.config, tt.entries, e)
+		}
+	}
+}

config/validate/validate.go

@@ -0,0 +1,164 @@
+/*
+   Copyright 2014 CoreOS, Inc.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package validate
+
+import (
+	"errors"
+	"fmt"
+	"regexp"
+	"strconv"
+	"strings"
+
+	"github.com/coreos/coreos-cloudinit/config"
+
+	"github.com/coreos/coreos-cloudinit/Godeps/_workspace/src/github.com/coreos/yaml"
+)
+
+var (
+	yamlLineError = regexp.MustCompile(`^YAML error: line (?P<line>[[:digit:]]+): (?P<msg>.*)$`)
+	yamlError     = regexp.MustCompile(`^YAML error: (?P<msg>.*)$`)
+)
+
+// Validate runs a series of validation tests against the given userdata and
+// returns a report detailing all of the issues. Presently, only cloud-configs
+// can be validated.
+func Validate(userdataBytes []byte) (Report, error) {
+	switch {
+	case len(userdataBytes) == 0:
+		return Report{}, nil
+	case config.IsScript(string(userdataBytes)):
+		return Report{}, nil
+	case config.IsCloudConfig(string(userdataBytes)):
+		return validateCloudConfig(userdataBytes, Rules)
+	default:
+		return Report{entries: []Entry{
+			Entry{kind: entryError, message: `must be "#cloud-config" or begin with "#!"`, line: 1},
+		}}, nil
+	}
+}
+
+// validateCloudConfig runs all of the validation rules in Rules and returns
+// the resulting report and any errors encountered.
+func validateCloudConfig(config []byte, rules []rule) (report Report, err error) {
+	defer func() {
+		if r := recover(); r != nil {
+			err = fmt.Errorf("%v", r)
+		}
+	}()
+
+	c, err := parseCloudConfig(config, &report)
+	if err != nil {
+		return report, err
+	}
+
+	for _, r := range rules {
+		r(c, &report)
+	}
+	return report, nil
+}
+
+// parseCloudConfig parses the provided config into a node structure and logs
+// any parsing issues into the provided report. Unrecoverable errors are
+// returned as an error.
+func parseCloudConfig(cfg []byte, report *Report) (node, error) {
+	yaml.UnmarshalMappingKeyTransform = func(nameIn string) (nameOut string) {
+		return nameIn
+	}
+	// unmarshal the config into an implicitly-typed form. The yaml library
+	// will implicitly convert types into their normalized form
+	// (e.g. 0744 -> 484, off -> false).
+	var weak map[interface{}]interface{}
+	if err := yaml.Unmarshal(cfg, &weak); err != nil {
+		matches := yamlLineError.FindStringSubmatch(err.Error())
+		if len(matches) == 3 {
+			line, err := strconv.Atoi(matches[1])
+			if err != nil {
+				return node{}, err
+			}
+			msg := matches[2]
+			report.Error(line, msg)
+			return node{}, nil
+		}
+
+		matches = yamlError.FindStringSubmatch(err.Error())
+		if len(matches) == 2 {
+			report.Error(1, matches[1])
+			return node{}, nil
+		}
+
+		return node{}, errors.New("couldn't parse yaml error")
+	}
+	w := NewNode(weak, NewContext(cfg))
+	w = normalizeNodeNames(w, report)
+
+	// unmarshal the config into the explicitly-typed form.
+	yaml.UnmarshalMappingKeyTransform = func(nameIn string) (nameOut string) {
+		return strings.Replace(nameIn, "-", "_", -1)
+	}
+	var strong config.CloudConfig
+	if err := yaml.Unmarshal([]byte(cfg), &strong); err != nil {
+		return node{}, err
+	}
+	s := NewNode(strong, NewContext(cfg))
+
+	// coerceNodes weak nodes and strong nodes. strong nodes replace weak nodes
+	// if they are compatible types (this happens when the yaml library
+	// converts the input).
+	// (e.g. weak 484 is replaced by strong 0744, weak 4 is not replaced by
+	// strong false)
+	return coerceNodes(w, s), nil
+}
+
+// coerceNodes recursively evaluates two nodes, returning a new node containing
+// either the weak or strong node's value and its recursively processed
+// children. The strong node's value is used if the two nodes are leafs, are
+// both valid, and are compatible types (defined by isCompatible()). The weak
+// node is returned in all other cases. coerceNodes is used to counteract the
+// effects of yaml's automatic type conversion. The weak node is the one
+// resulting from unmarshalling into an empty interface{} (the type is
+// inferred). The strong node is the one resulting from unmarshalling into a
+// struct. If the two nodes are of compatible types, the yaml library correctly
+// parsed the value into the strongly typed unmarshalling. In this case, we
+// prefer the strong node because its actually the type we are expecting.
+func coerceNodes(w, s node) node {
+	n := w
+	n.children = nil
+	if len(w.children) == 0 && len(s.children) == 0 &&
+		w.IsValid() && s.IsValid() &&
+		isCompatible(w.Kind(), s.Kind()) {
+		n.Value = s.Value
+	}
+
+	for _, cw := range w.children {
+		n.children = append(n.children, coerceNodes(cw, s.Child(cw.name)))
+	}
+	return n
+}
+
+// normalizeNodeNames replaces all occurences of '-' with '_' within key names
+// and makes a note of each replacement in the report.
+func normalizeNodeNames(node node, report *Report) node {
+	if strings.Contains(node.name, "-") {
+		// TODO(crawford): Enable this message once the new validator hits stable.
+		//report.Info(node.line, fmt.Sprintf("%q uses '-' instead of '_'", node.name))
+		node.name = strings.Replace(node.name, "-", "_", -1)
+	}
+	for i := range node.children {
+		node.children[i] = normalizeNodeNames(node.children[i], report)
+	}
+	return node
+}

config/validate/validate_test.go

@@ -0,0 +1,169 @@
+/*
+   Copyright 2014 CoreOS, Inc.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package validate
+
+import (
+	"errors"
+	"reflect"
+	"testing"
+)
+
+func TestParseCloudConfig(t *testing.T) {
+	tests := []struct {
+		config string
+
+		entries []Entry
+	}{
+		{},
+		{
+			config: "	",
+			entries: []Entry{{entryError, "found character that cannot start any token", 1}},
+		},
+		{
+			config:  "a:\na",
+			entries: []Entry{{entryError, "could not find expected ':'", 2}},
+		},
+		{
+			config:  "#hello\na:\na",
+			entries: []Entry{{entryError, "could not find expected ':'", 3}},
+		},
+	}
+
+	for _, tt := range tests {
+		r := Report{}
+		parseCloudConfig([]byte(tt.config), &r)
+
+		if e := r.Entries(); !reflect.DeepEqual(tt.entries, e) {
+			t.Errorf("bad report (%s): want %#v, got %#v", tt.config, tt.entries, e)
+		}
+	}
+}
+
+func TestValidateCloudConfig(t *testing.T) {
+	tests := []struct {
+		config string
+		rules  []rule
+
+		report Report
+		err    error
+	}{
+		{
+			rules: []rule{func(_ node, _ *Report) { panic("something happened") }},
+			err:   errors.New("something happened"),
+		},
+		{
+			config: "write_files:\n  - permissions: 0744",
+			rules:  Rules,
+		},
+		{
+			config: "write_files:\n  - permissions: '0744'",
+			rules:  Rules,
+		},
+		{
+			config: "write_files:\n  - permissions: 744",
+			rules:  Rules,
+		},
+		{
+			config: "write_files:\n  - permissions: '744'",
+			rules:  Rules,
+		},
+		{
+			config: "coreos:\n  update:\n    reboot-strategy: off",
+			rules:  Rules,
+		},
+		{
+			config: "coreos:\n  update:\n    reboot-strategy: false",
+			rules:  Rules,
+			report: Report{entries: []Entry{{entryError, "invalid value false", 3}}},
+		},
+	}
+
+	for _, tt := range tests {
+		r, err := validateCloudConfig([]byte(tt.config), tt.rules)
+		if !reflect.DeepEqual(tt.err, err) {
+			t.Errorf("bad error (%s): want %v, got %v", tt.config, tt.err, err)
+		}
+		if !reflect.DeepEqual(tt.report, r) {
+			t.Errorf("bad report (%s): want %+v, got %+v", tt.config, tt.report, r)
+		}
+	}
+}
+
+func TestValidate(t *testing.T) {
+	tests := []struct {
+		config string
+
+		report Report
+	}{
+		{},
+		{
+			config: "#!/bin/bash\necho hey",
+		},
+	}
+
+	for i, tt := range tests {
+		r, err := Validate([]byte(tt.config))
+		if err != nil {
+			t.Errorf("bad error (case #%d): want %v, got %v", i, nil, err)
+		}
+		if !reflect.DeepEqual(tt.report, r) {
+			t.Errorf("bad report (case #%d): want %+v, got %+v", i, tt.report, r)
+		}
+	}
+}
+
+func BenchmarkValidate(b *testing.B) {
+	config := `#cloud-config
+hostname: test
+
+coreos:
+  etcd:
+    name:      node001
+    discovery: https://discovery.etcd.io/disco
+    addr:      $public_ipv4:4001
+    peer-addr: $private_ipv4:7001
+  fleet:
+    verbosity: 2
+    metadata:  "hi"
+  update:
+    reboot-strategy: off
+  units:
+    - name:    hi.service
+      command: start
+      enable:  true
+    - name:    bye.service
+      command: stop
+
+ssh_authorized_keys:
+  - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC0g+ZTxC7weoIJLUafOgrm+h...
+  - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC0g+ZTxC7weoIJLUafOgrm+h...
+
+users:
+  - name: me
+
+write_files:
+  - path: /etc/yes
+    content: "Hi"
+
+manage_etc_hosts: localhost`
+
+	for i := 0; i < b.N; i++ {
+		if _, err := Validate([]byte(config)); err != nil {
+			panic(err)
+		}
+	}
+}

coreos-cloudinit.go

@@ -24,6 +24,7 @@ import (
 	"time"
 
 	"github.com/coreos/coreos-cloudinit/config"
+	"github.com/coreos/coreos-cloudinit/config/validate"
 	"github.com/coreos/coreos-cloudinit/datasource"
 	"github.com/coreos/coreos-cloudinit/datasource/configdrive"
 	"github.com/coreos/coreos-cloudinit/datasource/file"
@@ -39,7 +40,7 @@ import (
 )
 
 const (
-	version               = "0.10.4+git"
+	version               = "1.2.1"
 	datasourceInterval    = 100 * time.Millisecond
 	datasourceMaxInterval = 30 * time.Second
 	datasourceTimeout     = 5 * time.Minute
@@ -64,6 +65,7 @@ var (
 		workspace      string
 		sshKeyName     string
 		oem            string
+		validate       bool
 	}{}
 )
 
@@ -83,6 +85,7 @@ func init() {
 	flag.StringVar(&flags.convertNetconf, "convert-netconf", "", "Read the network config provided in cloud-drive and translate it from the specified format into networkd unit files")
 	flag.StringVar(&flags.workspace, "workspace", "/var/lib/coreos-cloudinit", "Base directory coreos-cloudinit should use to store data")
 	flag.StringVar(&flags.sshKeyName, "ssh-key-name", initialize.DefaultSSHKeyName, "Add SSH keys to the system with the given name")
+	flag.BoolVar(&flags.validate, "validate", false, "[EXPERIMENTAL] Validate the user-data but do not apply it to the system")
 }
 
 type oemConfig map[string]string
@@ -158,6 +161,22 @@ func main() {
 		failure = true
 	}
 
+	if report, err := validate.Validate(userdataBytes); err == nil {
+		ret := 0
+		for _, e := range report.Entries() {
+			fmt.Println(e)
+			ret = 1
+		}
+		if flags.validate {
+			os.Exit(ret)
+		}
+	} else {
+		fmt.Printf("Failed while validating user_data (%q)\n", err)
+		if flags.validate {
+			os.Exit(1)
+		}
+	}
+
 	fmt.Printf("Fetching meta-data from datasource of type %q\n", ds.Type())
 	metadataBytes, err := ds.FetchMetadata()
 	if err != nil {
@@ -180,7 +199,7 @@ func main() {
 	userdata := env.Apply(string(userdataBytes))
 
 	var ccm, ccu *config.CloudConfig
-	var script *system.Script
+	var script *config.Script
 	if ccm, err = initialize.ParseMetaData(string(metadataBytes)); err != nil {
 		fmt.Printf("Failed to parse meta-data: %v\n", err)
 		os.Exit(1)
@@ -203,7 +222,7 @@ func main() {
 		switch t := ud.(type) {
 		case *config.CloudConfig:
 			ccu = t
-		case system.Script:
+		case config.Script:
 			script = &t
 		}
 	}
@@ -362,7 +381,7 @@ func selectDatasource(sources []datasource.Datasource) datasource.Datasource {
 }
 
 // TODO(jonboulle): this should probably be refactored and moved into a different module
-func runScript(script system.Script, env *initialize.Environment) error {
+func runScript(script config.Script, env *initialize.Environment) error {
 	err := initialize.PrepWorkspace(env.Workspace())
 	if err != nil {
 		fmt.Printf("Failed preparing workspace: %v\n", err)

datasource/metadata/cloudsigma/server_context.go

@@ -17,8 +17,12 @@
 package cloudsigma
 
 import (
+	"bytes"
 	"encoding/base64"
 	"encoding/json"
+	"errors"
+	"io/ioutil"
+	"net"
 	"os"
 	"strings"
 
@@ -51,7 +55,8 @@ func (_ *serverContextService) IsAvailable() bool {
 	}
 	productName := make([]byte, 10)
 	_, err = productNameFile.Read(productName)
-	return err == nil && string(productName) == "CloudSigma"
+
+	return err == nil && string(productName) == "CloudSigma" && hasDHCPLeases()
 }
 
 func (_ *serverContextService) AvailabilityChanges() bool {
@@ -73,12 +78,16 @@ func (scs *serverContextService) FetchMetadata() ([]byte, error) {
 			UUID string            `json:"uuid"`
 			Meta map[string]string `json:"meta"`
 			Nics []struct {
-				Runtime struct {
+				Mac      string `json:"mac"`
+				IPv4Conf struct {
 					InterfaceType string `json:"interface_type"`
-					IPv4          struct {
-						IP string `json:"uuid"`
-					} `json:"ip_v4"`
-				} `json:"runtime"`
+					IP            struct {
+						UUID string `json:"uuid"`
+					} `json:"ip"`
+				} `json:"ip_v4_conf"`
+				VLAN struct {
+					UUID string `json:"uuid"`
+				} `json:"vlan"`
 			} `json:"nics"`
 		}
 		outputMetadata struct {
@@ -112,11 +121,12 @@ func (scs *serverContextService) FetchMetadata() ([]byte, error) {
 	}
 
 	for _, nic := range inputMetadata.Nics {
-		if nic.Runtime.IPv4.IP != "" {
-			if nic.Runtime.InterfaceType == "public" {
-				outputMetadata.PublicIPv4 = nic.Runtime.IPv4.IP
-			} else {
-				outputMetadata.LocalIPv4 = nic.Runtime.IPv4.IP
+		if nic.IPv4Conf.IP.UUID != "" {
+			outputMetadata.PublicIPv4 = nic.IPv4Conf.IP.UUID
+		}
+		if nic.VLAN.UUID != "" {
+			if localIP, err := scs.findLocalIP(nic.Mac); err == nil {
+				outputMetadata.LocalIPv4 = localIP
 			}
 		}
 	}
@@ -146,6 +156,36 @@ func (scs *serverContextService) FetchNetworkConfig(a string) ([]byte, error) {
 	return nil, nil
 }
 
+func (scs *serverContextService) findLocalIP(mac string) (string, error) {
+	ifaces, err := net.Interfaces()
+	if err != nil {
+		return "", err
+	}
+	ifaceMac, err := net.ParseMAC(mac)
+	if err != nil {
+		return "", err
+	}
+	for _, iface := range ifaces {
+		if !bytes.Equal(iface.HardwareAddr, ifaceMac) {
+			continue
+		}
+		addrs, err := iface.Addrs()
+		if err != nil {
+			continue
+		}
+
+		for _, addr := range addrs {
+			switch ip := addr.(type) {
+			case *net.IPNet:
+				if ip.IP.To4() != nil {
+					return ip.IP.To4().String(), nil
+				}
+			}
+		}
+	}
+	return "", errors.New("Local IP not found")
+}
+
 func isBase64Encoded(field string, userdata map[string]string) bool {
 	base64Fields, ok := userdata["base64_fields"]
 	if !ok {
@@ -159,3 +199,8 @@ func isBase64Encoded(field string, userdata map[string]string) bool {
 	}
 	return false
 }
+
+func hasDHCPLeases() bool {
+	files, err := ioutil.ReadDir("/run/systemd/netif/leases/")
+	return err == nil && len(files) > 0
+}

datasource/metadata/cloudsigma/server_context_test.go

@@ -74,14 +74,41 @@ func TestServerContextFetchMetadata(t *testing.T) {
 		"name": "coreos",
 		"nics": [
 			{
-				"runtime": {
-					"interface_type": "public",
-					"ip_v4": {
+				"boot_order": null,
+				"ip_v4_conf": {
+					"conf": "dhcp",
+					"ip": {
+						"gateway": "31.171.244.1",
+						"meta": {},
+						"nameservers": [
+							"178.22.66.167",
+							"178.22.71.56",
+							"8.8.8.8"
+						],
+						"netmask": 22,
+						"tags": [],
 						"uuid": "31.171.251.74"
+					}
 				},
-					"ip_v6": null
-				},
+				"ip_v6_conf": null,
+				"mac": "22:3d:09:6b:90:f3",
+				"model": "virtio",
 				"vlan": null
+			},
+			{
+				"boot_order": null,
+				"ip_v4_conf": null,
+				"ip_v6_conf": null,
+				"mac": "22:ae:4a:fb:8f:31",
+				"model": "virtio",
+				"vlan": {
+					"meta": {
+						"description": "",
+						"name": "CoreOS"
+					},
+					"tags": [],
+					"uuid": "5dec030e-25b8-4621-a5a4-a3302c9d9619"
+				}
 			}
 		],
 		"smp": 2,
@@ -106,12 +133,8 @@ func TestServerContextFetchMetadata(t *testing.T) {
 		t.Error("Public SSH Keys are not being read properly")
 	}
 
-	if metadata.LocalIPv4 != "" {
-		t.Errorf("Local IP is not empty but %s instead", metadata.LocalIPv4)
-	}
-
 	if metadata.PublicIPv4 != "31.171.251.74" {
-		t.Errorf("Local IP is not 31.171.251.74 but %s instead", metadata.PublicIPv4)
+		t.Errorf("Public IP is not 31.171.251.74 but %s instead", metadata.PublicIPv4)
 	}
 }
 

datasource/metadata/ec2/metadata.go

@@ -69,7 +69,7 @@ func (ms metadataService) FetchMetadata() ([]byte, error) {
 	}
 
 	if hostname, err := ms.fetchAttribute(fmt.Sprintf("%s/hostname", ms.MetadataUrl())); err == nil {
-		attrs["hostname"] = hostname
+		attrs["hostname"] = strings.Split(hostname, " ")[0]
 	} else if _, ok := err.(pkg.ErrNotFound); !ok {
 		return nil, err
 	}

datasource/metadata/ec2/metadata_test.go

@@ -173,6 +173,20 @@ func TestFetchMetadata(t *testing.T) {
 			},
 			expect: []byte(`{"hostname":"host","local-ipv4":"1.2.3.4","network_config":{"content_path":"path"},"public-ipv4":"5.6.7.8","public_keys":{"test1":"key"}}`),
 		},
+		{
+			root:         "/",
+			metadataPath: "2009-04-04/meta-data",
+			resources: map[string]string{
+				"/2009-04-04/meta-data/hostname":                    "host domain another_domain",
+				"/2009-04-04/meta-data/local-ipv4":                  "1.2.3.4",
+				"/2009-04-04/meta-data/public-ipv4":                 "5.6.7.8",
+				"/2009-04-04/meta-data/public-keys":                 "0=test1\n",
+				"/2009-04-04/meta-data/public-keys/0":               "openssh-key",
+				"/2009-04-04/meta-data/public-keys/0/openssh-key":   "key",
+				"/2009-04-04/meta-data/network_config/content_path": "path",
+			},
+			expect: []byte(`{"hostname":"host","local-ipv4":"1.2.3.4","network_config":{"content_path":"path"},"public-ipv4":"5.6.7.8","public_keys":{"test1":"key"}}`),
+		},
 		{
 			clientErr: pkg.ErrTimeout{Err: fmt.Errorf("test error")},
 			expectErr: pkg.ErrTimeout{Err: fmt.Errorf("test error")},

initialize/config.go

@@ -87,6 +87,12 @@ func Apply(cfg config.CloudConfig, env *Environment) error {
 				return err
 			}
 		}
+		for _, u := range user.SSHImportGithubUsers {
+			log.Printf("Authorizing github user %s SSH keys for CoreOS user '%s'", u, user.Name)
+			if err := SSHImportGithubUser(user.Name, u); err != nil {
+				return err
+			}
+		}
 		if user.SSHImportURL != "" {
 			log.Printf("Authorizing SSH keys for CoreOS user '%s' from '%s'", user.Name, user.SSHImportURL)
 			if err := SSHImportKeysFromURL(user.Name, user.SSHImportURL); err != nil {
@@ -110,9 +116,10 @@ func Apply(cfg config.CloudConfig, env *Environment) error {
 	}
 
 	for _, ccf := range []CloudConfigFile{
-		system.OEM{OEM: cfg.Coreos.OEM},
-		system.Update{Update: cfg.Coreos.Update, ReadConfig: system.DefaultReadConfig},
+		system.OEM{OEM: cfg.CoreOS.OEM},
+		system.Update{Update: cfg.CoreOS.Update, ReadConfig: system.DefaultReadConfig},
 		system.EtcHosts{EtcHosts: cfg.ManageEtcHosts},
+		system.Flannel{Flannel: cfg.CoreOS.Flannel},
 	} {
 		f, err := ccf.File()
 		if err != nil {
@@ -124,14 +131,15 @@ func Apply(cfg config.CloudConfig, env *Environment) error {
 	}
 
 	var units []system.Unit
-	for _, u := range cfg.Coreos.Units {
+	for _, u := range cfg.CoreOS.Units {
 		units = append(units, system.Unit{Unit: u})
 	}
 
 	for _, ccu := range []CloudConfigUnit{
-		system.Etcd{Etcd: cfg.Coreos.Etcd},
-		system.Fleet{Fleet: cfg.Coreos.Fleet},
-		system.Update{Update: cfg.Coreos.Update, ReadConfig: system.DefaultReadConfig},
+		system.Etcd{Etcd: cfg.CoreOS.Etcd},
+		system.Fleet{Fleet: cfg.CoreOS.Fleet},
+		system.Locksmith{Locksmith: cfg.CoreOS.Locksmith},
+		system.Update{Update: cfg.CoreOS.Update, ReadConfig: system.DefaultReadConfig},
 	} {
 		units = append(units, ccu.Units()...)
 	}
@@ -168,16 +176,13 @@ func Apply(cfg config.CloudConfig, env *Environment) error {
 		case "digitalocean":
 			interfaces, err = network.ProcessDigitalOceanNetconf(cfg.NetworkConfig)
 		default:
-			return fmt.Errorf("Unsupported network config format %q", env.NetconfType())
+			err = fmt.Errorf("Unsupported network config format %q", env.NetconfType())
 		}
-
 		if err != nil {
 			return err
 		}
 
-		if err := system.WriteNetworkdConfigs(interfaces); err != nil {
-			return err
-		}
+		units = append(units, createNetworkingUnits(interfaces)...)
 		if err := system.RestartNetwork(interfaces); err != nil {
 			return err
 		}
@@ -185,7 +190,25 @@ func Apply(cfg config.CloudConfig, env *Environment) error {
 
 	um := system.NewUnitManager(env.Root())
 	return processUnits(units, env.Root(), um)
+}
 
+func createNetworkingUnits(interfaces []network.InterfaceGenerator) (units []system.Unit) {
+	appendNewUnit := func(units []system.Unit, name, content string) []system.Unit {
+		if content == "" {
+			return units
+		}
+		return append(units, system.Unit{Unit: config.Unit{
+			Name:    name,
+			Runtime: true,
+			Content: content,
+		}})
+	}
+	for _, i := range interfaces {
+		units = appendNewUnit(units, fmt.Sprintf("%s.netdev", i.Filename()), i.Netdev())
+		units = appendNewUnit(units, fmt.Sprintf("%s.link", i.Filename()), i.Link())
+		units = appendNewUnit(units, fmt.Sprintf("%s.network", i.Filename()), i.Network())
+	}
+	return units
 }
 
 // processUnits takes a set of Units and applies them to the given root using
@@ -194,66 +217,92 @@ func Apply(cfg config.CloudConfig, env *Environment) error {
 // commands against units. It returns any error encountered.
 func processUnits(units []system.Unit, root string, um system.UnitManager) error {
 	type action struct {
-		unit    string
+		unit    system.Unit
 		command string
 	}
 	actions := make([]action, 0, len(units))
 	reload := false
+	restartNetworkd := false
 	for _, unit := range units {
-		dst := unit.Destination(root)
+		if unit.Name == "" {
+			log.Printf("Skipping unit without name")
+			continue
+		}
+
 		if unit.Content != "" {
-			log.Printf("Writing unit %s to filesystem at path %s", unit.Name, dst)
-			if err := um.PlaceUnit(&unit, dst); err != nil {
+			log.Printf("Writing unit %q to filesystem", unit.Name)
+			if err := um.PlaceUnit(unit); err != nil {
 				return err
 			}
-			log.Printf("Placed unit %s at %s", unit.Name, dst)
+			log.Printf("Wrote unit %q", unit.Name)
 			reload = true
 		}
 
+		for _, dropin := range unit.DropIns {
+			if dropin.Name != "" && dropin.Content != "" {
+				log.Printf("Writing drop-in unit %q to filesystem", dropin.Name)
+				if err := um.PlaceUnitDropIn(unit, dropin); err != nil {
+					return err
+				}
+				log.Printf("Wrote drop-in unit %q", dropin.Name)
+				reload = true
+			}
+		}
+
 		if unit.Mask {
-			log.Printf("Masking unit file %s", unit.Name)
-			if err := um.MaskUnit(&unit); err != nil {
+			log.Printf("Masking unit file %q", unit.Name)
+			if err := um.MaskUnit(unit); err != nil {
 				return err
 			}
 		} else if unit.Runtime {
-			log.Printf("Ensuring runtime unit file %s is unmasked", unit.Name)
-			if err := um.UnmaskUnit(&unit); err != nil {
+			log.Printf("Ensuring runtime unit file %q is unmasked", unit.Name)
+			if err := um.UnmaskUnit(unit); err != nil {
 				return err
 			}
 		}
 
 		if unit.Enable {
 			if unit.Group() != "network" {
-				log.Printf("Enabling unit file %s", unit.Name)
-				if err := um.EnableUnitFile(unit.Name, unit.Runtime); err != nil {
+				log.Printf("Enabling unit file %q", unit.Name)
+				if err := um.EnableUnitFile(unit); err != nil {
 					return err
 				}
-				log.Printf("Enabled unit %s", unit.Name)
+				log.Printf("Enabled unit %q", unit.Name)
 			} else {
-				log.Printf("Skipping enable for network-like unit %s", unit.Name)
+				log.Printf("Skipping enable for network-like unit %q", unit.Name)
 			}
 		}
 
 		if unit.Group() == "network" {
-			actions = append(actions, action{"systemd-networkd.service", "restart"})
+			restartNetworkd = true
 		} else if unit.Command != "" {
-			actions = append(actions, action{unit.Name, unit.Command})
+			actions = append(actions, action{unit, unit.Command})
 		}
 	}
 
 	if reload {
 		if err := um.DaemonReload(); err != nil {
-			return errors.New(fmt.Sprintf("failed systemd daemon-reload: %v", err))
+			return errors.New(fmt.Sprintf("failed systemd daemon-reload: %s", err))
 		}
 	}
 
-	for _, action := range actions {
-		log.Printf("Calling unit command '%s %s'", action.command, action.unit)
-		res, err := um.RunUnitCommand(action.command, action.unit)
+	if restartNetworkd {
+		log.Printf("Restarting systemd-networkd")
+		networkd := system.Unit{Unit: config.Unit{Name: "systemd-networkd.service"}}
+		res, err := um.RunUnitCommand(networkd, "restart")
 		if err != nil {
 			return err
 		}
-		log.Printf("Result of '%s %s': %s", action.command, action.unit, res)
+		log.Printf("Restarted systemd-networkd (%s)", res)
+	}
+
+	for _, action := range actions {
+		log.Printf("Calling unit command %q on %q'", action.command, action.unit.Name)
+		res, err := um.RunUnitCommand(action.unit, action.command)
+		if err != nil {
+			return err
+		}
+		log.Printf("Result of %q on %q: %s", action.command, action.unit.Name, res)
 	}
 
 	return nil

initialize/config_test.go

@@ -17,9 +17,11 @@
 package initialize
 
 import (
+	"reflect"
 	"testing"
 
 	"github.com/coreos/coreos-cloudinit/config"
+	"github.com/coreos/coreos-cloudinit/network"
 	"github.com/coreos/coreos-cloudinit/system"
 )
 
@@ -28,103 +30,272 @@ type TestUnitManager struct {
 	enabled  []string
 	masked   []string
 	unmasked []string
-	commands map[string]string
+	commands []UnitAction
 	reload   bool
 }
 
-func (tum *TestUnitManager) PlaceUnit(unit *system.Unit, dst string) error {
-	tum.placed = append(tum.placed, unit.Name)
+type UnitAction struct {
+	unit    string
+	command string
+}
+
+func (tum *TestUnitManager) PlaceUnit(u system.Unit) error {
+	tum.placed = append(tum.placed, u.Name)
 	return nil
 }
-func (tum *TestUnitManager) EnableUnitFile(unit string, runtime bool) error {
-	tum.enabled = append(tum.enabled, unit)
+func (tum *TestUnitManager) PlaceUnitDropIn(u system.Unit, d config.UnitDropIn) error {
+	tum.placed = append(tum.placed, u.Name+".d/"+d.Name)
 	return nil
 }
-func (tum *TestUnitManager) RunUnitCommand(command, unit string) (string, error) {
-	tum.commands = make(map[string]string)
-	tum.commands[unit] = command
+func (tum *TestUnitManager) EnableUnitFile(u system.Unit) error {
+	tum.enabled = append(tum.enabled, u.Name)
+	return nil
+}
+func (tum *TestUnitManager) RunUnitCommand(u system.Unit, c string) (string, error) {
+	tum.commands = append(tum.commands, UnitAction{u.Name, c})
 	return "", nil
 }
 func (tum *TestUnitManager) DaemonReload() error {
 	tum.reload = true
 	return nil
 }
-func (tum *TestUnitManager) MaskUnit(unit *system.Unit) error {
-	tum.masked = append(tum.masked, unit.Name)
+func (tum *TestUnitManager) MaskUnit(u system.Unit) error {
+	tum.masked = append(tum.masked, u.Name)
 	return nil
 }
-func (tum *TestUnitManager) UnmaskUnit(unit *system.Unit) error {
-	tum.unmasked = append(tum.unmasked, unit.Name)
+func (tum *TestUnitManager) UnmaskUnit(u system.Unit) error {
+	tum.unmasked = append(tum.unmasked, u.Name)
 	return nil
 }
 
+type mockInterface struct {
+	name           string
+	filename       string
+	netdev         string
+	link           string
+	network        string
+	kind           string
+	modprobeParams string
+}
+
+func (i mockInterface) Name() string {
+	return i.name
+}
+
+func (i mockInterface) Filename() string {
+	return i.filename
+}
+
+func (i mockInterface) Netdev() string {
+	return i.netdev
+}
+
+func (i mockInterface) Link() string {
+	return i.link
+}
+
+func (i mockInterface) Network() string {
+	return i.network
+}
+
+func (i mockInterface) Type() string {
+	return i.kind
+}
+
+func (i mockInterface) ModprobeParams() string {
+	return i.modprobeParams
+}
+
+func TestCreateNetworkingUnits(t *testing.T) {
+	for _, tt := range []struct {
+		interfaces []network.InterfaceGenerator
+		expect     []system.Unit
+	}{
+		{nil, nil},
+		{
+			[]network.InterfaceGenerator{
+				network.InterfaceGenerator(mockInterface{filename: "test"}),
+			},
+			nil,
+		},
+		{
+			[]network.InterfaceGenerator{
+				network.InterfaceGenerator(mockInterface{filename: "test1", netdev: "test netdev"}),
+				network.InterfaceGenerator(mockInterface{filename: "test2", link: "test link"}),
+				network.InterfaceGenerator(mockInterface{filename: "test3", network: "test network"}),
+			},
+			[]system.Unit{
+				system.Unit{Unit: config.Unit{Name: "test1.netdev", Runtime: true, Content: "test netdev"}},
+				system.Unit{Unit: config.Unit{Name: "test2.link", Runtime: true, Content: "test link"}},
+				system.Unit{Unit: config.Unit{Name: "test3.network", Runtime: true, Content: "test network"}},
+			},
+		},
+		{
+			[]network.InterfaceGenerator{
+				network.InterfaceGenerator(mockInterface{filename: "test", netdev: "test netdev", link: "test link", network: "test network"}),
+			},
+			[]system.Unit{
+				system.Unit{Unit: config.Unit{Name: "test.netdev", Runtime: true, Content: "test netdev"}},
+				system.Unit{Unit: config.Unit{Name: "test.link", Runtime: true, Content: "test link"}},
+				system.Unit{Unit: config.Unit{Name: "test.network", Runtime: true, Content: "test network"}},
+			},
+		},
+	} {
+		units := createNetworkingUnits(tt.interfaces)
+		if !reflect.DeepEqual(tt.expect, units) {
+			t.Errorf("bad units (%+v): want %#v, got %#v", tt.interfaces, tt.expect, units)
+		}
+	}
+}
+
 func TestProcessUnits(t *testing.T) {
-	tum := &TestUnitManager{}
-	units := []system.Unit{
+	tests := []struct {
+		units []system.Unit
+
+		result TestUnitManager
+	}{
+		{
+			units: []system.Unit{
 				system.Unit{Unit: config.Unit{
 					Name: "foo",
 					Mask: true,
 				}},
-	}
-	if err := processUnits(units, "", tum); err != nil {
-		t.Fatalf("unexpected error calling processUnits: %v", err)
-	}
-	if len(tum.masked) != 1 || tum.masked[0] != "foo" {
-		t.Errorf("expected foo to be masked, but found %v", tum.masked)
-	}
-
-	tum = &TestUnitManager{}
-	units = []system.Unit{
+			},
+			result: TestUnitManager{
+				masked: []string{"foo"},
+			},
+		},
+		{
+			units: []system.Unit{
+				system.Unit{Unit: config.Unit{
+					Name:    "baz.service",
+					Content: "[Service]\nExecStart=/bin/baz",
+					Command: "start",
+				}},
+				system.Unit{Unit: config.Unit{
+					Name:    "foo.network",
+					Content: "[Network]\nFoo=true",
+				}},
 				system.Unit{Unit: config.Unit{
 					Name:    "bar.network",
+					Content: "[Network]\nBar=true",
 				}},
-	}
-	if err := processUnits(units, "", tum); err != nil {
-		t.Fatalf("unexpected error calling processUnits: %v", err)
-	}
-	if _, ok := tum.commands["systemd-networkd.service"]; !ok {
-		t.Errorf("expected systemd-networkd.service to be reloaded!")
-	}
-
-	tum = &TestUnitManager{}
-	units = []system.Unit{
+			},
+			result: TestUnitManager{
+				placed: []string{"baz.service", "foo.network", "bar.network"},
+				commands: []UnitAction{
+					UnitAction{"systemd-networkd.service", "restart"},
+					UnitAction{"baz.service", "start"},
+				},
+				reload: true,
+			},
+		},
+		{
+			units: []system.Unit{
 				system.Unit{Unit: config.Unit{
 					Name:    "baz.service",
 					Content: "[Service]\nExecStart=/bin/true",
 				}},
-	}
-	if err := processUnits(units, "", tum); err != nil {
-		t.Fatalf("unexpected error calling processUnits: %v", err)
-	}
-	if len(tum.placed) != 1 || tum.placed[0] != "baz.service" {
-		t.Fatalf("expected baz.service to be written, but got %v", tum.placed)
-	}
-
-	tum = &TestUnitManager{}
-	units = []system.Unit{
+			},
+			result: TestUnitManager{
+				placed: []string{"baz.service"},
+				reload: true,
+			},
+		},
+		{
+			units: []system.Unit{
 				system.Unit{Unit: config.Unit{
 					Name:    "locksmithd.service",
 					Runtime: true,
 				}},
-	}
-	if err := processUnits(units, "", tum); err != nil {
-		t.Fatalf("unexpected error calling processUnits: %v", err)
-	}
-	if len(tum.unmasked) != 1 || tum.unmasked[0] != "locksmithd.service" {
-		t.Fatalf("expected locksmithd.service to be unmasked, but got %v", tum.unmasked)
-	}
-
-	tum = &TestUnitManager{}
-	units = []system.Unit{
+			},
+			result: TestUnitManager{
+				unmasked: []string{"locksmithd.service"},
+			},
+		},
+		{
+			units: []system.Unit{
 				system.Unit{Unit: config.Unit{
 					Name:   "woof",
 					Enable: true,
 				}},
+			},
+			result: TestUnitManager{
+				enabled: []string{"woof"},
+			},
+		},
+		{
+			units: []system.Unit{
+				system.Unit{Unit: config.Unit{
+					Name:    "hi.service",
+					Runtime: true,
+					Content: "[Service]\nExecStart=/bin/echo hi",
+					DropIns: []config.UnitDropIn{
+						{
+							Name:    "lo.conf",
+							Content: "[Service]\nExecStart=/bin/echo lo",
+						},
+						{
+							Name:    "bye.conf",
+							Content: "[Service]\nExecStart=/bin/echo bye",
+						},
+					},
+				}},
+			},
+			result: TestUnitManager{
+				placed:   []string{"hi.service", "hi.service.d/lo.conf", "hi.service.d/bye.conf"},
+				unmasked: []string{"hi.service"},
+				reload:   true,
+			},
+		},
+		{
+			units: []system.Unit{
+				system.Unit{Unit: config.Unit{
+					DropIns: []config.UnitDropIn{
+						{
+							Name:    "lo.conf",
+							Content: "[Service]\nExecStart=/bin/echo lo",
+						},
+					},
+				}},
+			},
+			result: TestUnitManager{},
+		},
+		{
+			units: []system.Unit{
+				system.Unit{Unit: config.Unit{
+					Name: "hi.service",
+					DropIns: []config.UnitDropIn{
+						{
+							Content: "[Service]\nExecStart=/bin/echo lo",
+						},
+					},
+				}},
+			},
+			result: TestUnitManager{},
+		},
+		{
+			units: []system.Unit{
+				system.Unit{Unit: config.Unit{
+					Name: "hi.service",
+					DropIns: []config.UnitDropIn{
+						{
+							Name: "lo.conf",
+						},
+					},
+				}},
+			},
+			result: TestUnitManager{},
+		},
 	}
-	if err := processUnits(units, "", tum); err != nil {
-		t.Fatalf("unexpected error calling processUnits: %v", err)
+
+	for _, tt := range tests {
+		tum := &TestUnitManager{}
+		if err := processUnits(tt.units, "", tum); err != nil {
+			t.Errorf("bad error (%+v): want nil, got %s", tt.units, err)
+		}
+		if !reflect.DeepEqual(tt.result, *tum) {
+			t.Errorf("bad result (%+v): want %+v, got %+v", tt.units, tt.result, tum)
 		}
-	if len(tum.enabled) != 1 || tum.enabled[0] != "woof" {
-		t.Fatalf("expected woof to be enabled, but got %v", tum.enabled)
 	}
 }

initialize/user_data.go

@@ -17,32 +17,25 @@
 package initialize
 
 import (
-	"fmt"
+	"errors"
 	"log"
-	"strings"
 
 	"github.com/coreos/coreos-cloudinit/config"
-	"github.com/coreos/coreos-cloudinit/system"
 )
 
 func ParseUserData(contents string) (interface{}, error) {
 	if len(contents) == 0 {
 		return nil, nil
 	}
-	header := strings.SplitN(contents, "\n", 2)[0]
 
-	// Explicitly trim the header so we can handle user-data from
-	// non-unix operating systems. The rest of the file is parsed
-	// by yaml, which correctly handles CRLF.
-	header = strings.TrimSpace(header)
-
-	if strings.HasPrefix(header, "#!") {
+	switch {
+	case config.IsScript(contents):
 		log.Printf("Parsing user-data as script")
-		return system.Script(contents), nil
-	} else if header == "#cloud-config" {
+		return config.NewScript(contents)
+	case config.IsCloudConfig(contents):
 		log.Printf("Parsing user-data as cloud-config")
 		return config.NewCloudConfig(contents)
-	} else {
-		return nil, fmt.Errorf("Unrecognized user-data header: %s", header)
+	default:
+		return nil, errors.New("Unrecognized user-data format")
 	}
 }

initialize/workspace.go

@@ -38,7 +38,7 @@ func PrepWorkspace(workspace string) error {
 	return nil
 }
 
-func PersistScriptInWorkspace(script system.Script, workspace string) (string, error) {
+func PersistScriptInWorkspace(script config.Script, workspace string) (string, error) {
 	scriptsPath := path.Join(workspace, "scripts")
 	tmp, err := ioutil.TempFile(scriptsPath, "")
 	if err != nil {

system/env.go

@@ -19,24 +19,36 @@ package system
 import (
 	"fmt"
 	"reflect"
+
+	"github.com/coreos/coreos-cloudinit/config"
 )
 
-// dropinContents generates the contents for a drop-in unit given the config.
+// serviceContents generates the contents for a drop-in unit given the config.
 // The argument must be a struct from the 'config' package.
-func dropinContents(e interface{}) string {
+func serviceContents(e interface{}) string {
+	vars := getEnvVars(e)
+	if len(vars) == 0 {
+		return ""
+	}
+
+	out := "[Service]\n"
+	for _, v := range vars {
+		out += fmt.Sprintf("Environment=\"%s\"\n", v)
+	}
+	return out
+}
+
+func getEnvVars(e interface{}) []string {
 	et := reflect.TypeOf(e)
 	ev := reflect.ValueOf(e)
 
-	var out string
+	vars := []string{}
 	for i := 0; i < et.NumField(); i++ {
-		if val := ev.Field(i).String(); val != "" {
+		if val := ev.Field(i).Interface(); !config.IsZero(val) {
 			key := et.Field(i).Tag.Get("env")
-			out += fmt.Sprintf("Environment=\"%s=%s\"\n", key, val)
+			vars = append(vars, fmt.Sprintf("%s=%v", key, val))
 		}
 	}
 
-	if out == "" {
-		return ""
-	}
-	return "[Service]\n" + out
+	return vars
 }

system/env_test.go

@@ -0,0 +1,55 @@
+package system
+
+import (
+	"testing"
+)
+
+func TestServiceContents(t *testing.T) {
+	tests := []struct {
+		Config   interface{}
+		Contents string
+	}{
+		{
+			struct{}{},
+			"",
+		},
+		{
+			struct {
+				A string  `env:"A"`
+				B int     `env:"B"`
+				C bool    `env:"C"`
+				D float64 `env:"D"`
+			}{
+				"hi", 1, true, 0.12345,
+			},
+			`[Service]
+Environment="A=hi"
+Environment="B=1"
+Environment="C=true"
+Environment="D=0.12345"
+`,
+		},
+		{
+			struct {
+				A float64 `env:"A"`
+				B float64 `env:"B"`
+				C float64 `env:"C"`
+				D float64 `env:"D"`
+			}{
+				0.000001, 1, 0.9999999, 0.1,
+			},
+			`[Service]
+Environment="A=1e-06"
+Environment="B=1"
+Environment="C=0.9999999"
+Environment="D=0.1"
+`,
+		},
+	}
+
+	for _, tt := range tests {
+		if c := serviceContents(tt.Config); c != tt.Contents {
+			t.Errorf("bad contents (%+v): want %q, got %q", tt, tt.Contents, c)
+		}
+	}
+}

system/etcd.go

@@ -28,14 +28,12 @@ type Etcd struct {
 
 // Units creates a Unit file drop-in for etcd, using any configured options.
 func (ee Etcd) Units() []Unit {
-	content := dropinContents(ee.Etcd)
-	if content == "" {
-		return nil
-	}
 	return []Unit{{config.Unit{
 		Name:    "etcd.service",
 		Runtime: true,
-		DropIn:  true,
-		Content: content,
+		DropIns: []config.UnitDropIn{{
+			Name:    "20-cloudinit.conf",
+			Content: serviceContents(ee.Etcd),
+		}},
 	}}}
 }

system/etcd_test.go

@@ -30,7 +30,11 @@ func TestEtcdUnits(t *testing.T) {
 	}{
 		{
 			config.Etcd{},
-			nil,
+			[]Unit{{config.Unit{
+				Name:    "etcd.service",
+				Runtime: true,
+				DropIns: []config.UnitDropIn{{Name: "20-cloudinit.conf"}},
+			}}},
 		},
 		{
 			config.Etcd{
@@ -40,11 +44,13 @@ func TestEtcdUnits(t *testing.T) {
 			[]Unit{{config.Unit{
 				Name:    "etcd.service",
 				Runtime: true,
-				DropIn:  true,
+				DropIns: []config.UnitDropIn{{
+					Name: "20-cloudinit.conf",
 					Content: `[Service]
 Environment="ETCD_DISCOVERY=http://disco.example.com/foobar"
 Environment="ETCD_PEER_BIND_ADDR=127.0.0.1:7002"
 `,
+				}},
 			}}},
 		},
 		{
@@ -56,18 +62,20 @@ Environment="ETCD_PEER_BIND_ADDR=127.0.0.1:7002"
 			[]Unit{{config.Unit{
 				Name:    "etcd.service",
 				Runtime: true,
-				DropIn:  true,
+				DropIns: []config.UnitDropIn{{
+					Name: "20-cloudinit.conf",
 					Content: `[Service]
 Environment="ETCD_DISCOVERY=http://disco.example.com/foobar"
 Environment="ETCD_NAME=node001"
 Environment="ETCD_PEER_BIND_ADDR=127.0.0.1:7002"
 `,
+				}},
 			}}},
 		},
 	} {
 		units := Etcd{tt.config}.Units()
 		if !reflect.DeepEqual(tt.units, units) {
-			t.Errorf("bad units (%q): want %#v, got %#v", tt.config, tt.units, units)
+			t.Errorf("bad units (%+v): want %#v, got %#v", tt.config, tt.units, units)
 		}
 	}
 }

system/file.go

@@ -17,9 +17,9 @@
 package system
 
 import (
-	"errors"
 	"fmt"
 	"io/ioutil"
+	"log"
 	"os"
 	"os/exec"
 	"path"
@@ -39,21 +39,24 @@ func (f *File) Permissions() (os.FileMode, error) {
 		return os.FileMode(0644), nil
 	}
 
-	// Parse string representation of file mode as octal
+	// Parse string representation of file mode as integer
 	perm, err := strconv.ParseInt(f.RawFilePermissions, 8, 32)
 	if err != nil {
-		return 0, errors.New("Unable to parse file permissions as octal integer")
+		return 0, fmt.Errorf("Unable to parse file permissions %q as integer", f.RawFilePermissions)
 	}
 	return os.FileMode(perm), nil
 }
 
 func WriteFile(f *File, root string) (string, error) {
-	if f.Encoding != "" {
-		return "", fmt.Errorf("Unable to write file with encoding %s", f.Encoding)
-	}
-
 	fullpath := path.Join(root, f.Path)
 	dir := path.Dir(fullpath)
+	log.Printf("Writing file to %q", fullpath)
+
+	content, err := config.DecodeContent(f.Content, f.Encoding)
+
+	if err != nil {
+		return "", fmt.Errorf("Unable to decode %s (%v)", f.Path, err)
+	}
 
 	if err := EnsureDirectoryExists(dir); err != nil {
 		return "", err
@@ -70,7 +73,7 @@ func WriteFile(f *File, root string) (string, error) {
 		return "", err
 	}
 
-	if err := ioutil.WriteFile(tmp.Name(), []byte(f.Content), perm); err != nil {
+	if err := ioutil.WriteFile(tmp.Name(), content, perm); err != nil {
 		return "", err
 	}
 
@@ -95,6 +98,7 @@ func WriteFile(f *File, root string) (string, error) {
 		return "", err
 	}
 
+	log.Printf("Wrote file to %q", fullpath)
 	return fullpath, nil
 }
 

system/file_test.go

@@ -85,6 +85,38 @@ func TestWriteFileInvalidPermission(t *testing.T) {
 	}
 }
 
+func TestDecimalFilePermissions(t *testing.T) {
+	dir, err := ioutil.TempDir(os.TempDir(), "coreos-cloudinit-")
+	if err != nil {
+		t.Fatalf("Unable to create tempdir: %v", err)
+	}
+	defer os.RemoveAll(dir)
+
+	fn := "foo"
+	fullPath := path.Join(dir, fn)
+
+	wf := File{config.File{
+		Path:               fn,
+		RawFilePermissions: "744",
+	}}
+
+	path, err := WriteFile(&wf, dir)
+	if err != nil {
+		t.Fatalf("Processing of WriteFile failed: %v", err)
+	} else if path != fullPath {
+		t.Fatalf("WriteFile returned bad path: want %s, got %s", fullPath, path)
+	}
+
+	fi, err := os.Stat(fullPath)
+	if err != nil {
+		t.Fatalf("Unable to stat file: %v", err)
+	}
+
+	if fi.Mode() != os.FileMode(0744) {
+		t.Errorf("File has incorrect mode: %v", fi.Mode())
+	}
+}
+
 func TestWriteFilePermissions(t *testing.T) {
 	dir, err := ioutil.TempDir(os.TempDir(), "coreos-cloudinit-")
 	if err != nil {
@@ -124,10 +156,97 @@ func TestWriteFileEncodedContent(t *testing.T) {
 	}
 	defer os.RemoveAll(dir)
 
+	//all of these decode to "bar"
+	content_tests := map[string]string{
+		"base64":      "YmFy",
+		"b64":         "YmFy",
+		"gz":          "\x1f\x8b\x08\x08w\x14\x87T\x02\xffok\x00KJ,\x02\x00\xaa\x8c\xffv\x03\x00\x00\x00",
+		"gzip":        "\x1f\x8b\x08\x08w\x14\x87T\x02\xffok\x00KJ,\x02\x00\xaa\x8c\xffv\x03\x00\x00\x00",
+		"gz+base64":   "H4sIABMVh1QAA0tKLAIAqoz/dgMAAAA=",
+		"gzip+base64": "H4sIABMVh1QAA0tKLAIAqoz/dgMAAAA=",
+		"gz+b64":      "H4sIABMVh1QAA0tKLAIAqoz/dgMAAAA=",
+		"gzip+b64":    "H4sIABMVh1QAA0tKLAIAqoz/dgMAAAA=",
+	}
+
+	for encoding, content := range content_tests {
+		fullPath := path.Join(dir, encoding)
+
+		wf := File{config.File{
+			Path:               encoding,
+			Encoding:           encoding,
+			Content:            content,
+			RawFilePermissions: "0644",
+		}}
+
+		path, err := WriteFile(&wf, dir)
+		if err != nil {
+			t.Fatalf("Processing of WriteFile failed: %v", err)
+		} else if path != fullPath {
+			t.Fatalf("WriteFile returned bad path: want %s, got %s", fullPath, path)
+		}
+
+		fi, err := os.Stat(fullPath)
+		if err != nil {
+			t.Fatalf("Unable to stat file: %v", err)
+		}
+
+		if fi.Mode() != os.FileMode(0644) {
+			t.Errorf("File has incorrect mode: %v", fi.Mode())
+		}
+
+		contents, err := ioutil.ReadFile(fullPath)
+		if err != nil {
+			t.Fatalf("Unable to read expected file: %v", err)
+		}
+
+		if string(contents) != "bar" {
+			t.Fatalf("File has incorrect contents: '%s'", contents)
+		}
+	}
+}
+
+func TestWriteFileInvalidEncodedContent(t *testing.T) {
+	dir, err := ioutil.TempDir(os.TempDir(), "coreos-cloudinit-")
+	if err != nil {
+		t.Fatalf("Unable to create tempdir: %v", err)
+	}
+	defer os.RemoveAll(dir)
+
+	content_encodings := []string{
+		"base64",
+		"b64",
+		"gz",
+		"gzip",
+		"gz+base64",
+		"gzip+base64",
+		"gz+b64",
+		"gzip+b64",
+	}
+
+	for _, encoding := range content_encodings {
 		wf := File{config.File{
 			Path:     path.Join(dir, "tmp", "foo"),
-		Content:  "",
-		Encoding: "base64",
+			Content:  "@&*#%invalid data*@&^#*&",
+			Encoding: encoding,
+		}}
+
+		if _, err := WriteFile(&wf, dir); err == nil {
+			t.Fatalf("Expected error to be raised when writing file with encoding")
+		}
+	}
+}
+
+func TestWriteFileUnknownEncodedContent(t *testing.T) {
+	dir, err := ioutil.TempDir(os.TempDir(), "coreos-cloudinit-")
+	if err != nil {
+		t.Fatalf("Unable to create tempdir: %v", err)
+	}
+	defer os.RemoveAll(dir)
+
+	wf := File{config.File{
+		Path:     path.Join(dir, "tmp", "foo"),
+		Content:  "",
+		Encoding: "no-such-encoding",
 	}}
 
 	if _, err := WriteFile(&wf, dir); err == nil {

system/flannel.go

@@ -0,0 +1,30 @@
+package system
+
+import (
+	"path"
+	"strings"
+
+	"github.com/coreos/coreos-cloudinit/config"
+)
+
+// flannel is a top-level structure which embeds its underlying configuration,
+// config.Flannel, and provides the system-specific Unit().
+type Flannel struct {
+	config.Flannel
+}
+
+func (fl Flannel) envVars() string {
+	return strings.Join(getEnvVars(fl.Flannel), "\n")
+}
+
+func (fl Flannel) File() (*File, error) {
+	vars := fl.envVars()
+	if vars == "" {
+		return nil, nil
+	}
+	return &File{config.File{
+		Path:               path.Join("run", "flannel", "options.env"),
+		RawFilePermissions: "0644",
+		Content:            vars,
+	}}, nil
+}

system/flannel_test.go

@@ -0,0 +1,62 @@
+package system
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/coreos/coreos-cloudinit/config"
+)
+
+func TestFlannelEnvVars(t *testing.T) {
+	for _, tt := range []struct {
+		config   config.Flannel
+		contents string
+	}{
+		{
+			config.Flannel{},
+			"",
+		},
+		{
+			config.Flannel{
+				EtcdEndpoints: "http://12.34.56.78:4001",
+				EtcdPrefix:    "/coreos.com/network/tenant1",
+			},
+			`FLANNELD_ETCD_ENDPOINTS=http://12.34.56.78:4001
+FLANNELD_ETCD_PREFIX=/coreos.com/network/tenant1`,
+		},
+	} {
+		out := Flannel{tt.config}.envVars()
+		if out != tt.contents {
+			t.Errorf("bad contents (%+v): want %q, got %q", tt, tt.contents, out)
+		}
+	}
+}
+
+func TestFlannelFile(t *testing.T) {
+	for _, tt := range []struct {
+		config config.Flannel
+		file   *File
+	}{
+		{
+			config.Flannel{},
+			nil,
+		},
+		{
+			config.Flannel{
+				EtcdEndpoints: "http://12.34.56.78:4001",
+				EtcdPrefix:    "/coreos.com/network/tenant1",
+			},
+			&File{config.File{
+				Path:               "run/flannel/options.env",
+				RawFilePermissions: "0644",
+				Content: `FLANNELD_ETCD_ENDPOINTS=http://12.34.56.78:4001
+FLANNELD_ETCD_PREFIX=/coreos.com/network/tenant1`,
+			}},
+		},
+	} {
+		file, _ := Flannel{tt.config}.File()
+		if !reflect.DeepEqual(tt.file, file) {
+			t.Errorf("bad units (%q): want %#v, got %#v", tt.config, tt.file, file)
+		}
+	}
+}

system/fleet.go

@@ -29,14 +29,12 @@ type Fleet struct {
 // Units generates a Unit file drop-in for fleet, if any fleet options were
 // configured in cloud-config
 func (fe Fleet) Units() []Unit {
-	content := dropinContents(fe.Fleet)
-	if content == "" {
-		return nil
-	}
 	return []Unit{{config.Unit{
 		Name:    "fleet.service",
 		Runtime: true,
-		DropIn:  true,
-		Content: content,
+		DropIns: []config.UnitDropIn{{
+			Name:    "20-cloudinit.conf",
+			Content: serviceContents(fe.Fleet),
+		}},
 	}}}
 }

system/fleet_test.go

@@ -30,7 +30,11 @@ func TestFleetUnits(t *testing.T) {
 	}{
 		{
 			config.Fleet{},
-			nil,
+			[]Unit{{config.Unit{
+				Name:    "fleet.service",
+				Runtime: true,
+				DropIns: []config.UnitDropIn{{Name: "20-cloudinit.conf"}},
+			}}},
 		},
 		{
 			config.Fleet{
@@ -38,17 +42,19 @@ func TestFleetUnits(t *testing.T) {
 			},
 			[]Unit{{config.Unit{
 				Name:    "fleet.service",
+				Runtime: true,
+				DropIns: []config.UnitDropIn{{
+					Name: "20-cloudinit.conf",
 					Content: `[Service]
 Environment="FLEET_PUBLIC_IP=12.34.56.78"
 `,
-				Runtime: true,
-				DropIn:  true,
+				}},
 			}}},
 		},
 	} {
 		units := Fleet{tt.config}.Units()
 		if !reflect.DeepEqual(units, tt.units) {
-			t.Errorf("bad units (%q): want %#v, got %#v", tt.config, tt.units, units)
+			t.Errorf("bad units (%+v): want %#v, got %#v", tt.config, tt.units, units)
 		}
 	}
 }

system/locksmith.go

@@ -0,0 +1,39 @@
+/*
+   Copyright 2014 CoreOS, Inc.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package system
+
+import (
+	"github.com/coreos/coreos-cloudinit/config"
+)
+
+// Locksmith is a top-level structure which embeds its underlying configuration,
+// config.Locksmith, and provides the system-specific Unit().
+type Locksmith struct {
+	config.Locksmith
+}
+
+// Units creates a Unit file drop-in for etcd, using any configured options.
+func (ee Locksmith) Units() []Unit {
+	return []Unit{{config.Unit{
+		Name:    "locksmithd.service",
+		Runtime: true,
+		DropIns: []config.UnitDropIn{{
+			Name:    "20-cloudinit.conf",
+			Content: serviceContents(ee.Locksmith),
+		}},
+	}}}
+}

system/locksmith_test.go

@@ -0,0 +1,60 @@
+/*
+   Copyright 2014 CoreOS, Inc.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package system
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/coreos/coreos-cloudinit/config"
+)
+
+func TestLocksmithUnits(t *testing.T) {
+	for _, tt := range []struct {
+		config config.Locksmith
+		units  []Unit
+	}{
+		{
+			config.Locksmith{},
+			[]Unit{{config.Unit{
+				Name:    "locksmithd.service",
+				Runtime: true,
+				DropIns: []config.UnitDropIn{{Name: "20-cloudinit.conf"}},
+			}}},
+		},
+		{
+			config.Locksmith{
+				Endpoint: "12.34.56.78:4001",
+			},
+			[]Unit{{config.Unit{
+				Name:    "locksmithd.service",
+				Runtime: true,
+				DropIns: []config.UnitDropIn{{
+					Name: "20-cloudinit.conf",
+					Content: `[Service]
+Environment="LOCKSMITHD_ENDPOINT=12.34.56.78:4001"
+`,
+				}},
+			}}},
+		},
+	} {
+		units := Locksmith{tt.config}.Units()
+		if !reflect.DeepEqual(units, tt.units) {
+			t.Errorf("bad units (%+v): want %#v, got %#v", tt.config, tt.units, units)
+		}
+	}
+}

system/networkd.go

@@ -29,10 +29,6 @@ import (
 	"github.com/coreos/coreos-cloudinit/Godeps/_workspace/src/github.com/dotcloud/docker/pkg/netlink"
 )
 
-const (
-	runtimeNetworkPath = "/run/systemd/network"
-)
-
 func RestartNetwork(interfaces []network.InterfaceGenerator) (err error) {
 	defer func() {
 		if e := restartNetworkd(); e != nil {
@@ -96,33 +92,7 @@ func maybeProbeBonding(interfaces []network.InterfaceGenerator) error {
 
 func restartNetworkd() error {
 	log.Printf("Restarting networkd.service\n")
-	_, err := NewUnitManager("").RunUnitCommand("restart", "systemd-networkd.service")
-	return err
-}
-
-func WriteNetworkdConfigs(interfaces []network.InterfaceGenerator) error {
-	for _, iface := range interfaces {
-		filename := fmt.Sprintf("%s.netdev", iface.Filename())
-		if err := writeConfig(filename, iface.Netdev()); err != nil {
-			return err
-		}
-		filename = fmt.Sprintf("%s.link", iface.Filename())
-		if err := writeConfig(filename, iface.Link()); err != nil {
-			return err
-		}
-		filename = fmt.Sprintf("%s.network", iface.Filename())
-		if err := writeConfig(filename, iface.Network()); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func writeConfig(filename string, content string) error {
-	if content == "" {
-		return nil
-	}
-	log.Printf("Writing networkd unit %q\n", filename)
-	_, err := WriteFile(&File{config.File{Content: content, Path: filename}}, runtimeNetworkPath)
+	networkd := Unit{config.Unit{Name: "systemd-networkd.service"}}
+	_, err := NewUnitManager("").RunUnitCommand(networkd, "restart")
 	return err
 }

system/systemd.go

@@ -23,7 +23,6 @@ import (
 	"os"
 	"os/exec"
 	"path"
-	"path/filepath"
 	"strings"
 
 	"github.com/coreos/coreos-cloudinit/Godeps/_workspace/src/github.com/coreos/go-systemd/dbus"
@@ -42,49 +41,51 @@ type systemd struct {
 // never be used as a true MachineID
 const fakeMachineID = "42000000000000000000000000000042"
 
-// PlaceUnit writes a unit file at the provided destination, creating
-// parent directories as necessary.
-func (s *systemd) PlaceUnit(u *Unit, dst string) error {
-	dir := filepath.Dir(dst)
-	if _, err := os.Stat(dir); os.IsNotExist(err) {
-		if err := os.MkdirAll(dir, os.FileMode(0755)); err != nil {
-			return err
-		}
-	}
-
+// PlaceUnit writes a unit file at its desired destination, creating parent
+// directories as necessary.
+func (s *systemd) PlaceUnit(u Unit) error {
 	file := File{config.File{
-		Path:               filepath.Base(dst),
+		Path:               u.Destination(s.root),
 		Content:            u.Content,
 		RawFilePermissions: "0644",
 	}}
 
-	_, err := WriteFile(&file, dir)
-	if err != nil {
+	_, err := WriteFile(&file, "/")
 	return err
 }
 
-	return nil
+// PlaceUnitDropIn writes a unit drop-in file at its desired destination,
+// creating parent directories as necessary.
+func (s *systemd) PlaceUnitDropIn(u Unit, d config.UnitDropIn) error {
+	file := File{config.File{
+		Path:               u.DropInDestination(s.root, d),
+		Content:            d.Content,
+		RawFilePermissions: "0644",
+	}}
+
+	_, err := WriteFile(&file, "/")
+	return err
 }
 
-func (s *systemd) EnableUnitFile(unit string, runtime bool) error {
+func (s *systemd) EnableUnitFile(u Unit) error {
 	conn, err := dbus.New()
 	if err != nil {
 		return err
 	}
 
-	units := []string{unit}
-	_, _, err = conn.EnableUnitFiles(units, runtime, true)
+	units := []string{u.Name}
+	_, _, err = conn.EnableUnitFiles(units, u.Runtime, true)
 	return err
 }
 
-func (s *systemd) RunUnitCommand(command, unit string) (string, error) {
+func (s *systemd) RunUnitCommand(u Unit, c string) (string, error) {
 	conn, err := dbus.New()
 	if err != nil {
 		return "", err
 	}
 
 	var fn func(string, string) (string, error)
-	switch command {
+	switch c {
 	case "start":
 		fn = conn.StartUnit
 	case "stop":
@@ -100,10 +101,10 @@ func (s *systemd) RunUnitCommand(command, unit string) (string, error) {
 	case "reload-or-try-restart":
 		fn = conn.ReloadOrTryRestartUnit
 	default:
-		return "", fmt.Errorf("Unsupported systemd command %q", command)
+		return "", fmt.Errorf("Unsupported systemd command %q", c)
 	}
 
-	return fn(unit, "replace")
+	return fn(u.Name, "replace")
 }
 
 func (s *systemd) DaemonReload() error {
@@ -119,8 +120,8 @@ func (s *systemd) DaemonReload() error {
 // /dev/null, analogous to `systemctl mask`.
 // N.B.: Unlike `systemctl mask`, this function will *remove any existing unit
 // file at the location*, to ensure that the mask will succeed.
-func (s *systemd) MaskUnit(unit *Unit) error {
-	masked := unit.Destination(s.root)
+func (s *systemd) MaskUnit(u Unit) error {
+	masked := u.Destination(s.root)
 	if _, err := os.Stat(masked); os.IsNotExist(err) {
 		if err := os.MkdirAll(path.Dir(masked), os.FileMode(0755)); err != nil {
 			return err
@@ -134,8 +135,8 @@ func (s *systemd) MaskUnit(unit *Unit) error {
 // UnmaskUnit is analogous to systemd's unit_file_unmask. If the file
 // associated with the given Unit is empty or appears to be a symlink to
 // /dev/null, it is removed.
-func (s *systemd) UnmaskUnit(unit *Unit) error {
-	masked := unit.Destination(s.root)
+func (s *systemd) UnmaskUnit(u Unit) error {
+	masked := u.Destination(s.root)
 	ne, err := nullOrEmpty(masked)
 	if os.IsNotExist(err) {
 		return nil

system/systemd_test.go

@@ -17,6 +17,7 @@
 package system
 
 import (
+	"fmt"
 	"io/ioutil"
 	"os"
 	"path"
@@ -25,133 +26,109 @@ import (
 	"github.com/coreos/coreos-cloudinit/config"
 )
 
-func TestPlaceNetworkUnit(t *testing.T) {
-	u := Unit{config.Unit{
+func TestPlaceUnit(t *testing.T) {
+	tests := []config.Unit{
+		{
 			Name:    "50-eth0.network",
 			Runtime: true,
-		Content: `[Match]
-Name=eth47
-
-[Network]
-Address=10.209.171.177/19
-`,
-	}}
-
-	dir, err := ioutil.TempDir(os.TempDir(), "coreos-cloudinit-")
-	if err != nil {
-		t.Fatalf("Unable to create tempdir: %v", err)
-	}
-	defer os.RemoveAll(dir)
-
-	sd := &systemd{dir}
-
-	dst := u.Destination(dir)
-	expectDst := path.Join(dir, "run", "systemd", "network", "50-eth0.network")
-	if dst != expectDst {
-		t.Fatalf("unit.Destination returned %s, expected %s", dst, expectDst)
-	}
-
-	if err := sd.PlaceUnit(&u, dst); err != nil {
-		t.Fatalf("PlaceUnit failed: %v", err)
-	}
-
-	fi, err := os.Stat(dst)
-	if err != nil {
-		t.Fatalf("Unable to stat file: %v", err)
-	}
-
-	if fi.Mode() != os.FileMode(0644) {
-		t.Errorf("File has incorrect mode: %v", fi.Mode())
-	}
-
-	contents, err := ioutil.ReadFile(dst)
-	if err != nil {
-		t.Fatalf("Unable to read expected file: %v", err)
-	}
-
-	expectContents := `[Match]
-Name=eth47
-
-[Network]
-Address=10.209.171.177/19
-`
-	if string(contents) != expectContents {
-		t.Fatalf("File has incorrect contents '%s'.\nExpected '%s'", string(contents), expectContents)
-	}
-}
-
-func TestUnitDestination(t *testing.T) {
-	dir := "/some/dir"
-	name := "foobar.service"
-
-	u := Unit{config.Unit{
-		Name:   name,
-		DropIn: false,
-	}}
-
-	dst := u.Destination(dir)
-	expectDst := path.Join(dir, "etc", "systemd", "system", "foobar.service")
-	if dst != expectDst {
-		t.Errorf("unit.Destination returned %s, expected %s", dst, expectDst)
-	}
-
-	u.DropIn = true
-
-	dst = u.Destination(dir)
-	expectDst = path.Join(dir, "etc", "systemd", "system", "foobar.service.d", cloudConfigDropIn)
-	if dst != expectDst {
-		t.Errorf("unit.Destination returned %s, expected %s", dst, expectDst)
-	}
-}
-
-func TestPlaceMountUnit(t *testing.T) {
-	u := Unit{config.Unit{
+			Content: "[Match]\nName=eth47\n\n[Network]\nAddress=10.209.171.177/19\n",
+		},
+		{
 			Name:    "media-state.mount",
-		Runtime: false,
-		Content: `[Mount]
-What=/dev/sdb1
-Where=/media/state
-`,
-	}}
+			Content: "[Mount]\nWhat=/dev/sdb1\nWhere=/media/state\n",
+		},
+	}
 
+	for _, tt := range tests {
 		dir, err := ioutil.TempDir(os.TempDir(), "coreos-cloudinit-")
 		if err != nil {
-		t.Fatalf("Unable to create tempdir: %v", err)
+			panic(fmt.Sprintf("Unable to create tempdir: %v", err))
 		}
-	defer os.RemoveAll(dir)
 
+		u := Unit{tt}
 		sd := &systemd{dir}
 
-	dst := u.Destination(dir)
-	expectDst := path.Join(dir, "etc", "systemd", "system", "media-state.mount")
-	if dst != expectDst {
-		t.Fatalf("unit.Destination returned %s, expected %s", dst, expectDst)
+		if err := sd.PlaceUnit(u); err != nil {
+			t.Fatalf("PlaceUnit(): bad error (%+v): want nil, got %s", tt, err)
 		}
 
-	if err := sd.PlaceUnit(&u, dst); err != nil {
-		t.Fatalf("PlaceUnit failed: %v", err)
-	}
-
-	fi, err := os.Stat(dst)
+		fi, err := os.Stat(u.Destination(dir))
 		if err != nil {
-		t.Fatalf("Unable to stat file: %v", err)
+			t.Fatalf("Stat(): bad error (%+v): want nil, got %s", tt, err)
 		}
 
-	if fi.Mode() != os.FileMode(0644) {
-		t.Errorf("File has incorrect mode: %v", fi.Mode())
+		if mode := fi.Mode(); mode != os.FileMode(0644) {
+			t.Errorf("bad filemode (%+v): want %v, got %v", tt, os.FileMode(0644), mode)
 		}
 
-	contents, err := ioutil.ReadFile(dst)
+		c, err := ioutil.ReadFile(u.Destination(dir))
 		if err != nil {
-		t.Fatalf("Unable to read expected file: %v", err)
+			t.Fatalf("ReadFile(): bad error (%+v): want nil, got %s", tt, err)
 		}
 
-	expectContents := `[Mount]
-What=/dev/sdb1
-Where=/media/state
-`
-	if string(contents) != expectContents {
-		t.Fatalf("File has incorrect contents '%s'.\nExpected '%s'", string(contents), expectContents)
+		if string(c) != tt.Content {
+			t.Errorf("bad contents (%+v): want %q, got %q", tt, tt.Content, string(c))
+		}
+
+		os.RemoveAll(dir)
+	}
+}
+
+func TestPlaceUnitDropIn(t *testing.T) {
+	tests := []config.Unit{
+		{
+			Name:    "false.service",
+			Runtime: true,
+			DropIns: []config.UnitDropIn{
+				{
+					Name:    "00-true.conf",
+					Content: "[Service]\nExecStart=\nExecStart=/usr/bin/true\n",
+				},
+			},
+		},
+		{
+			Name: "true.service",
+			DropIns: []config.UnitDropIn{
+				{
+					Name:    "00-false.conf",
+					Content: "[Service]\nExecStart=\nExecStart=/usr/bin/false\n",
+				},
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		dir, err := ioutil.TempDir(os.TempDir(), "coreos-cloudinit-")
+		if err != nil {
+			panic(fmt.Sprintf("Unable to create tempdir: %v", err))
+		}
+
+		u := Unit{tt}
+		sd := &systemd{dir}
+
+		if err := sd.PlaceUnitDropIn(u, u.DropIns[0]); err != nil {
+			t.Fatalf("PlaceUnit(): bad error (%+v): want nil, got %s", tt, err)
+		}
+
+		fi, err := os.Stat(u.DropInDestination(dir, u.DropIns[0]))
+		if err != nil {
+			t.Fatalf("Stat(): bad error (%+v): want nil, got %s", tt, err)
+		}
+
+		if mode := fi.Mode(); mode != os.FileMode(0644) {
+			t.Errorf("bad filemode (%+v): want %v, got %v", tt, os.FileMode(0644), mode)
+		}
+
+		c, err := ioutil.ReadFile(u.DropInDestination(dir, u.DropIns[0]))
+		if err != nil {
+			t.Fatalf("ReadFile(): bad error (%+v): want nil, got %s", tt, err)
+		}
+
+		if string(c) != u.DropIns[0].Content {
+			t.Errorf("bad contents (%+v): want %q, got %q", tt, u.DropIns[0].Content, string(c))
+		}
+
+		os.RemoveAll(dir)
 	}
 }
 
@@ -180,7 +157,7 @@ func TestMaskUnit(t *testing.T) {
 	sd := &systemd{dir}
 
 	// Ensure mask works with units that do not currently exist
-	uf := &Unit{config.Unit{Name: "foo.service"}}
+	uf := Unit{config.Unit{Name: "foo.service"}}
 	if err := sd.MaskUnit(uf); err != nil {
 		t.Fatalf("Unable to mask new unit: %v", err)
 	}
@@ -194,7 +171,7 @@ func TestMaskUnit(t *testing.T) {
 	}
 
 	// Ensure mask works with unit files that already exist
-	ub := &Unit{config.Unit{Name: "bar.service"}}
+	ub := Unit{config.Unit{Name: "bar.service"}}
 	barPath := path.Join(dir, "etc", "systemd", "system", "bar.service")
 	if _, err := os.Create(barPath); err != nil {
 		t.Fatalf("Error creating new unit file: %v", err)
@@ -220,12 +197,12 @@ func TestUnmaskUnit(t *testing.T) {
 
 	sd := &systemd{dir}
 
-	nilUnit := &Unit{config.Unit{Name: "null.service"}}
+	nilUnit := Unit{config.Unit{Name: "null.service"}}
 	if err := sd.UnmaskUnit(nilUnit); err != nil {
 		t.Errorf("unexpected error from unmasking nonexistent unit: %v", err)
 	}
 
-	uf := &Unit{config.Unit{Name: "foo.service", Content: "[Service]\nExecStart=/bin/true"}}
+	uf := Unit{config.Unit{Name: "foo.service", Content: "[Service]\nExecStart=/bin/true"}}
 	dst := uf.Destination(dir)
 	if err := os.MkdirAll(path.Dir(dst), os.FileMode(0755)); err != nil {
 		t.Fatalf("Unable to create unit directory: %v", err)
@@ -245,7 +222,7 @@ func TestUnmaskUnit(t *testing.T) {
 		t.Errorf("unmask of non-empty unit mutated unit contents unexpectedly")
 	}
 
-	ub := &Unit{config.Unit{Name: "bar.service"}}
+	ub := Unit{config.Unit{Name: "bar.service"}}
 	dst = ub.Destination(dir)
 	if err := os.Symlink("/dev/null", dst); err != nil {
 		t.Fatalf("Unable to create masked unit: %v", err)

system/unit.go

@@ -19,42 +19,66 @@ package system
 import (
 	"fmt"
 	"path"
+	"path/filepath"
+	"strings"
 
 	"github.com/coreos/coreos-cloudinit/config"
 )
 
-// Name for drop-in service configuration files created by cloudconfig
-const cloudConfigDropIn = "20-cloudinit.conf"
-
 type UnitManager interface {
-	PlaceUnit(unit *Unit, dst string) error
-	EnableUnitFile(unit string, runtime bool) error
-	RunUnitCommand(command, unit string) (string, error)
+	PlaceUnit(unit Unit) error
+	PlaceUnitDropIn(unit Unit, dropIn config.UnitDropIn) error
+	EnableUnitFile(unit Unit) error
+	RunUnitCommand(unit Unit, command string) (string, error)
+	MaskUnit(unit Unit) error
+	UnmaskUnit(unit Unit) error
 	DaemonReload() error
-	MaskUnit(unit *Unit) error
-	UnmaskUnit(unit *Unit) error
 }
 
 // Unit is a top-level structure which embeds its underlying configuration,
-// config.Unit, and provides the system-specific Destination().
+// config.Unit, and provides the system-specific Destination(), Type(), and
+// Group().
 type Unit struct {
 	config.Unit
 }
 
-type Script []byte
+// Type returns the extension of the unit (everything that follows the final
+// period).
+func (u Unit) Type() string {
+	ext := filepath.Ext(u.Name)
+	return strings.TrimLeft(ext, ".")
+}
 
-// Destination builds the appropriate absolute file path for
-// the Unit. The root argument indicates the effective base
-// directory of the system (similar to a chroot).
-func (u *Unit) Destination(root string) string {
+// Group returns "network" or "system" depending on whether or not the unit is
+// a network unit or otherwise.
+func (u Unit) Group() string {
+	switch u.Type() {
+	case "network", "netdev", "link":
+		return "network"
+	default:
+		return "system"
+	}
+}
+
+// Destination builds the appropriate absolute file path for the Unit. The root
+// argument indicates the effective base directory of the system (similar to a
+// chroot).
+func (u Unit) Destination(root string) string {
+	return path.Join(u.prefix(root), u.Name)
+}
+
+// DropInDestination builds the appropriate absolute file path for the
+// UnitDropIn. The root argument indicates the effective base directory of the
+// system (similar to a chroot) and the dropIn argument is the UnitDropIn for
+// which the destination is being calculated.
+func (u Unit) DropInDestination(root string, dropIn config.UnitDropIn) string {
+	return path.Join(u.prefix(root), fmt.Sprintf("%s.d", u.Name), dropIn.Name)
+}
+
+func (u Unit) prefix(root string) string {
 	dir := "etc"
 	if u.Runtime {
 		dir = "run"
 	}
-
-	if u.DropIn {
-		return path.Join(root, dir, "systemd", u.Group(), fmt.Sprintf("%s.d", u.Name), cloudConfigDropIn)
-	} else {
-		return path.Join(root, dir, "systemd", u.Group(), u.Name)
-	}
+	return path.Join(root, dir, "systemd", u.Group())
 }

system/unit_test.go

@@ -0,0 +1,138 @@
+/*
+   Copyright 2014 CoreOS, Inc.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package system
+
+import (
+	"testing"
+
+	"github.com/coreos/coreos-cloudinit/config"
+)
+
+func TestType(t *testing.T) {
+	tests := []struct {
+		name string
+
+		typ string
+	}{
+		{},
+		{"test.service", "service"},
+		{"hello", ""},
+		{"lots.of.dots", "dots"},
+	}
+
+	for _, tt := range tests {
+		u := Unit{config.Unit{
+			Name: tt.name,
+		}}
+		if typ := u.Type(); tt.typ != typ {
+			t.Errorf("bad type (%+v): want %q, got %q", tt, tt.typ, typ)
+		}
+	}
+}
+
+func TestGroup(t *testing.T) {
+	tests := []struct {
+		name string
+
+		group string
+	}{
+		{"test.service", "system"},
+		{"test.link", "network"},
+		{"test.network", "network"},
+		{"test.netdev", "network"},
+		{"test.conf", "system"},
+	}
+
+	for _, tt := range tests {
+		u := Unit{config.Unit{
+			Name: tt.name,
+		}}
+		if group := u.Group(); tt.group != group {
+			t.Errorf("bad group (%+v): want %q, got %q", tt, tt.group, group)
+		}
+	}
+}
+
+func TestDestination(t *testing.T) {
+	tests := []struct {
+		root    string
+		name    string
+		runtime bool
+
+		destination string
+	}{
+		{
+			root:        "/some/dir",
+			name:        "foobar.service",
+			destination: "/some/dir/etc/systemd/system/foobar.service",
+		},
+		{
+			root:        "/some/dir",
+			name:        "foobar.service",
+			runtime:     true,
+			destination: "/some/dir/run/systemd/system/foobar.service",
+		},
+	}
+
+	for _, tt := range tests {
+		u := Unit{config.Unit{
+			Name:    tt.name,
+			Runtime: tt.runtime,
+		}}
+		if d := u.Destination(tt.root); tt.destination != d {
+			t.Errorf("bad destination (%+v): want %q, got %q", tt, tt.destination, d)
+		}
+	}
+}
+
+func TestDropInDestination(t *testing.T) {
+	tests := []struct {
+		root       string
+		unitName   string
+		dropInName string
+		runtime    bool
+
+		destination string
+	}{
+		{
+			root:        "/some/dir",
+			unitName:    "foo.service",
+			dropInName:  "bar.conf",
+			destination: "/some/dir/etc/systemd/system/foo.service.d/bar.conf",
+		},
+		{
+			root:        "/some/dir",
+			unitName:    "foo.service",
+			dropInName:  "bar.conf",
+			runtime:     true,
+			destination: "/some/dir/run/systemd/system/foo.service.d/bar.conf",
+		},
+	}
+
+	for _, tt := range tests {
+		u := Unit{config.Unit{
+			Name:    tt.unitName,
+			Runtime: tt.runtime,
+			DropIns: []config.UnitDropIn{{
+				Name: tt.dropInName,
+			}},
+		}}
+		if d := u.DropInDestination(tt.root, u.DropIns[0]); tt.destination != d {
+			t.Errorf("bad destination (%+v): want %q, got %q", tt, tt.destination, d)
+		}
+	}
+}

system/update.go

@@ -61,7 +61,7 @@ func (uc Update) File() (*File, error) {
 	if config.IsZero(uc.Update) {
 		return nil, nil
 	}
-	if err := config.AssertValid(uc.Update); err != nil {
+	if err := config.AssertStructValid(uc.Update); err != nil {
 		return nil, err
 	}
 

system/update_test.go

@@ -17,7 +17,6 @@
 package system
 
 import (
-	"errors"
 	"io"
 	"reflect"
 	"strings"
@@ -101,7 +100,7 @@ func TestUpdateFile(t *testing.T) {
 		},
 		{
 			config: config.Update{RebootStrategy: "wizzlewazzle"},
-			err:    errors.New("invalid value \"wizzlewazzle\" for option \"RebootStrategy\" (valid options: \"best-effort,etcd-lock,reboot,off\")"),
+			err:    &config.ErrorValid{Value: "wizzlewazzle", Field: "RebootStrategy", Valid: "^(best-effort|etcd-lock|reboot|off)$"},
 		},
 		{
 			config: config.Update{Group: "master", Server: "http://foo.com"},

test

@@ -15,6 +15,7 @@ source ./build
 
 declare -a TESTPKGS=(
 	config
+	config/validate
 	datasource
 	datasource/configdrive
 	datasource/file