Merge from trunk, and resolve conflict with nova/auth/ldapdriver.py

128 files changed, 3795 insertions, 3136 deletions

diff --git a/.mailmap b/.mailmap
index 2a6eb8d7d..8041e2341 100644
--- a/.mailmap
+++ b/.mailmap
@@ -19,6 +19,7 @@
 <mordred@inaugust.com> <mordred@hudson>
 <paul@openstack.org> <pvoccio@castor.local>
 <paul@openstack.org> <paul.voccio@rackspace.com>
+<soren.hansen@rackspace.com> <soren@linux2go.dk>
 <todd@ansolabs.com> <todd@lapex>
 <todd@ansolabs.com> <todd@rubidine.com>
 <vishvananda@gmail.com> <vishvananda@yahoo.com>
diff --git a/Authors b/Authors
index 62f0c49d5..0b048becb 100644
--- a/Authors
+++ b/Authors
@@ -3,8 +3,11 @@ Anne Gentle <anne@openstack.org>
 Anthony Young <sleepsonthefloor@gmail.com>
 Armando Migliaccio <Armando.Migliaccio@eu.citrix.com>
 Chris Behrens <cbehrens@codestud.com>
+Chmouel Boudjnah <chmouel@chmouel.com>
 Dean Troyer <dtroyer@gmail.com>
 Devin Carlen <devin.carlen@gmail.com>
+Ed Leafe <ed@leafe.com>
+Eldar Nugaev <enugaev@griddynamics.com>
 Eric Day <eday@oddments.org>
 Ewan Mellor <ewan.mellor@citrix.com>
 Hisaki Ohara <hisaki.ohara@intel.com>
@@ -12,6 +15,7 @@ Jay Pipes <jaypipes@gmail.com>
 Jesse Andrews <anotherjesse@gmail.com>
 Joe Heck <heckj@mac.com>
 Joel Moore <joelbm24@gmail.com>
+Jonathan Bryce <jbryce@jbryce.com>
 Josh Kearney <josh.kearney@rackspace.com>
 Joshua McKenty <jmckenty@gmail.com>
 Justin Santa Barbara <justin@fathomdb.com>
@@ -21,8 +25,11 @@ Monty Taylor <mordred@inaugust.com>
 Paul Voccio <paul@openstack.org>
 Rick Clark <rick@openstack.org>
 Ryan Lucio <rlucio@internap.com>
+Sandy Walsh <sandy.walsh@rackspace.com>
 Soren Hansen <soren.hansen@rackspace.com>
+Thierry Carrez <thierry@openstack.org>
 Todd Willey <todd@ansolabs.com>
+Trey Morris <trey.morris@rackspace.com>
 Vishvananda Ishaya <vishvananda@gmail.com>
 Youcef Laribi <Youcef.Laribi@eu.citrix.com>
 Zhixue Wu <Zhixue.Wu@citrix.com>
diff --git a/CA/geninter.sh b/CA/geninter.sh
index 7d6c280d5..1fbcc9e73 100755
--- a/CA/geninter.sh
+++ b/CA/geninter.sh
@@ -16,16 +16,24 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-# ARG is the id of the user
-export SUBJ="/C=US/ST=California/L=MountainView/O=AnsoLabs/OU=NovaDev/CN=customer-intCA-$1"
-mkdir INTER/$1
-cd INTER/$1
+# $1 is the id of the project and $2 is the subject of the cert
+NAME=$1
+SUBJ=$2
+mkdir -p projects/$NAME
+cd projects/$NAME
 cp ../../openssl.cnf.tmpl openssl.cnf
-sed -i -e s/%USERNAME%/$1/g openssl.cnf
+sed -i -e s/%USERNAME%/$NAME/g openssl.cnf
 mkdir certs crl newcerts private
+openssl req -new -x509 -extensions v3_ca -keyout private/cakey.pem -out cacert.pem -days 365 -config ./openssl.cnf -batch -nodes
 echo "10" > serial
 touch index.txt
-openssl genrsa -out private/cakey.pem 1024 -config ./openssl.cnf -batch -nodes
-openssl req -new -sha2 -key private/cakey.pem -out ../../reqs/inter$1.csr -batch -subj "$SUBJ"
-cd ../../
-openssl ca -extensions v3_ca -days 365 -out INTER/$1/cacert.pem -in reqs/inter$1.csr -config openssl.cnf -batch
+# NOTE(vish): Disabling intermediate ca's because we don't actually need them.
+#             It makes more sense to have each project have its own root ca.
+# openssl genrsa -out private/cakey.pem 1024 -config ./openssl.cnf -batch -nodes
+# openssl req -new -sha256 -key private/cakey.pem -out ../../reqs/inter$NAME.csr -batch -subj "$SUBJ"
+openssl ca -gencrl -config ./openssl.cnf -out crl.pem
+if [ "`id -u`" != "`grep nova /etc/passwd | cut -d':' -f3`" ]; then
+    sudo chown -R nova:nogroup .
+fi
+# cd ../../
+# openssl ca -extensions v3_ca -days 365 -out INTER/$NAME/cacert.pem -in reqs/inter$NAME.csr -config openssl.cnf -batch
diff --git a/CA/genrootca.sh b/CA/genrootca.sh
index 31976092e..8f2c3ee3f 100755
--- a/CA/genrootca.sh
+++ b/CA/genrootca.sh
@@ -25,4 +25,5 @@ else
     openssl req -new -x509 -extensions v3_ca -keyout private/cakey.pem -out cacert.pem -days 365 -config ./openssl.cnf -batch -nodes
     touch index.txt
     echo "10" > serial
+    openssl ca -gencrl -config ./openssl.cnf -out crl.pem
 fi
diff --git a/nova/tests/validator_unittest.py b/CA/genvpn.sh
index b5f1c0667..7e7db185d 100644..100755
--- a/nova/tests/validator_unittest.py
+++ b/CA/genvpn.sh
@@ -1,3 +1,4 @@
+#!/bin/bash
 # vim: tabstop=4 shiftwidth=4 softtabstop=4
 
 # Copyright 2010 United States Government as represented by the
@@ -16,27 +17,20 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-import logging
-import unittest
+# This gets zipped and run on the cloudpipe-managed OpenVPN server
+NAME=$1
+SUBJ=$2
 
-from nova import flags
-from nova import test
-from nova import validate
+mkdir -p projects/$NAME
+cd projects/$NAME
 
+# generate a server priv key
+openssl genrsa -out server.key 2048
 
-class ValidationTestCase(test.TrialTestCase):
-    def setUp(self):
-        super(ValidationTestCase, self).setUp()
+# generate a server CSR
+openssl req -new -key server.key -out server.csr -batch -subj "$SUBJ"
 
-    def tearDown(self):
-        super(ValidationTestCase, self).tearDown()
-
-    def test_type_validation(self):
-        self.assertTrue(type_case("foo", 5, 1))
-        self.assertRaises(TypeError, type_case, "bar", "5", 1)
-        self.assertRaises(TypeError, type_case, None, 5, 1)
-
-
-@validate.typetest(instanceid=str, size=int, number_of_instances=int)
-def type_case(instanceid, size, number_of_instances):
-    return True
+novauid=`getent passwd nova | awk -F: '{print $3}'`
+if [ ! -z "${novauid}" ] && [ "`id -u`" != "${novauid}" ]; then
+    sudo chown -R nova:nogroup .
+fi
diff --git a/CA/openssl.cnf.tmpl b/CA/openssl.cnf.tmpl
index 639b8e80a..dd81f1c2b 100644
--- a/CA/openssl.cnf.tmpl
+++ b/CA/openssl.cnf.tmpl
@@ -24,7 +24,6 @@ dir			= .
 
 [ ca ]
 default_ca		= CA_default
-unique_subject		= no
 
 [ CA_default ]
 serial			= $dir/serial
@@ -32,6 +31,8 @@ database		= $dir/index.txt
 new_certs_dir		= $dir/newcerts
 certificate		= $dir/cacert.pem
 private_key		= $dir/private/cakey.pem
+unique_subject		= no
+default_crl_days	= 365
 default_days		= 365
 default_md		= md5
 preserve		= no
diff --git a/CA/INTER/.gitignore b/CA/projects/.gitignore
index 72e8ffc0d..72e8ffc0d 100644
--- a/CA/INTER/.gitignore
+++ b/CA/projects/.gitignore
diff --git a/CA/INTER/.placeholder b/CA/projects/.placeholder
index e69de29bb..e69de29bb 100644
--- a/CA/INTER/.placeholder
+++ b/CA/projects/.placeholder
diff --git a/MANIFEST.in b/MANIFEST.in
index 982b727aa..199ce30b6 100644
--- a/MANIFEST.in
+++ b/MANIFEST.in
@@ -13,7 +13,7 @@ include nova/cloudpipe/client.ovpn.template
 include nova/compute/fakevirtinstance.xml
 include nova/compute/interfaces.template
 include nova/virt/interfaces.template
-include nova/virt/libvirt.*.xml.template
+include nova/virt/libvirt*.xml.template
 include nova/tests/CA/
 include nova/tests/CA/cacert.pem
 include nova/tests/CA/private/
diff --git a/bin/nova-api b/bin/nova-api
index a9c53dbcd..1c671201e 100755
--- a/bin/nova-api
+++ b/bin/nova-api
@@ -17,10 +17,10 @@
 #    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 #    See the License for the specific language governing permissions and
 #    limitations under the License.
-"""
-Nova API daemon.
-"""
 
+"""Starter script for Nova API."""
+
+import gettext
 import os
 import sys
 
@@ -32,9 +32,13 @@ possible_topdir = os.path.normpath(os.path.join(os.path.abspath(sys.argv[0]),
 if os.path.exists(os.path.join(possible_topdir, 'nova', '__init__.py')):
     sys.path.insert(0, possible_topdir)
 
+gettext.install('nova', unicode=1)
+
+from nova import api
 from nova import flags
 from nova import utils
-from nova import server
+from nova import wsgi
+
 
 FLAGS = flags.FLAGS
 flags.DEFINE_integer('osapi_port', 8774, 'OpenStack API port')
@@ -43,15 +47,10 @@ flags.DEFINE_integer('ec2api_port', 8773, 'EC2 API port')
 flags.DEFINE_string('ec2api_host', '0.0.0.0', 'EC2 API host')
 
 
-def main(_args):
-    from nova import api
-    from nova import wsgi
+if __name__ == '__main__':
+    utils.default_flagfile()
+    FLAGS(sys.argv)
     server = wsgi.Server()
     server.start(api.API('os'), FLAGS.osapi_port, host=FLAGS.osapi_host)
     server.start(api.API('ec2'), FLAGS.ec2api_port, host=FLAGS.ec2api_host)
     server.wait()
-
-
-if __name__ == '__main__':
-    utils.default_flagfile()
-    server.serve('nova-api', main)
diff --git a/bin/nova-combined b/bin/nova-combined
new file mode 100755
index 000000000..c6a04f7e9
--- /dev/null
+++ b/bin/nova-combined
@@ -0,0 +1,65 @@
+#!/usr/bin/env python
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2010 United States Government as represented by the
+# Administrator of the National Aeronautics and Space Administration.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+"""Combined starter script for Nova services."""
+
+import eventlet
+eventlet.monkey_patch()
+
+import os
+import sys
+
+# If ../nova/__init__.py exists, add ../ to Python search path, so that
+# it will override what happens to be installed in /usr/(local/)lib/python...
+possible_topdir = os.path.normpath(os.path.join(os.path.abspath(sys.argv[0]),
+                                   os.pardir,
+                                   os.pardir))
+if os.path.exists(os.path.join(possible_topdir, 'nova', '__init__.py')):
+    sys.path.insert(0, possible_topdir)
+
+from nova import api
+from nova import flags
+from nova import service
+from nova import utils
+from nova import wsgi
+
+
+FLAGS = flags.FLAGS
+flags.DEFINE_integer('osapi_port', 8774, 'OpenStack API port')
+flags.DEFINE_string('osapi_host', '0.0.0.0', 'OpenStack API host')
+flags.DEFINE_integer('ec2api_port', 8773, 'EC2 API port')
+flags.DEFINE_string('ec2api_host', '0.0.0.0', 'EC2 API host')
+
+
+if __name__ == '__main__':
+    utils.default_flagfile()
+    FLAGS(sys.argv)
+
+    compute = service.Service.create(binary='nova-compute')
+    network = service.Service.create(binary='nova-network')
+    volume = service.Service.create(binary='nova-volume')
+    scheduler = service.Service.create(binary='nova-scheduler')
+    #objectstore = service.Service.create(binary='nova-objectstore')
+
+    service.serve(compute, network, volume, scheduler)
+
+    server = wsgi.Server()
+    server.start(api.API('os'), FLAGS.osapi_port, host=FLAGS.osapi_host)
+    server.start(api.API('ec2'), FLAGS.ec2api_port, host=FLAGS.ec2api_host)
+    server.wait()
diff --git a/bin/nova-compute b/bin/nova-compute
index ac6378f75..d2d352da2 100755
--- a/bin/nova-compute
+++ b/bin/nova-compute
@@ -17,10 +17,12 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-"""
-  Twistd daemon for the nova compute nodes.
-"""
+"""Starter script for Nova Compute."""
 
+import eventlet
+eventlet.monkey_patch()
+
+import gettext
 import os
 import sys
 
@@ -32,14 +34,12 @@ possible_topdir = os.path.normpath(os.path.join(os.path.abspath(sys.argv[0]),
 if os.path.exists(os.path.join(possible_topdir, 'nova', '__init__.py')):
     sys.path.insert(0, possible_topdir)
 
+gettext.install('nova', unicode=1)
+
 from nova import service
-from nova import twistd
 from nova import utils
 
-
 if __name__ == '__main__':
     utils.default_flagfile()
-    twistd.serve(__file__)
-
-if __name__ == '__builtin__':
-    application = service.Service.create()  # pylint: disable=C0103
+    service.serve()
+    service.wait()
diff --git a/bin/nova-dhcpbridge b/bin/nova-dhcpbridge
index 17c62da0a..81b9b6dd3 100755
--- a/bin/nova-dhcpbridge
+++ b/bin/nova-dhcpbridge
@@ -21,6 +21,7 @@
 Handle lease database updates from DHCP servers.
 """
 
+import gettext
 import logging
 import os
 import sys
@@ -33,6 +34,8 @@ possible_topdir = os.path.normpath(os.path.join(os.path.abspath(sys.argv[0]),
 if os.path.exists(os.path.join(possible_topdir, 'nova', '__init__.py')):
     sys.path.insert(0, possible_topdir)
 
+gettext.install('nova', unicode=1)
+
 from nova import context
 from nova import db
 from nova import flags
diff --git a/bin/nova-import-canonical-imagestore b/bin/nova-import-canonical-imagestore
index 4ed9e8365..036b41e48 100755
--- a/bin/nova-import-canonical-imagestore
+++ b/bin/nova-import-canonical-imagestore
@@ -21,6 +21,7 @@
   Download images from Canonical Image Store
 """
 
+import gettext
 import json
 import os
 import tempfile
@@ -37,6 +38,8 @@ possible_topdir = os.path.normpath(os.path.join(os.path.abspath(sys.argv[0]),
 if os.path.exists(os.path.join(possible_topdir, 'nova', '__init__.py')):
     sys.path.insert(0, possible_topdir)
 
+gettext.install('nova', unicode=1)
+
 from nova import flags
 from nova import utils
 from nova.objectstore import image
diff --git a/bin/nova-instancemonitor b/bin/nova-instancemonitor
index 9b6c40e82..5dac3ffe6 100755
--- a/bin/nova-instancemonitor
+++ b/bin/nova-instancemonitor
@@ -21,6 +21,7 @@
   Daemon for Nova RRD based instance resource monitoring.
 """
 
+import gettext
 import os
 import logging
 import sys
@@ -34,6 +35,8 @@ possible_topdir = os.path.normpath(os.path.join(os.path.abspath(sys.argv[0]),
 if os.path.exists(os.path.join(possible_topdir, 'nova', '__init__.py')):
     sys.path.insert(0, possible_topdir)
 
+gettext.install('nova', unicode=1)
+
 from nova import utils
 from nova import twistd
 from nova.compute import monitor
diff --git a/bin/nova-manage b/bin/nova-manage
index 62eec8353..599e02a7e 100755
--- a/bin/nova-manage
+++ b/bin/nova-manage
@@ -53,6 +53,7 @@
   CLI interface for nova management.
 """
 
+import gettext
 import logging
 import os
 import sys
@@ -68,7 +69,10 @@ possible_topdir = os.path.normpath(os.path.join(os.path.abspath(sys.argv[0]),
 if os.path.exists(os.path.join(possible_topdir, 'nova', '__init__.py')):
     sys.path.insert(0, possible_topdir)
 
+gettext.install('nova', unicode=1)
+
 from nova import context
+from nova import crypto
 from nova import db
 from nova import exception
 from nova import flags
@@ -93,47 +97,43 @@ class VpnCommands(object):
         self.manager = manager.AuthManager()
         self.pipe = pipelib.CloudPipe()
 
-    def list(self):
-        """Print a listing of the VPNs for all projects."""
+    def list(self, project=None):
+        """Print a listing of the VPN data for one or all projects.
+
+        args: [project=all]"""
         print "%-12s\t" % 'project',
         print "%-20s\t" % 'ip:port',
+        print "%-20s\t" % 'private_ip',
         print "%s" % 'state'
-        for project in self.manager.get_projects():
+        if project:
+            projects = [self.manager.get_project(project)]
+        else:
+            projects = self.manager.get_projects()
+            # NOTE(vish): This hits the database a lot.  We could optimize
+            #             by getting all networks in one query and all vpns
+            #             in aother query, then doing lookups by project
+        for project in projects:
             print "%-12s\t" % project.name,
-
-            try:
-                s = "%s:%s" % (project.vpn_ip, project.vpn_port)
-            except exception.NotFound:
-                s = "None"
-            print "%-20s\t" % s,
-
-            vpn = self._vpn_for(project.id)
+            ipport = "%s:%s" % (project.vpn_ip, project.vpn_port)
+            print "%-20s\t" % ipport,
+            ctxt = context.get_admin_context()
+            vpn = db.instance_get_project_vpn(ctxt, project.id)
             if vpn:
-                command = "ping -c1 -w1 %s > /dev/null; echo $?"
-                out, _err = utils.execute(command % vpn['private_dns_name'],
-                                          check_exit_code=False)
-                if out.strip() == '0':
-                    net = 'up'
-                else:
-                    net = 'down'
-                print vpn['private_dns_name'],
-                print vpn['node_name'],
-                print vpn['instance_id'],
+                address = None
+                state = 'down'
+                if vpn.get('fixed_ip', None):
+                    address = vpn['fixed_ip']['address']
+                if project.vpn_ip and utils.vpn_ping(project.vpn_ip,
+                                                     project.vpn_port):
+                    state = 'up'
+                print address,
+                print vpn['host'],
+                print vpn['ec2_id'],
                 print vpn['state_description'],
-                print net
-
+                print state
             else:
                 print None
 
-    def _vpn_for(self, project_id):
-        """Get the VPN instance for a project ID."""
-        for instance in db.instance_get_all(context.get_admin_context()):
-            if (instance['image_id'] == FLAGS.vpn_image_id
-                and not instance['state_description'] in
-                    ['shutting_down', 'shutdown']
-                and instance['project_id'] == project_id):
-                return instance
-
     def spawn(self):
         """Run all VPNs."""
         for p in reversed(self.manager.get_projects()):
@@ -146,6 +146,21 @@ class VpnCommands(object):
         """Start the VPN for a given project."""
         self.pipe.launch_vpn_instance(project_id)
 
+    def change(self, project_id, ip, port):
+        """Change the ip and port for a vpn.
+
+        args: project, ip, port"""
+        project = self.manager.get_project(project_id)
+        if not project:
+            print 'No project %s' % (project_id)
+            return
+        admin = context.get_admin_context()
+        network_ref = db.project_get_network(admin, project_id)
+        db.network_update(admin,
+                          network_ref['id'],
+                          {'vpn_public_address': ip,
+                           'vpn_public_port': int(port)})
+
 
 class ShellCommands(object):
     def bpython(self):
@@ -292,6 +307,14 @@ class UserCommands(object):
             is_admin = False
         self.manager.modify_user(name, access_key, secret_key, is_admin)
 
+    def revoke(self, user_id, project_id=None):
+        """revoke certs for a user
+        arguments: user_id [project_id]"""
+        if project_id:
+            crypto.revoke_certs_by_user_and_project(user_id, project_id)
+        else:
+            crypto.revoke_certs_by_user(user_id)
+
 
 class ProjectCommands(object):
     """Class for managing projects."""
diff --git a/bin/nova-network b/bin/nova-network
index d1fb55261..0143846a7 100755
--- a/bin/nova-network
+++ b/bin/nova-network
@@ -17,10 +17,12 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-"""
-  Twistd daemon for the nova network nodes.
-"""
+"""Starter script for Nova Network."""
 
+import eventlet
+eventlet.monkey_patch()
+
+import gettext
 import os
 import sys
 
@@ -32,14 +34,12 @@ possible_topdir = os.path.normpath(os.path.join(os.path.abspath(sys.argv[0]),
 if os.path.exists(os.path.join(possible_topdir, 'nova', '__init__.py')):
     sys.path.insert(0, possible_topdir)
 
+gettext.install('nova', unicode=1)
+
 from nova import service
-from nova import twistd
 from nova import utils
 
-
 if __name__ == '__main__':
     utils.default_flagfile()
-    twistd.serve(__file__)
-
-if __name__ == '__builtin__':
-    application = service.Service.create()  # pylint: disable-msg=C0103
+    service.serve()
+    service.wait()
diff --git a/bin/nova-objectstore b/bin/nova-objectstore
index 00ae27af9..9fbe228a2 100755
--- a/bin/nova-objectstore
+++ b/bin/nova-objectstore
@@ -21,6 +21,7 @@
   Twisted daemon for nova objectstore. Supports S3 API.
 """
 
+import gettext
 import os
 import sys
 
@@ -32,6 +33,8 @@ possible_topdir = os.path.normpath(os.path.join(os.path.abspath(sys.argv[0]),
 if os.path.exists(os.path.join(possible_topdir, 'nova', '__init__.py')):
     sys.path.insert(0, possible_topdir)
 
+gettext.install('nova', unicode=1)
+
 from nova import flags
 from nova import utils
 from nova import twistd
diff --git a/bin/nova-scheduler b/bin/nova-scheduler
index 4d1a40cf1..f4c0eaed6 100755
--- a/bin/nova-scheduler
+++ b/bin/nova-scheduler
@@ -17,10 +17,12 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-"""
-  Twistd daemon for the nova scheduler nodes.
-"""
+"""Starter script for Nova Scheduler."""
 
+import eventlet
+eventlet.monkey_patch()
+
+import gettext
 import os
 import sys
 
@@ -32,14 +34,12 @@ possible_topdir = os.path.normpath(os.path.join(os.path.abspath(sys.argv[0]),
 if os.path.exists(os.path.join(possible_topdir, 'nova', '__init__.py')):
     sys.path.insert(0, possible_topdir)
 
+gettext.install('nova', unicode=1)
+
 from nova import service
-from nova import twistd
 from nova import utils
 
-
 if __name__ == '__main__':
     utils.default_flagfile()
-    twistd.serve(__file__)
-
-if __name__ == '__builtin__':
-    application = service.Service.create()
+    service.serve()
+    service.wait()
diff --git a/bin/nova-volume b/bin/nova-volume
index e7281d6c0..ad3ddc405 100755
--- a/bin/nova-volume
+++ b/bin/nova-volume
@@ -17,10 +17,12 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-"""
-  Twistd daemon for the nova volume nodes.
-"""
+"""Starter script for Nova Volume."""
 
+import eventlet
+eventlet.monkey_patch()
+
+import gettext
 import os
 import sys
 
@@ -32,14 +34,12 @@ possible_topdir = os.path.normpath(os.path.join(os.path.abspath(sys.argv[0]),
 if os.path.exists(os.path.join(possible_topdir, 'nova', '__init__.py')):
     sys.path.insert(0, possible_topdir)
 
+gettext.install('nova', unicode=1)
+
 from nova import service
-from nova import twistd
 from nova import utils
 
-
 if __name__ == '__main__':
     utils.default_flagfile()
-    twistd.serve(__file__)
-
-if __name__ == '__builtin__':
-    application = service.Service.create()  # pylint: disable-msg=C0103
+    service.serve()
+    service.wait()
diff --git a/contrib/nova.sh b/contrib/nova.sh
index 7eb934eca..30df4edb6 100755
--- a/contrib/nova.sh
+++ b/contrib/nova.sh
@@ -72,7 +72,7 @@ fi
 # You should only have to run this once
 if [ "$CMD" == "install" ]; then
     sudo apt-get install -y python-software-properties
-    sudo add-apt-repository ppa:nova-core/ppa
+    sudo add-apt-repository ppa:nova-core/trunk
     sudo apt-get update
     sudo apt-get install -y dnsmasq kpartx kvm gawk iptables ebtables
     sudo apt-get install -y user-mode-linux kvm libvirt-bin
diff --git a/doc/ext/nova_autodoc.py b/doc/ext/nova_autodoc.py
index 39aa2c2cf..5429bb656 100644
--- a/doc/ext/nova_autodoc.py
+++ b/doc/ext/nova_autodoc.py
@@ -1,5 +1,8 @@
+import gettext
 import os
 
+gettext.install('nova')
+
 from nova import utils
 
 def setup(app):
diff --git a/doc/source/adminguide/managing.networks.rst b/doc/source/adminguide/managing.networks.rst
index b8563637e..38c1cba78 100644
--- a/doc/source/adminguide/managing.networks.rst
+++ b/doc/source/adminguide/managing.networks.rst
@@ -23,7 +23,7 @@ In Nova, users organize their cloud resources in projects. A Nova project consis
 Nova Network Strategies
 -----------------------
 
-Currently, Nova supports three kinds of networks, implemented in three "Network Manager" types respectively: Flat Network Manager, Flat DHCP Network Manager, and VLAN Network Manager. The three kinds of networks can c-exist in a cloud system. However, the scheduler for selecting the type of network for a given project is not yet implemented. Here is a brief description of each of the different network strategies, with a focus on the VLAN Manager in a separate section. 
+Currently, Nova supports three kinds of networks, implemented in three "Network Manager" types respectively: Flat Network Manager, Flat DHCP Network Manager, and VLAN Network Manager. The three kinds of networks can co-exist in a cloud system. However, the scheduler for selecting the type of network for a given project is not yet implemented. Here is a brief description of each of the different network strategies, with a focus on the VLAN Manager in a separate section. 
 
 Read more about Nova network strategies here:
 
diff --git a/doc/source/adminguide/multi.node.install.rst b/doc/source/adminguide/multi.node.install.rst
index 1eed30c5b..fcb76c5e5 100644
--- a/doc/source/adminguide/multi.node.install.rst
+++ b/doc/source/adminguide/multi.node.install.rst
@@ -35,7 +35,6 @@ Requirements for a multi-node installation
 * For a recommended HA setup, consider a MySQL master/slave replication, with as many slaves as you like, and probably a heartbeat to kick one of the slaves into being a master if it dies.
 * For performance optimization, split reads and writes to the database. MySQL proxy is the easiest way to make this work if running MySQL.
 
-
 Assumptions
 ^^^^^^^^^^^
 
@@ -69,14 +68,14 @@ Step 1 Use apt-get to get the latest code
 
 It is highly likely that there will be errors when the nova services come up since they are not yet configured. Don't worry, you're only at step 1!
 
-Step 2 Setup configuration files (installed in /etc/nova)
+Step 2 Setup configuration file (installed in /etc/nova)
 ---------------------------------------------------------
 
 Note: CC_ADDR=<the external IP address of your cloud controller>
 
-1. These need to be defined in EACH configuration file
+Nova development has consolidated all .conf files to nova.conf as of November 2010. References to specific .conf files may be ignored.
 
-::
+#. These need to be defined in the nova.conf configuration file::
 
    --sql_connection=mysql://root:nova@$CC_ADDR/nova # location of nova sql db
    --s3_host=$CC_ADDR  # This is where nova is hosting the objectstore service, which
@@ -87,31 +86,14 @@ Note: CC_ADDR=<the external IP address of your cloud controller>
    --ec2_url=http://$CC_ADDR:8773/services/Cloud
    --network_manager=nova.network.manager.FlatManager # simple, no-vlan networking type
 
-
-2. nova-manage specific flags
-
-::
-
-   --fixed_range=<network/prefix>   # ip network to use for VM guests, ex 192.168.2.64/26
-   --network_size=<# of addrs>      # number of ip addrs to use for VM guests, ex 64
-
-
-3. nova-network specific flags
-
-::
-
    --fixed_range=<network/prefix>   # ip network to use for VM guests, ex 192.168.2.64/26
    --network_size=<# of addrs>      # number of ip addrs to use for VM guests, ex 64
 
-4. Create a nova group
-
-::
+#. Create a nova group::
 
    sudo addgroup nova
 
-5. nova-objectstore specific flags < no specific config needed >
-
-Config files should be have their owner set to root:nova, and mode set to 0640, since they contain your MySQL server's root password.
+The Nova config file should have its owner set to root:nova, and mode set to 0640, since they contain your MySQL server's root password.
 
 ::
 
@@ -121,7 +103,7 @@ Config files should be have their owner set to root:nova, and mode set to 0640,
 Step 3 Setup the sql db
 -----------------------
 
-1. First you 'preseed' (using vishy's :doc:`../quickstart`). Run this as root.
+1. First you 'preseed' (using the Quick Start method :doc:`../quickstart`). Run this as root.
 
 ::
 
diff --git a/doc/source/adminguide/single.node.install.rst b/doc/source/adminguide/single.node.install.rst
index f6b2290bc..8572c5a4a 100644
--- a/doc/source/adminguide/single.node.install.rst
+++ b/doc/source/adminguide/single.node.install.rst
@@ -9,7 +9,7 @@ The fastest way to get a test cloud running is through our :doc:`../quickstart`.
 Step 1 and 2: Get the latest Nova code system software
 ------------------------------------------------------
 
-Depending on your system, the mehod for accomplishing this varies
+Depending on your system, the method for accomplishing this varies
 
 .. toctree::
    :maxdepth: 1
@@ -139,7 +139,7 @@ Type or copy/paste the following to source the novarc file in your current worki
 
 Step 9: Pat yourself on the back :)
 -----------------------------------
-Congratulations, your cloud is up and running, you’ve created an admin user, retrieved the user's credentials and put them in your environment.
+Congratulations, your cloud is up and running, you’ve created an admin user, created a network, retrieved the user's credentials and put them in your environment.
 
 Now you need an image.
 
diff --git a/doc/source/cloud101.rst b/doc/source/cloud101.rst
index 87db5af1e..7c79d2a70 100644
--- a/doc/source/cloud101.rst
+++ b/doc/source/cloud101.rst
@@ -54,6 +54,8 @@ Cloud computing offers different service models depending on the capabilities a
 The US-based National Institute of Standards and Technology offers definitions for cloud computing
 and the service models that are emerging. 
 
+These definitions are summarized from http://csrc.nist.gov/groups/SNS/cloud-computing/.
+
 SaaS - Software as a Service
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
@@ -72,12 +74,15 @@ IaaS - Infrastructure as a Service
 Provides infrastructure such as computer instances, network connections, and storage so that people 
 can run any software or operating system.
 
-.. todo:: Use definitions from http://csrc.nist.gov/groups/SNS/cloud-computing/ and attribute NIST
 
 Types of Cloud Deployments
 --------------------------
-.. todo:: describe public/private/hybrid/etc
 
+When you hear terms such as public cloud or private cloud, these refer to the deployment model for the cloud. A private cloud operates for a single organization, but can be managed on-premise or off-premise. A public cloud has an infrastructure that is available to the general public or a large industry group and is likely owned by a cloud services company. 
+
+The NIST also defines community cloud as shared by several organizations supporting a specific community with shared concerns. 
+
+A hybrid cloud can be a deployment model, as a composition of both public and private clouds, or a hybrid model for cloud computing may involve both virtual and physical servers.
 
 Work in the Clouds
 ------------------
diff --git a/doc/source/images/novascreens.png b/doc/source/images/novascreens.png
new file mode 100644
index 000000000..0fe3279cf
--- /dev/null
+++ b/doc/source/images/novascreens.png
diff --git a/doc/source/images/novashvirtually.png b/doc/source/images/novashvirtually.png
new file mode 100644
index 000000000..02c7e767c
--- /dev/null
+++ b/doc/source/images/novashvirtually.png
diff --git a/doc/source/index.rst b/doc/source/index.rst
index 9b2c8e1f8..b9ba6208a 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -26,7 +26,7 @@ Nova is written with the following design guidelines in mind:
 
 * **Component based architecture**: Quickly add new behaviors
 * **Highly available**: Scale to very serious workloads
-* **Fault-Tollerant**: Isloated processes avoid cascading failures
+* **Fault-Tolerant**: Isolated processes avoid cascading failures
 * **Recoverable**: Failures should be easy to diagnose, debug, and rectify
 * **Open Standards**: Be a reference implementation for a community-driven api
 * **API Compatibility**: Nova strives to provide API-compatible with popular systems like Amazon EC2
@@ -62,8 +62,6 @@ Administrator's Documentation
    adminguide/single.node.install
    adminguide/multi.node.install
 
-.. todo:: add swiftadmin
-
 Developer Docs
 ==============
 
diff --git a/doc/source/livecd.rst b/doc/source/livecd.rst
index 82cf4658a..b355fa180 100644
--- a/doc/source/livecd.rst
+++ b/doc/source/livecd.rst
@@ -1,2 +1,48 @@
 Installing the Live CD
 ======================
+
+If you'd like to set up a sandbox installation of Nova, you can use one of these Live CD images. 
+
+If you don't already have VirtualBox installed, you can download it from http://www.virtualbox.org/wiki/Downloads.
+ 
+Download the zip or iso file and then follow these steps to try Nova in a virtual environment.
+
+http://c0047913.cdn1.cloudfiles.rackspacecloud.com/OpenStackNova.x86_64-2010.1.2.iso (OpenSUSE image; root password is "linux" for this image)
+
+http://c0028699.cdn1.cloudfiles.rackspacecloud.com/nova-vm.zip (~900 MB) (log in information is nova/nova)
+
+Once a VM is configured and started, here are the basics:
+
+ #. Login to Ubuntu using ID nova and Password nova.
+
+ #. Switch to running as sudo (enter nova when prompted for the password)::
+
+    sudo -s
+
+ #. To run Nova for the first time, enter::
+
+    cd /var/openstack/
+
+ #. Now that you're in the correct directory, enter::
+
+    ./nova.sh run
+
+    .. image:: images/novashvirtually.png
+
+If it's already running, use screen -ls, and when the nova screen is presented,then enter screen -d -r nova.
+
+These are the steps to get an instance running (the image is already provided in this environment). Enter these commands in the "test" screen.
+
+::
+
+ euca-add-keypair test > test.pem
+ chmod 600 test.pem
+ euca-run-instances -k test -t m1.tiny ami-tiny
+ euca-describe-instances
+
+ ssh -i test.pem root@10.0.0.3
+
+To see output from the various workers, switch screen windows with Ctrl+A " (quotation mark). 
+
+    .. image:: images/novascreens.png 
+
diff --git a/nova/adminclient.py b/nova/adminclient.py
index 5a62cce7d..6ae9f0c0f 100644
--- a/nova/adminclient.py
+++ b/nova/adminclient.py
@@ -194,6 +194,7 @@ class HostInfo(object):
 
 
 class NovaAdminClient(object):
+
     def __init__(
             self,
             clc_url=DEFAULT_CLC_URL,
diff --git a/nova/api/__init__.py b/nova/api/__init__.py
index 80f9f2109..803470570 100644
--- a/nova/api/__init__.py
+++ b/nova/api/__init__.py
@@ -29,9 +29,7 @@ import routes
 import webob.dec
 
 from nova import flags
-from nova import utils
 from nova import wsgi
-from nova.api import cloudpipe
 from nova.api import ec2
 from nova.api import openstack
 from nova.api.ec2 import metadatarequesthandler
@@ -41,6 +39,7 @@ flags.DEFINE_string('osapi_subdomain', 'api',
                     'subdomain running the OpenStack API')
 flags.DEFINE_string('ec2api_subdomain', 'ec2',
                     'subdomain running the EC2 API')
+
 FLAGS = flags.FLAGS
 
 
@@ -80,7 +79,6 @@ class API(wsgi.Router):
             mapper.connect('%s/{path_info:.*}' % s, controller=mrh,
                            conditions=ec2api_subdomain)
 
-        mapper.connect("/cloudpipe/{path_info:.*}", controller=cloudpipe.API())
         super(API, self).__init__(mapper)
 
     @webob.dec.wsgify
diff --git a/nova/api/cloudpipe/__init__.py b/nova/api/cloudpipe/__init__.py
deleted file mode 100644
index 6d40990a8..000000000
--- a/nova/api/cloudpipe/__init__.py
+++ /dev/null
@@ -1,69 +0,0 @@
-# vim: tabstop=4 shiftwidth=4 softtabstop=4
-
-# Copyright 2010 United States Government as represented by the
-# Administrator of the National Aeronautics and Space Administration.
-# All Rights Reserved.
-#
-#    Licensed under the Apache License, Version 2.0 (the "License"); you may
-#    not use this file except in compliance with the License. You may obtain
-#    a copy of the License at
-#
-#         http://www.apache.org/licenses/LICENSE-2.0
-#
-#    Unless required by applicable law or agreed to in writing, software
-#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-#    License for the specific language governing permissions and limitations
-#    under the License.
-
-"""
-REST API Request Handlers for CloudPipe
-"""
-
-import logging
-import urllib
-import webob
-import webob.dec
-import webob.exc
-
-from nova import crypto
-from nova import wsgi
-from nova.auth import manager
-from nova.api.ec2 import cloud
-
-
-_log = logging.getLogger("api")
-_log.setLevel(logging.DEBUG)
-
-
-class API(wsgi.Application):
-
-    def __init__(self):
-        self.controller = cloud.CloudController()
-
-    @webob.dec.wsgify
-    def __call__(self, req):
-        if req.method == 'POST':
-            return self.sign_csr(req)
-        _log.debug("Cloudpipe path is %s" % req.path_info)
-        if req.path_info.endswith("/getca/"):
-            return self.send_root_ca(req)
-        return webob.exc.HTTPNotFound()
-
-    def get_project_id_from_ip(self, ip):
-        # TODO(eday): This was removed with the ORM branch, fix!
-        instance = self.controller.get_instance_by_ip(ip)
-        return instance['project_id']
-
-    def send_root_ca(self, req):
-        _log.debug("Getting root ca")
-        project_id = self.get_project_id_from_ip(req.remote_addr)
-        res = webob.Response()
-        res.headers["Content-Type"] = "text/plain"
-        res.body = crypto.fetch_ca(project_id)
-        return res
-
-    def sign_csr(self, req):
-        project_id = self.get_project_id_from_ip(req.remote_addr)
-        cert = self.str_params['cert']
-        return crypto.sign_csr(urllib.unquote(cert), project_id)
diff --git a/nova/api/ec2/__init__.py b/nova/api/ec2/__init__.py
index a6ee16c33..d1e2596c3 100644
--- a/nova/api/ec2/__init__.py
+++ b/nova/api/ec2/__init__.py
@@ -26,8 +26,8 @@ import webob
 import webob.dec
 import webob.exc
 
-from nova import exception
 from nova import context
+from nova import exception
 from nova import flags
 from nova import wsgi
 from nova.api.ec2 import apirequest
@@ -37,16 +37,79 @@ from nova.auth import manager
 
 
 FLAGS = flags.FLAGS
+flags.DEFINE_boolean('use_lockout', False,
+                     'Whether or not to use lockout middleware.')
+flags.DEFINE_integer('lockout_attempts', 5,
+                     'Number of failed auths before lockout.')
+flags.DEFINE_integer('lockout_minutes', 15,
+                     'Number of minutes to lockout if triggered.')
+flags.DEFINE_integer('lockout_window', 15,
+                     'Number of minutes for lockout window.')
+flags.DEFINE_list('lockout_memcached_servers', None,
+                  'Memcached servers or None for in process cache.')
+
+
 _log = logging.getLogger("api")
 _log.setLevel(logging.DEBUG)
 
 
 class API(wsgi.Middleware):
-
     """Routing for all EC2 API requests."""
 
     def __init__(self):
         self.application = Authenticate(Router(Authorizer(Executor())))
+        if FLAGS.use_lockout:
+            self.application = Lockout(self.application)
+
+
+class Lockout(wsgi.Middleware):
+    """Lockout for x minutes on y failed auths in a z minute period.
+
+    x = lockout_timeout flag
+    y = lockout_window flag
+    z = lockout_attempts flag
+
+    Uses memcached if lockout_memcached_servers flag is set, otherwise it
+    uses a very simple in-proccess cache. Due to the simplicity of
+    the implementation, the timeout window is started with the first
+    failed request, so it will block if there are x failed logins within
+    that period.
+
+    There is a possible race condition where simultaneous requests could
+    sneak in before the lockout hits, but this is extremely rare and would
+    only result in a couple of extra failed attempts."""
+
+    def __init__(self, application):
+        """middleware can use fake for testing."""
+        if FLAGS.lockout_memcached_servers:
+            import memcache
+        else:
+            from nova import fakememcache as memcache
+        self.mc = memcache.Client(FLAGS.lockout_memcached_servers,
+                                  debug=0)
+        super(Lockout, self).__init__(application)
+
+    @webob.dec.wsgify
+    def __call__(self, req):
+        access_key = str(req.params['AWSAccessKeyId'])
+        failures_key = "authfailures-%s" % access_key
+        failures = int(self.mc.get(failures_key) or 0)
+        if failures >= FLAGS.lockout_attempts:
+            detail = "Too many failed authentications."
+            raise webob.exc.HTTPForbidden(detail=detail)
+        res = req.get_response(self.application)
+        if res.status_int == 403:
+            failures = self.mc.incr(failures_key)
+            if failures is None:
+                # NOTE(vish): To use incr, failures has to be a string.
+                self.mc.set(failures_key, '1', time=FLAGS.lockout_window * 60)
+            elif failures >= FLAGS.lockout_attempts:
+                _log.warn('Access key %s has had %d failed authentications'
+                          ' and will be locked out for %d minutes.' %
+                          (access_key, failures, FLAGS.lockout_minutes))
+                self.mc.set(failures_key, str(failures),
+                            time=FLAGS.lockout_minutes * 60)
+        return res
 
 
 class Authenticate(wsgi.Middleware):
@@ -77,7 +140,7 @@ class Authenticate(wsgi.Middleware):
                     req.host,
                     req.path)
         except exception.Error, ex:
-            logging.debug("Authentication Failure: %s" % ex)
+            logging.debug(_("Authentication Failure: %s") % ex)
             raise webob.exc.HTTPForbidden()
 
         # Authenticated!
@@ -120,9 +183,9 @@ class Router(wsgi.Middleware):
         except:
             raise webob.exc.HTTPBadRequest()
 
-        _log.debug('action: %s' % action)
+        _log.debug(_('action: %s') % action)
         for key, value in args.items():
-            _log.debug('arg: %s\t\tval: %s' % (key, value))
+            _log.debug(_('arg: %s\t\tval: %s') % (key, value))
 
         # Success!
         req.environ['ec2.controller'] = controller
diff --git a/nova/api/ec2/admin.py b/nova/api/ec2/admin.py
index 1c6ab688d..fac01369e 100644
--- a/nova/api/ec2/admin.py
+++ b/nova/api/ec2/admin.py
@@ -168,6 +168,7 @@ class AdminController(object):
 
     # FIXME(vish): these host commands don't work yet, perhaps some of the
     #              required data can be retrieved from service objects?
+
     def describe_hosts(self, _context, **_kwargs):
         """Returns status info for all nodes. Includes:
             * Disk Space
diff --git a/nova/api/ec2/apirequest.py b/nova/api/ec2/apirequest.py
index 5758781b6..a90fbeb0c 100644
--- a/nova/api/ec2/apirequest.py
+++ b/nova/api/ec2/apirequest.py
@@ -92,8 +92,8 @@ class APIRequest(object):
             method = getattr(self.controller,
                              _camelcase_to_underscore(self.action))
         except AttributeError:
-            _error = ('Unsupported API request: controller = %s,'
-                      'action = %s') % (self.controller, self.action)
+            _error = _('Unsupported API request: controller = %s,'
+                       'action = %s') % (self.controller, self.action)
             _log.warning(_error)
             # TODO: Raise custom exception, trap in apiserver,
             #       and reraise as 400 error.
diff --git a/nova/api/ec2/cloud.py b/nova/api/ec2/cloud.py
index 4eef5e1ef..e09261f00 100644
--- a/nova/api/ec2/cloud.py
+++ b/nova/api/ec2/cloud.py
@@ -27,7 +27,6 @@ import datetime
 import logging
 import re
 import os
-import time
 
 from nova import context
 import IPy
@@ -114,7 +113,7 @@ class CloudController(object):
             start = os.getcwd()
             os.chdir(FLAGS.ca_path)
             # TODO(vish): Do this with M2Crypto instead
-            utils.runthis("Generating root CA: %s", "sh genrootca.sh")
+            utils.runthis(_("Generating root CA: %s"), "sh genrootca.sh")
             os.chdir(start)
 
     def _get_mpi_data(self, context, project_id):
@@ -196,15 +195,19 @@ class CloudController(object):
         if FLAGS.region_list:
             regions = []
             for region in FLAGS.region_list:
-                name, _sep, url = region.partition('=')
+                name, _sep, host = region.partition('=')
+                endpoint = '%s://%s:%s%s' % (FLAGS.ec2_prefix,
+                                             host,
+                                             FLAGS.cc_port,
+                                             FLAGS.ec2_suffix)
                 regions.append({'regionName': name,
-                                'regionEndpoint': url})
+                                'regionEndpoint': endpoint})
         else:
             regions = [{'regionName': 'nova',
-                        'regionEndpoint': FLAGS.ec2_url}]
-        if region_name:
-            regions = [r for r in regions if r['regionName'] in region_name]
-        return {'regionInfo': regions}
+                        'regionEndpoint': '%s://%s:%s%s' % (FLAGS.ec2_prefix,
+                                                            FLAGS.cc_host,
+                                                            FLAGS.cc_port,
+                                                            FLAGS.ec2_suffix)}]
 
     def describe_snapshots(self,
                            context,
@@ -318,11 +321,11 @@ class CloudController(object):
             ip_protocol = str(ip_protocol)
 
             if ip_protocol.upper() not in ['TCP', 'UDP', 'ICMP']:
-                raise InvalidInputException('%s is not a valid ipProtocol' %
+                raise InvalidInputException(_('%s is not a valid ipProtocol') %
                                             (ip_protocol,))
             if ((min(from_port, to_port) < -1) or
                 (max(from_port, to_port) > 65535)):
-                raise InvalidInputException('Invalid port range')
+                raise InvalidInputException(_('Invalid port range'))
 
             values['protocol'] = ip_protocol
             values['from_port'] = from_port
@@ -360,7 +363,8 @@ class CloudController(object):
 
         criteria = self._revoke_rule_args_to_dict(context, **kwargs)
         if criteria == None:
-            raise exception.ApiError("No rule for the specified parameters.")
+            raise exception.ApiError(_("No rule for the specified "
+                                       "parameters."))
 
         for rule in security_group.rules:
             match = True
@@ -371,7 +375,7 @@ class CloudController(object):
                 db.security_group_rule_destroy(context, rule['id'])
                 self._trigger_refresh_security_group(context, security_group)
                 return True
-        raise exception.ApiError("No rule for the specified parameters.")
+        raise exception.ApiError(_("No rule for the specified parameters."))
 
     # TODO(soren): This has only been tested with Boto as the client.
     #              Unfortunately, it seems Boto is using an old API
@@ -387,8 +391,8 @@ class CloudController(object):
         values['parent_group_id'] = security_group.id
 
         if self._security_group_rule_exists(security_group, values):
-            raise exception.ApiError('This rule already exists in group %s' %
-                                     group_name)
+            raise exception.ApiError(_('This rule already exists in group %s')
+                                     % group_name)
 
         security_group_rule = db.security_group_rule_create(context, values)
 
@@ -416,7 +420,7 @@ class CloudController(object):
     def create_security_group(self, context, group_name, group_description):
         self.compute_api.ensure_default_security_group(context)
         if db.security_group_exists(context, context.project_id, group_name):
-            raise exception.ApiError('group %s already exists' % group_name)
+            raise exception.ApiError(_('group %s already exists') % group_name)
 
         group = {'user_id': context.user.id,
                  'project_id': context.project_id,
@@ -450,13 +454,15 @@ class CloudController(object):
                 "Timestamp": now,
                 "output": base64.b64encode(output)}
 
-    def describe_volumes(self, context, **kwargs):
+    def describe_volumes(self, context, volume_id=None, **kwargs):
         if context.user.is_admin():
             volumes = db.volume_get_all(context)
         else:
             volumes = db.volume_get_all_by_project(context, context.project_id)
 
-        volumes = [self._format_volume(context, v) for v in volumes]
+        # NOTE(vish): volume_id is an optional list of volume ids to filter by.
+        volumes = [self._format_volume(context, v) for v in volumes
+                   if volume_id is None or v['ec2_id'] in volume_id]
 
         return {'volumeSet': volumes}
 
@@ -527,13 +533,13 @@ class CloudController(object):
     def attach_volume(self, context, volume_id, instance_id, device, **kwargs):
         volume_ref = db.volume_get_by_ec2_id(context, volume_id)
         if not re.match("^/dev/[a-z]d[a-z]+$", device):
-            raise exception.ApiError("Invalid device specified: %s. "
-                                     "Example device: /dev/vdb" % device)
+            raise exception.ApiError(_("Invalid device specified: %s. "
+                                     "Example device: /dev/vdb") % device)
         # TODO(vish): abstract status checking?
         if volume_ref['status'] != "available":
-            raise exception.ApiError("Volume status must be available")
+            raise exception.ApiError(_("Volume status must be available"))
         if volume_ref['attach_status'] == "attached":
-            raise exception.ApiError("Volume is already attached")
+            raise exception.ApiError(_("Volume is already attached"))
         internal_id = ec2_id_to_internal_id(instance_id)
         instance_ref = self.compute_api.get_instance(context, internal_id)
         host = instance_ref['host']
@@ -555,10 +561,10 @@ class CloudController(object):
         instance_ref = db.volume_get_instance(context.elevated(),
                                               volume_ref['id'])
         if not instance_ref:
-            raise exception.ApiError("Volume isn't attached to anything!")
+            raise exception.ApiError(_("Volume isn't attached to anything!"))
         # TODO(vish): abstract status checking?
         if volume_ref['status'] == "available":
-            raise exception.ApiError("Volume is already detached")
+            raise exception.ApiError(_("Volume is already detached"))
         try:
             host = instance_ref['host']
             rpc.cast(context,
@@ -687,23 +693,29 @@ class CloudController(object):
     def allocate_address(self, context, **kwargs):
         # check quota
         if quota.allowed_floating_ips(context, 1) < 1:
-            logging.warn("Quota exceeeded for %s, tried to allocate address",
+            logging.warn(_("Quota exceeeded for %s, tried to allocate "
+                           "address"),
                          context.project_id)
-            raise quota.QuotaError("Address quota exceeded. You cannot "
-                                   "allocate any more addresses")
-        network_topic = self._get_network_topic(context)
+            raise quota.QuotaError(_("Address quota exceeded. You cannot "
+                                   "allocate any more addresses"))
+        # NOTE(vish): We don't know which network host should get the ip
+        #             when we allocate, so just send it to any one.  This
+        #             will probably need to move into a network supervisor
+        #             at some point.
         public_ip = rpc.call(context,
-                             network_topic,
+                             FLAGS.network_topic,
                              {"method": "allocate_floating_ip",
                               "args": {"project_id": context.project_id}})
         return {'addressSet': [{'publicIp': public_ip}]}
 
     def release_address(self, context, public_ip, **kwargs):
-        # NOTE(vish): Should we make sure this works?
         floating_ip_ref = db.floating_ip_get_by_address(context, public_ip)
-        network_topic = self._get_network_topic(context)
+        # NOTE(vish): We don't know which network host should get the ip
+        #             when we deallocate, so just send it to any one.  This
+        #             will probably need to move into a network supervisor
+        #             at some point.
         rpc.cast(context,
-                 network_topic,
+                 FLAGS.network_topic,
                  {"method": "deallocate_floating_ip",
                   "args": {"floating_address": floating_ip_ref['address']}})
         return {'releaseResponse': ["Address released."]}
@@ -714,7 +726,10 @@ class CloudController(object):
         fixed_address = db.instance_get_fixed_address(context,
                                                       instance_ref['id'])
         floating_ip_ref = db.floating_ip_get_by_address(context, public_ip)
-        network_topic = self._get_network_topic(context)
+        # NOTE(vish): Perhaps we should just pass this on to compute and
+        #             let compute communicate with network.
+        network_topic = self.compute_api.get_network_topic(context,
+                                                           internal_id)
         rpc.cast(context,
                  network_topic,
                  {"method": "associate_floating_ip",
@@ -724,24 +739,18 @@ class CloudController(object):
 
     def disassociate_address(self, context, public_ip, **kwargs):
         floating_ip_ref = db.floating_ip_get_by_address(context, public_ip)
-        network_topic = self._get_network_topic(context)
+        # NOTE(vish): Get the topic from the host name of the network of
+        #             the associated fixed ip.
+        if not floating_ip_ref.get('fixed_ip'):
+            raise exception.ApiError('Address is not associated.')
+        host = floating_ip_ref['fixed_ip']['network']['host']
+        topic = db.queue_get_for(context, FLAGS.network_topic, host)
         rpc.cast(context,
-                 network_topic,
+                 topic,
                  {"method": "disassociate_floating_ip",
                   "args": {"floating_address": floating_ip_ref['address']}})
         return {'disassociateResponse': ["Address disassociated."]}
 
-    def _get_network_topic(self, context):
-        """Retrieves the network host for a project"""
-        network_ref = self.network_manager.get_network(context)
-        host = network_ref['host']
-        if not host:
-            host = rpc.call(context,
-                            FLAGS.network_topic,
-                            {"method": "set_network_host",
-                             "args": {"network_id": network_ref['id']}})
-        return db.queue_get_for(context, FLAGS.network_topic, host)
-
     def run_instances(self, context, **kwargs):
         max_count = int(kwargs.get('max_count', 1))
         instances = self.compute_api.create_instances(context,
@@ -749,12 +758,12 @@ class CloudController(object):
             kwargs['image_id'],
             min_count=int(kwargs.get('min_count', max_count)),
             max_count=max_count,
-            kernel_id=kwargs.get('kernel_id'),
+            kernel_id=kwargs.get('kernel_id', None),
             ramdisk_id=kwargs.get('ramdisk_id'),
             display_name=kwargs.get('display_name'),
             description=kwargs.get('display_description'),
-            user_data=kwargs.get('user_data', ''),
             key_name=kwargs.get('key_name'),
+            user_data=kwargs.get('user_data'),
             security_group=kwargs.get('security_group'),
             generate_hostname=internal_id_to_ec2_id)
         return self._format_run_instances(context,
@@ -804,7 +813,7 @@ class CloudController(object):
         # TODO: return error if not authorized
         volume_ref = db.volume_get_by_ec2_id(context, volume_id)
         if volume_ref['status'] != "available":
-            raise exception.ApiError("Volume status must be available")
+            raise exception.ApiError(_("Volume status must be available"))
         now = datetime.datetime.utcnow()
         db.volume_update(context, volume_ref['id'], {'status': 'deleting',
                                                      'terminated_at': now})
@@ -835,11 +844,12 @@ class CloudController(object):
 
     def describe_image_attribute(self, context, image_id, attribute, **kwargs):
         if attribute != 'launchPermission':
-            raise exception.ApiError('attribute not supported: %s' % attribute)
+            raise exception.ApiError(_('attribute not supported: %s')
+                                     % attribute)
         try:
             image = self.image_service.show(context, image_id)
         except IndexError:
-            raise exception.ApiError('invalid id: %s' % image_id)
+            raise exception.ApiError(_('invalid id: %s') % image_id)
         result = {'image_id': image_id, 'launchPermission': []}
         if image['isPublic']:
             result['launchPermission'].append({'group': 'all'})
@@ -849,13 +859,14 @@ class CloudController(object):
                                operation_type, **kwargs):
         # TODO(devcamcar): Support users and groups other than 'all'.
         if attribute != 'launchPermission':
-            raise exception.ApiError('attribute not supported: %s' % attribute)
+            raise exception.ApiError(_('attribute not supported: %s')
+                                     % attribute)
         if not 'user_group' in kwargs:
-            raise exception.ApiError('user or group not specified')
+            raise exception.ApiError(_('user or group not specified'))
         if len(kwargs['user_group']) != 1 and kwargs['user_group'][0] != 'all':
-            raise exception.ApiError('only group "all" is supported')
+            raise exception.ApiError(_('only group "all" is supported'))
         if not operation_type in ['add', 'remove']:
-            raise exception.ApiError('operation_type must be add or remove')
+            raise exception.ApiError(_('operation_type must be add or remove'))
         return self.image_service.modify(context, image_id, operation_type)
 
     def update_image(self, context, image_id, **kwargs):
diff --git a/nova/api/ec2/metadatarequesthandler.py b/nova/api/ec2/metadatarequesthandler.py
index 2f4f414cc..0e9e686ff 100644
--- a/nova/api/ec2/metadatarequesthandler.py
+++ b/nova/api/ec2/metadatarequesthandler.py
@@ -65,7 +65,7 @@ class MetadataRequestHandler(object):
         cc = cloud.CloudController()
         meta_data = cc.get_metadata(req.remote_addr)
         if meta_data is None:
-            logging.error('Failed to get metadata for ip: %s' %
+            logging.error(_('Failed to get metadata for ip: %s') %
                           req.remote_addr)
             raise webob.exc.HTTPNotFound()
         data = self.lookup(req.path_info, meta_data)
diff --git a/nova/api/openstack/__init__.py b/nova/api/openstack/__init__.py
index 4ca108c4e..de95ee548 100644
--- a/nova/api/openstack/__init__.py
+++ b/nova/api/openstack/__init__.py
@@ -30,6 +30,7 @@ import webob.dec
 import webob.exc
 import webob
 
+from nova import context
 from nova import flags
 from nova import utils
 from nova import wsgi
@@ -48,6 +49,10 @@ flags.DEFINE_string('nova_api_auth',
     'nova.api.openstack.auth.BasicApiAuthManager',
     'The auth mechanism to use for the OpenStack API implemenation')
 
+flags.DEFINE_bool('allow_admin_api',
+    False,
+    'When True, this API service will accept admin operations.')
+
 
 class API(wsgi.Middleware):
     """WSGI entry point for all OpenStack API requests."""
@@ -61,7 +66,7 @@ class API(wsgi.Middleware):
         try:
             return req.get_response(self.application)
         except Exception as ex:
-            logging.warn("Caught error: %s" % str(ex))
+            logging.warn(_("Caught error: %s") % str(ex))
             logging.debug(traceback.format_exc())
             exc = webob.exc.HTTPInternalServerError(explanation=str(ex))
             return faults.Fault(exc)
@@ -84,9 +89,7 @@ class AuthMiddleware(wsgi.Middleware):
         if not user:
             return faults.Fault(webob.exc.HTTPUnauthorized())
 
-        if 'nova.context' not in req.environ:
-            req.environ['nova.context'] = {}
-        req.environ['nova.context']['user'] = user
+        req.environ['nova.context'] = context.RequestContext(user, user)
         return self.application
 
 
@@ -121,16 +124,16 @@ class RateLimitingMiddleware(wsgi.Middleware):
         If the request should be rate limited, return a 413 status with a
         Retry-After header giving the time when the request would succeed.
         """
-        user_id = req.environ['nova.context']['user']['id']
         action_name = self.get_action_name(req)
         if not action_name:
             # Not rate limited
             return self.application
-        delay = self.get_delay(action_name, user_id)
+        delay = self.get_delay(action_name,
+            req.environ['nova.context'].user_id)
         if delay:
             # TODO(gundlach): Get the retry-after format correct.
             exc = webob.exc.HTTPRequestEntityTooLarge(
-                    explanation='Too many requests.',
+                    explanation=_('Too many requests.'),
                     headers={'Retry-After': time.time() + delay})
             raise faults.Fault(exc)
         return self.application
@@ -167,9 +170,16 @@ class APIRouter(wsgi.Router):
 
     def __init__(self):
         mapper = routes.Mapper()
+
+        server_members = {'action': 'POST'}
+        if FLAGS.allow_admin_api:
+            logging.debug("Including admin operations in API.")
+            server_members['pause'] = 'POST'
+            server_members['unpause'] = 'POST'
+
         mapper.resource("server", "servers", controller=servers.Controller(),
                         collection={'detail': 'GET'},
-                        member={'action': 'POST'})
+                        member=server_members)
 
         mapper.resource("backup_schedule", "backup_schedules",
                         controller=backup_schedules.Controller(),
diff --git a/nova/api/openstack/auth.py b/nova/api/openstack/auth.py
index 205035915..fcda97ab1 100644
--- a/nova/api/openstack/auth.py
+++ b/nova/api/openstack/auth.py
@@ -74,9 +74,7 @@ class BasicApiAuthManager(object):
             if delta.days >= 2:
                 self.db.auth_destroy_token(self.context, token)
             else:
-                #TODO(gundlach): Why not just return dict(id=token.user_id)?
-                user = self.auth.get_user(token.user_id)
-                return {'id': user.id}
+                return self.auth.get_user(token.user_id)
         return None
 
     def _authorize_user(self, username, key, req):
diff --git a/nova/api/openstack/backup_schedules.py b/nova/api/openstack/backup_schedules.py
index 3ed691d7b..fc70b5c6c 100644
--- a/nova/api/openstack/backup_schedules.py
+++ b/nova/api/openstack/backup_schedules.py
@@ -24,6 +24,7 @@ import nova.image.service
 
 
 class Controller(wsgi.Controller):
+
     def __init__(self):
         pass
 
diff --git a/nova/api/openstack/images.py b/nova/api/openstack/images.py
index cdbdc9bdd..4a0a8e6f1 100644
--- a/nova/api/openstack/images.py
+++ b/nova/api/openstack/images.py
@@ -17,7 +17,6 @@
 
 from webob import exc
 
-from nova import context
 from nova import flags
 from nova import utils
 from nova import wsgi
@@ -47,10 +46,8 @@ class Controller(wsgi.Controller):
 
     def detail(self, req):
         """Return all public images in detail."""
-        user_id = req.environ['nova.context']['user']['id']
-        ctxt = context.RequestContext(user_id, user_id)
         try:
-            images = self._service.detail(ctxt)
+            images = self._service.detail(req.environ['nova.context'])
             images = nova.api.openstack.limited(images, req)
         except NotImplementedError:
             # Emulate detail() using repeated calls to show()
@@ -61,9 +58,7 @@ class Controller(wsgi.Controller):
 
     def show(self, req, id):
         """Return data about the given image id."""
-        user_id = req.environ['nova.context']['user']['id']
-        ctxt = context.RequestContext(user_id, user_id)
-        return dict(image=self._service.show(ctxt, id))
+        return dict(image=self._service.show(req.environ['nova.context'], id))
 
     def delete(self, req, id):
         # Only public images are supported for now.
diff --git a/nova/api/openstack/servers.py b/nova/api/openstack/servers.py
index 6f2f6fed9..5c3322f7c 100644
--- a/nova/api/openstack/servers.py
+++ b/nova/api/openstack/servers.py
@@ -15,9 +15,11 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
+import logging
+import traceback
+
 from webob import exc
 
-from nova import context
 from nova import exception
 from nova import wsgi
 from nova.api.openstack import faults
@@ -28,6 +30,10 @@ from nova.compute import power_state
 import nova.api.openstack
 
 
+LOG = logging.getLogger('server')
+LOG.setLevel(logging.DEBUG)
+
+
 def _entity_list(entities):
     """ Coerces a list of servers into proper dictionary format """
     return dict(servers=entities)
@@ -90,29 +96,26 @@ class Controller(wsgi.Controller):
 
         entity_maker - either _entity_detail or _entity_inst
         """
-        user_id = req.environ['nova.context']['user']['id']
-        ctxt = context.RequestContext(user_id, user_id)
-        instance_list = self.compute_api.get_instances(ctxt)
+        instance_list = self.compute_api.get_instances(
+            req.environ['nova.context'])
         limited_list = nova.api.openstack.limited(instance_list, req)
         res = [entity_maker(inst)['server'] for inst in limited_list]
         return _entity_list(res)
 
     def show(self, req, id):
         """ Returns server details by server id """
-        user_id = req.environ['nova.context']['user']['id']
-        ctxt = context.RequestContext(user_id, user_id)
-        inst = self.compute_api.get_instance(ctxt, int(id))
-        if inst:
-            if inst.user_id == user_id:
-                return _entity_detail(inst)
-        raise faults.Fault(exc.HTTPNotFound())
+        try:
+            instance = self.compute_api.get_instance(
+                req.environ['nova.context'], int(id))
+            return _entity_detail(instance)
+        except exception.NotFound:
+            return faults.Fault(exc.HTTPNotFound())
 
     def delete(self, req, id):
         """ Destroys a server """
-        user_id = req.environ['nova.context']['user']['id']
-        ctxt = context.RequestContext(user_id, user_id)
         try:
-            self.compute_api.delete_instance(ctxt, int(id))
+            self.compute_api.delete_instance(req.environ['nova.context'],
+                int(id))
         except exception.NotFound:
             return faults.Fault(exc.HTTPNotFound())
         return exc.HTTPAccepted()
@@ -123,10 +126,10 @@ class Controller(wsgi.Controller):
         if not env:
             return faults.Fault(exc.HTTPUnprocessableEntity())
 
-        user_id = req.environ['nova.context']['user']['id']
-        ctxt = context.RequestContext(user_id, user_id)
-        key_pair = auth_manager.AuthManager.get_key_pairs(ctxt)[0]
-        instances = self.compute_api.create_instances(ctxt,
+        key_pair = auth_manager.AuthManager.get_key_pairs(
+            req.environ['nova.context'])[0]
+        instances = self.compute_api.create_instances(
+            req.environ['nova.context'],
             instance_types.get_by_flavor_id(env['server']['flavorId']),
             env['server']['imageId'],
             display_name=env['server']['name'],
@@ -137,8 +140,6 @@ class Controller(wsgi.Controller):
 
     def update(self, req, id):
         """ Updates the server name or password """
-        user_id = req.environ['nova.context']['user']['id']
-        ctxt = context.RequestContext(user_id, user_id)
         inst_dict = self._deserialize(req.body, req)
         if not inst_dict:
             return faults.Fault(exc.HTTPUnprocessableEntity())
@@ -150,7 +151,8 @@ class Controller(wsgi.Controller):
             update_dict['display_name'] = inst_dict['server']['name']
 
         try:
-            self.compute_api.update_instance(ctxt, instance['id'],
+            self.compute_api.update_instance(req.environ['nova.context'],
+                                             instance['id'],
                                              **update_dict)
         except exception.NotFound:
             return faults.Fault(exc.HTTPNotFound())
@@ -159,8 +161,6 @@ class Controller(wsgi.Controller):
     def action(self, req, id):
         """ Multi-purpose method used to reboot, rebuild, and
         resize a server """
-        user_id = req.environ['nova.context']['user']['id']
-        ctxt = context.RequestContext(user_id, user_id)
         input_dict = self._deserialize(req.body, req)
         try:
             reboot_type = input_dict['reboot']['type']
@@ -169,7 +169,29 @@ class Controller(wsgi.Controller):
         try:
             # TODO(gundlach): pass reboot_type, support soft reboot in
             # virt driver
-            self.compute_api.reboot(ctxt, id)
+            self.compute_api.reboot(req.environ['nova.context'], id)
+        except:
+            return faults.Fault(exc.HTTPUnprocessableEntity())
+        return exc.HTTPAccepted()
+
+    def pause(self, req, id):
+        """ Permit Admins to Pause the server. """
+        ctxt = req.environ['nova.context']
+        try:
+            self.compute_api.pause(ctxt, id)
+        except:
+            readable = traceback.format_exc()
+            logging.error("Compute.api::pause %s", readable)
+            return faults.Fault(exc.HTTPUnprocessableEntity())
+        return exc.HTTPAccepted()
+
+    def unpause(self, req, id):
+        """ Permit Admins to Unpause the server. """
+        ctxt = req.environ['nova.context']
+        try:
+            self.compute_api.unpause(ctxt, id)
         except:
+            readable = traceback.format_exc()
+            logging.error("Compute.api::unpause %s", readable)
             return faults.Fault(exc.HTTPUnprocessableEntity())
         return exc.HTTPAccepted()
diff --git a/nova/auth/dbdriver.py b/nova/auth/dbdriver.py
index a1584322b..47e435cb6 100644
--- a/nova/auth/dbdriver.py
+++ b/nova/auth/dbdriver.py
@@ -37,7 +37,6 @@ class DbDriver(object):
     def __init__(self):
         """Imports the LDAP module"""
         pass
-        db
 
     def __enter__(self):
         return self
@@ -83,7 +82,7 @@ class DbDriver(object):
             user_ref = db.user_create(context.get_admin_context(), values)
             return self._db_user_to_auth_user(user_ref)
         except exception.Duplicate, e:
-            raise exception.Duplicate('User %s already exists' % name)
+            raise exception.Duplicate(_('User %s already exists') % name)
 
     def _db_user_to_auth_user(self, user_ref):
         return {'id': user_ref['id'],
@@ -105,8 +104,9 @@ class DbDriver(object):
         """Create a project"""
         manager = db.user_get(context.get_admin_context(), manager_uid)
         if not manager:
-            raise exception.NotFound("Project can't be created because "
-                                     "manager %s doesn't exist" % manager_uid)
+            raise exception.NotFound(_("Project can't be created because "
+                                       "manager %s doesn't exist")
+                                     % manager_uid)
 
         # description is a required attribute
         if description is None:
@@ -133,8 +133,8 @@ class DbDriver(object):
         try:
             project = db.project_create(context.get_admin_context(), values)
         except exception.Duplicate:
-            raise exception.Duplicate("Project can't be created because "
-                                      "project %s already exists" % name)
+            raise exception.Duplicate(_("Project can't be created because "
+                                        "project %s already exists") % name)
 
         for member in members:
             db.project_add_member(context.get_admin_context(),
@@ -155,8 +155,8 @@ class DbDriver(object):
         if manager_uid:
             manager = db.user_get(context.get_admin_context(), manager_uid)
             if not manager:
-                raise exception.NotFound("Project can't be modified because "
-                                          "manager %s doesn't exist" %
+                raise exception.NotFound(_("Project can't be modified because "
+                                           "manager %s doesn't exist") %
                                           manager_uid)
             values['project_manager'] = manager['id']
         if description:
@@ -243,8 +243,8 @@ class DbDriver(object):
     def _validate_user_and_project(self, user_id, project_id):
         user = db.user_get(context.get_admin_context(), user_id)
         if not user:
-            raise exception.NotFound('User "%s" not found' % user_id)
+            raise exception.NotFound(_('User "%s" not found') % user_id)
         project = db.project_get(context.get_admin_context(), project_id)
         if not project:
-            raise exception.NotFound('Project "%s" not found' % project_id)
+            raise exception.NotFound(_('Project "%s" not found') % project_id)
         return user, project
diff --git a/nova/auth/fakeldap.py b/nova/auth/fakeldap.py
index 2dcb69267..4466051f0 100644
--- a/nova/auth/fakeldap.py
+++ b/nova/auth/fakeldap.py
@@ -15,7 +15,7 @@
 #    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
 #    License for the specific language governing permissions and limitations
 #    under the License.
-"""Fake LDAP server for test harness, backs to ReDIS.
+"""Fake LDAP server for test harness.
 
 This class does very little error checking, and knows nothing about ldap
 class definitions.  It implements the minimum emulation of the python ldap
@@ -23,34 +23,65 @@ library to work with nova.
 
 """
 
+import fnmatch
 import json
-import redis
 
-from nova import flags
 
-FLAGS = flags.FLAGS
-flags.DEFINE_string('redis_host', '127.0.0.1',
-                    'Host that redis is running on.')
-flags.DEFINE_integer('redis_port', 6379,
-                    'Port that redis is running on.')
-flags.DEFINE_integer('redis_db', 0, 'Multiple DB keeps tests away')
-
-
-class Redis(object):
+class Store(object):
     def __init__(self):
         if hasattr(self.__class__, '_instance'):
-            raise Exception('Attempted to instantiate singleton')
+            raise Exception(_('Attempted to instantiate singleton'))
 
     @classmethod
     def instance(cls):
         if not hasattr(cls, '_instance'):
-            inst = redis.Redis(host=FLAGS.redis_host,
-                               port=FLAGS.redis_port,
-                               db=FLAGS.redis_db)
-            cls._instance = inst
+            cls._instance = _StorageDict()
         return cls._instance
 
 
+class _StorageDict(dict):
+    def keys(self, pat=None):
+        ret = super(_StorageDict, self).keys()
+        if pat is not None:
+            ret = fnmatch.filter(ret, pat)
+        return ret
+
+    def delete(self, key):
+        try:
+            del self[key]
+        except KeyError:
+            pass
+
+    def flushdb(self):
+        self.clear()
+
+    def hgetall(self, key):
+        """Returns the hash for the given key; creates
+        the hash if the key doesn't exist."""
+        try:
+            return self[key]
+        except KeyError:
+            self[key] = {}
+            return self[key]
+
+    def hget(self, key, field):
+        hashdict = self.hgetall(key)
+        try:
+            return hashdict[field]
+        except KeyError:
+            hashdict[field] = {}
+            return hashdict[field]
+
+    def hset(self, key, field, val):
+        hashdict = self.hgetall(key)
+        hashdict[field] = val
+
+    def hmset(self, key, value_dict):
+        hashdict = self.hgetall(key)
+        for field, val in value_dict.items():
+            hashdict[field] = val
+
+
 SCOPE_BASE = 0
 SCOPE_ONELEVEL = 1  # Not implemented
 SCOPE_SUBTREE = 2
@@ -172,8 +203,6 @@ def _to_json(unencoded):
 
 
 class FakeLDAP(object):
-    #TODO(vish): refactor this class to use a wrapper instead of accessing
-    #            redis directly
     """Fake LDAP connection."""
 
     def simple_bind_s(self, dn, password):
@@ -186,14 +215,13 @@ class FakeLDAP(object):
 
     def add_s(self, dn, attr):
         """Add an object with the specified attributes at dn."""
-        key = "%s%s" % (self.__redis_prefix, dn)
-
+        key = "%s%s" % (self.__prefix, dn)
         value_dict = dict([(k, _to_json(v)) for k, v in attr])
-        Redis.instance().hmset(key, value_dict)
+        Store.instance().hmset(key, value_dict)
 
     def delete_s(self, dn):
         """Remove the ldap object at specified dn."""
-        Redis.instance().delete("%s%s" % (self.__redis_prefix, dn))
+        Store.instance().delete("%s%s" % (self.__prefix, dn))
 
     def modify_s(self, dn, attrs):
         """Modify the object at dn using the attribute list.
@@ -204,18 +232,18 @@ class FakeLDAP(object):
             ([MOD_ADD | MOD_DELETE | MOD_REPACE], attribute, value)
 
         """
-        redis = Redis.instance()
-        key = "%s%s" % (self.__redis_prefix, dn)
+        store = Store.instance()
+        key = "%s%s" % (self.__prefix, dn)
 
         for cmd, k, v in attrs:
-            values = _from_json(redis.hget(key, k))
+            values = _from_json(store.hget(key, k))
             if cmd == MOD_ADD:
                 values.append(v)
             elif cmd == MOD_REPLACE:
                 values = [v]
             else:
                 values.remove(v)
-            values = redis.hset(key, k, _to_json(values))
+            values = store.hset(key, k, _to_json(values))
 
     def search_s(self, dn, scope, query=None, fields=None):
         """Search for all matching objects under dn using the query.
@@ -229,16 +257,17 @@ class FakeLDAP(object):
         """
         if scope != SCOPE_BASE and scope != SCOPE_SUBTREE:
             raise NotImplementedError(str(scope))
-        redis = Redis.instance()
+        store = Store.instance()
         if scope == SCOPE_BASE:
-            keys = ["%s%s" % (self.__redis_prefix, dn)]
+            keys = ["%s%s" % (self.__prefix, dn)]
         else:
-            keys = redis.keys("%s*%s" % (self.__redis_prefix, dn))
+            keys = store.keys("%s*%s" % (self.__prefix, dn))
+
         objects = []
         for key in keys:
-            # get the attributes from redis
-            attrs = redis.hgetall(key)
-            # turn the values from redis into lists
+            # get the attributes from the store
+            attrs = store.hgetall(key)
+            # turn the values from the store into lists
             # pylint: disable-msg=E1103
             attrs = dict([(k, _from_json(v))
                           for k, v in attrs.iteritems()])
@@ -247,13 +276,13 @@ class FakeLDAP(object):
                 # filter the attributes by fields
                 attrs = dict([(k, v) for k, v in attrs.iteritems()
                               if not fields or k in fields])
-                objects.append((key[len(self.__redis_prefix):], attrs))
+                objects.append((key[len(self.__prefix):], attrs))
             # pylint: enable-msg=E1103
         if objects == []:
             raise NO_SUCH_OBJECT()
         return objects
 
     @property
-    def __redis_prefix(self):  # pylint: disable-msg=R0201
-        """Get the prefix to use for all redis keys."""
+    def __prefix(self):  # pylint: disable-msg=R0201
+        """Get the prefix to use for all keys."""
         return 'ldap:'
diff --git a/nova/auth/ldapdriver.py b/nova/auth/ldapdriver.py
index 1b928e7d8..7616ff112 100644
--- a/nova/auth/ldapdriver.py
+++ b/nova/auth/ldapdriver.py
@@ -176,7 +176,7 @@ class LdapDriver(object):
                 self.conn.modify_s(self.__uid_to_dn(name), attr)
                 return self.get_user(name)
             else:
-                raise exception.NotFound("LDAP object for %s doesn't exist"
+                raise exception.NotFound(_("LDAP object for %s doesn't exist")
                                          % name)
         else:
             attr = [
@@ -199,11 +199,12 @@ class LdapDriver(object):
                        description=None, member_uids=None):
         """Create a project"""
         if self.__project_exists(name):
-            raise exception.Duplicate("Project can't be created because "
-                                      "project %s already exists" % name)
+            raise exception.Duplicate(_("Project can't be created because "
+                                        "project %s already exists") % name)
         if not self.__user_exists(manager_uid):
-            raise exception.NotFound("Project can't be created because "
-                                     "manager %s doesn't exist" % manager_uid)
+            raise exception.NotFound(_("Project can't be created because "
+                                       "manager %s doesn't exist")
+                                     % manager_uid)
         manager_dn = self.__uid_to_dn(manager_uid)
         # description is a required attribute
         if description is None:
@@ -212,8 +213,8 @@ class LdapDriver(object):
         if member_uids is not None:
             for member_uid in member_uids:
                 if not self.__user_exists(member_uid):
-                    raise exception.NotFound("Project can't be created "
-                                             "because user %s doesn't exist"
+                    raise exception.NotFound(_("Project can't be created "
+                                               "because user %s doesn't exist")
                                              % member_uid)
                 members.append(self.__uid_to_dn(member_uid))
         # always add the manager as a member because members is required
@@ -235,9 +236,9 @@ class LdapDriver(object):
         attr = []
         if manager_uid:
             if not self.__user_exists(manager_uid):
-                raise exception.NotFound("Project can't be modified because "
-                                         "manager %s doesn't exist" %
-                                         manager_uid)
+                raise exception.NotFound(_("Project can't be modified because "
+                                           "manager %s doesn't exist")
+                                         % manager_uid)
             manager_dn = self.__uid_to_dn(manager_uid)
             attr.append((self.ldap.MOD_REPLACE, LdapDriver.project_attribute,
                          manager_dn))
@@ -472,8 +473,8 @@ class LdapDriver(object):
             raise exception.NotFound("The group at dn %s doesn't exist" %
                                      group_dn)
         if self.__is_in_group(uid, group_dn):
-            raise exception.Duplicate("User %s is already a member of "
-                                      "the group %s" % (uid, group_dn))
+            raise exception.Duplicate(_("User %s is already a member of "
+                                        "the group %s") % (uid, group_dn))
         attr = [(self.ldap.MOD_ADD, 'member', self.__uid_to_dn(uid))]
         self.conn.modify_s(group_dn, attr)
 
@@ -501,8 +502,8 @@ class LdapDriver(object):
         try:
             self.conn.modify_s(group_dn, attr)
         except self.ldap.OBJECT_CLASS_VIOLATION:
-            logging.debug("Attempted to remove the last member of a group. "
-                          "Deleting the group at %s instead.", group_dn)
+            logging.debug(_("Attempted to remove the last member of a group. "
+                            "Deleting the group at %s instead."), group_dn)
             self.__delete_group(group_dn)
 
     def __remove_from_all(self, uid):
@@ -522,7 +523,8 @@ class LdapDriver(object):
     def __delete_group(self, group_dn):
         """Delete Group"""
         if not self.__group_exists(group_dn):
-            raise exception.NotFound("Group at dn %s doesn't exist" % group_dn)
+            raise exception.NotFound(_("Group at dn %s doesn't exist")
+                                     % group_dn)
         self.conn.delete_s(group_dn)
 
     def __delete_roles(self, project_dn):
diff --git a/nova/auth/manager.py b/nova/auth/manager.py
index 11c3bd6df..d3e266952 100644
--- a/nova/auth/manager.py
+++ b/nova/auth/manager.py
@@ -64,12 +64,9 @@ flags.DEFINE_string('credential_key_file', 'pk.pem',
                     'Filename of private key in credentials zip')
 flags.DEFINE_string('credential_cert_file', 'cert.pem',
                     'Filename of certificate in credentials zip')
-flags.DEFINE_string('credential_rc_file', 'novarc',
-                    'Filename of rc in credentials zip')
-flags.DEFINE_string('credential_cert_subject',
-                    '/C=US/ST=California/L=MountainView/O=AnsoLabs/'
-                    'OU=NovaDev/CN=%s-%s',
-                    'Subject for certificate for users')
+flags.DEFINE_string('credential_rc_file', '%src',
+                    'Filename of rc in credentials zip, %s will be '
+                    'replaced by name of the region (nova by default)')
 flags.DEFINE_string('auth_driver', 'nova.auth.dbdriver.DbDriver',
                     'Driver that auth manager uses')
 
@@ -257,12 +254,12 @@ class AuthManager(object):
         # TODO(vish): check for valid timestamp
         (access_key, _sep, project_id) = access.partition(':')
 
-        logging.info('Looking up user: %r', access_key)
+        logging.info(_('Looking up user: %r'), access_key)
         user = self.get_user_from_access_key(access_key)
         logging.info('user: %r', user)
         if user == None:
-            raise exception.NotFound('No user found for access key %s' %
-                                     access_key)
+            raise exception.NotFound(_('No user found for access key %s')
+                                     % access_key)
 
         # NOTE(vish): if we stop using project name as id we need better
         #             logic to find a default project for user
@@ -271,12 +268,12 @@ class AuthManager(object):
 
         project = self.get_project(project_id)
         if project == None:
-            raise exception.NotFound('No project called %s could be found' %
-                                     project_id)
+            raise exception.NotFound(_('No project called %s could be found')
+                                     % project_id)
         if not self.is_admin(user) and not self.is_project_member(user,
                                                                   project):
-            raise exception.NotFound('User %s is not a member of project %s' %
-                                     (user.id, project.id))
+            raise exception.NotFound(_('User %s is not a member of project %s')
+                                     % (user.id, project.id))
         if check_type == 's3':
             sign = signer.Signer(user.secret.encode())
             expected_signature = sign.s3_authorization(headers, verb, path)
@@ -284,7 +281,7 @@ class AuthManager(object):
             logging.debug('expected_signature: %s', expected_signature)
             logging.debug('signature: %s', signature)
             if signature != expected_signature:
-                raise exception.NotAuthorized('Signature does not match')
+                raise exception.NotAuthorized(_('Signature does not match'))
         elif check_type == 'ec2':
             # NOTE(vish): hmac can't handle unicode, so encode ensures that
             #             secret isn't unicode
@@ -294,7 +291,7 @@ class AuthManager(object):
             logging.debug('expected_signature: %s', expected_signature)
             logging.debug('signature: %s', signature)
             if signature != expected_signature:
-                raise exception.NotAuthorized('Signature does not match')
+                raise exception.NotAuthorized(_('Signature does not match'))
         return (user, project)
 
     def get_access_key(self, user, project):
@@ -364,7 +361,7 @@ class AuthManager(object):
         with self.driver() as drv:
             if role == 'projectmanager':
                 if not project:
-                    raise exception.Error("Must specify project")
+                    raise exception.Error(_("Must specify project"))
                 return self.is_project_manager(user, project)
 
             global_role = drv.has_role(User.safe_id(user),
@@ -398,9 +395,9 @@ class AuthManager(object):
         @param project: Project in which to add local role.
         """
         if role not in FLAGS.allowed_roles:
-            raise exception.NotFound("The %s role can not be found" % role)
+            raise exception.NotFound(_("The %s role can not be found") % role)
         if project is not None and role in FLAGS.global_roles:
-            raise exception.NotFound("The %s role is global only" % role)
+            raise exception.NotFound(_("The %s role is global only") % role)
         with self.driver() as drv:
             drv.add_role(User.safe_id(user), role, Project.safe_id(project))
 
@@ -543,10 +540,10 @@ class AuthManager(object):
         """
 
         network_ref = db.project_get_network(context.get_admin_context(),
-                                             Project.safe_id(project))
+                                             Project.safe_id(project), False)
 
-        if not network_ref['vpn_public_port']:
-            raise exception.NotFound('project network data has not been set')
+        if not network_ref:
+            return (None, None)
         return (network_ref['vpn_public_address'],
                 network_ref['vpn_public_port'])
 
@@ -628,27 +625,37 @@ class AuthManager(object):
     def get_key_pairs(context):
         return db.key_pair_get_all_by_user(context.elevated(), context.user_id)
 
-    def get_credentials(self, user, project=None):
+    def get_credentials(self, user, project=None, use_dmz=True):
         """Get credential zip for user in project"""
         if not isinstance(user, User):
             user = self.get_user(user)
         if project is None:
             project = user.id
         pid = Project.safe_id(project)
-        rc = self.__generate_rc(user.access, user.secret, pid)
-        private_key, signed_cert = self._generate_x509_cert(user.id, pid)
+        private_key, signed_cert = crypto.generate_x509_cert(user.id, pid)
 
         tmpdir = tempfile.mkdtemp()
         zf = os.path.join(tmpdir, "temp.zip")
         zippy = zipfile.ZipFile(zf, 'w')
-        zippy.writestr(FLAGS.credential_rc_file, rc)
+        if use_dmz and FLAGS.region_list:
+            regions = {}
+            for item in FLAGS.region_list:
+                region, _sep, region_host = item.partition("=")
+                regions[region] = region_host
+        else:
+            regions = {'nova': FLAGS.cc_host}
+        for region, host in regions.iteritems():
+            rc = self.__generate_rc(user.access,
+                                    user.secret,
+                                    pid,
+                                    use_dmz,
+                                    host)
+            zippy.writestr(FLAGS.credential_rc_file % region, rc)
+
         zippy.writestr(FLAGS.credential_key_file, private_key)
         zippy.writestr(FLAGS.credential_cert_file, signed_cert)
 
-        try:
-            (vpn_ip, vpn_port) = self.get_project_vpn_data(project)
-        except exception.NotFound:
-            vpn_ip = None
+        (vpn_ip, vpn_port) = self.get_project_vpn_data(project)
         if vpn_ip:
             configfile = open(FLAGS.vpn_client_template, "r")
             s = string.Template(configfile.read())
@@ -659,10 +666,9 @@ class AuthManager(object):
                                   port=vpn_port)
             zippy.writestr(FLAGS.credential_vpn_file, config)
         else:
-            logging.warn("No vpn data for project %s" %
-                                  pid)
+            logging.warn(_("No vpn data for project %s"), pid)
 
-        zippy.writestr(FLAGS.ca_file, crypto.fetch_ca(user.id))
+        zippy.writestr(FLAGS.ca_file, crypto.fetch_ca(pid))
         zippy.close()
         with open(zf, 'rb') as f:
             read_buffer = f.read()
@@ -670,38 +676,38 @@ class AuthManager(object):
         shutil.rmtree(tmpdir)
         return read_buffer
 
-    def get_environment_rc(self, user, project=None):
+    def get_environment_rc(self, user, project=None, use_dmz=True):
         """Get credential zip for user in project"""
         if not isinstance(user, User):
             user = self.get_user(user)
         if project is None:
             project = user.id
         pid = Project.safe_id(project)
-        return self.__generate_rc(user.access, user.secret, pid)
+        return self.__generate_rc(user.access, user.secret, pid, use_dmz)
 
     @staticmethod
-    def __generate_rc(access, secret, pid):
+    def __generate_rc(access, secret, pid, use_dmz=True, host=None):
         """Generate rc file for user"""
+        if use_dmz:
+            cc_host = FLAGS.cc_dmz
+        else:
+            cc_host = FLAGS.cc_host
+        # NOTE(vish): Always use the dmz since it is used from inside the
+        #             instance
+        s3_host = FLAGS.s3_dmz
+        if host:
+            s3_host = host
+            cc_host = host
         rc = open(FLAGS.credentials_template).read()
         rc = rc % {'access': access,
                    'project': pid,
                    'secret': secret,
-                   'ec2': FLAGS.ec2_url,
-                   's3': 'http://%s:%s' % (FLAGS.s3_host, FLAGS.s3_port),
+                   'ec2': '%s://%s:%s%s' % (FLAGS.ec2_prefix,
+                                            cc_host,
+                                            FLAGS.cc_port,
+                                            FLAGS.ec2_suffix),
+                   's3': 'http://%s:%s' % (s3_host, FLAGS.s3_port),
                    'nova': FLAGS.ca_file,
                    'cert': FLAGS.credential_cert_file,
                    'key': FLAGS.credential_key_file}
         return rc
-
-    def _generate_x509_cert(self, uid, pid):
-        """Generate x509 cert for user"""
-        (private_key, csr) = crypto.generate_x509_cert(
-                self.__cert_subject(uid))
-        # TODO(joshua): This should be async call back to the cloud controller
-        signed_cert = crypto.sign_csr(csr, pid)
-        return (private_key, signed_cert)
-
-    @staticmethod
-    def __cert_subject(uid):
-        """Helper to generate cert subject"""
-        return FLAGS.credential_cert_subject % (uid, utils.isotime())
diff --git a/nova/cloudpipe/bootscript.sh b/nova/cloudpipe/bootscript.sh
deleted file mode 100755
index 30d9ad102..000000000
--- a/nova/cloudpipe/bootscript.sh
+++ /dev/null
@@ -1,63 +0,0 @@
-#!/bin/bash
-# vim: tabstop=4 shiftwidth=4 softtabstop=4
-
-# Copyright 2010 United States Government as represented by the
-# Administrator of the National Aeronautics and Space Administration.
-# All Rights Reserved.
-#
-#    Licensed under the Apache License, Version 2.0 (the "License"); you may
-#    not use this file except in compliance with the License. You may obtain
-#    a copy of the License at
-#
-#         http://www.apache.org/licenses/LICENSE-2.0
-#
-#    Unless required by applicable law or agreed to in writing, software
-#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-#    License for the specific language governing permissions and limitations
-#    under the License.
-
-# This gets zipped and run on the cloudpipe-managed OpenVPN server
-
-export SUPERVISOR="http://10.255.255.1:8773/cloudpipe"
-export VPN_IP=`ifconfig  | grep 'inet addr:'| grep -v '127.0.0.1' | cut -d: -f2 | awk '{print $1}'`
-export BROADCAST=`ifconfig  | grep 'inet addr:'| grep -v '127.0.0.1' | cut -d: -f3 | awk '{print $1}'`
-export DHCP_MASK=`ifconfig  | grep 'inet addr:'| grep -v '127.0.0.1' | cut -d: -f4 | awk '{print $1}'`
-export GATEWAY=`netstat -r | grep default | cut -d' ' -f10`
-export SUBJ="/C=US/ST=California/L=MountainView/O=AnsoLabs/OU=NovaDev/CN=customer-vpn-$VPN_IP"
-
-DHCP_LOWER=`echo $BROADCAST | awk -F. '{print $1"."$2"."$3"." $4 - 10 }'`
-DHCP_UPPER=`echo $BROADCAST | awk -F. '{print $1"."$2"."$3"." $4 - 1 }'`
-
-# generate a server DH
-openssl dhparam -out /etc/openvpn/dh1024.pem 1024
-
-# generate a server priv key
-openssl genrsa -out /etc/openvpn/server.key 2048
-
-# generate a server CSR
-openssl req -new -key /etc/openvpn/server.key -out /etc/openvpn/server.csr -batch -subj "$SUBJ"
-
-# URLEncode the CSR
-CSRTEXT=`cat /etc/openvpn/server.csr`
-CSRTEXT=$(python -c "import urllib; print urllib.quote('''$CSRTEXT''')")
-
-# SIGN the csr and save as server.crt
-# CURL fetch to the supervisor, POSTing the CSR text, saving the result as the CRT file
-curl --fail $SUPERVISOR -d "cert=$CSRTEXT" > /etc/openvpn/server.crt
-curl --fail $SUPERVISOR/getca/ > /etc/openvpn/ca.crt
-
-# Customize the server.conf.template
-cd /etc/openvpn
-
-sed -e s/VPN_IP/$VPN_IP/g server.conf.template > server.conf
-sed -i -e s/DHCP_SUBNET/$DHCP_MASK/g server.conf
-sed -i -e s/DHCP_LOWER/$DHCP_LOWER/g server.conf
-sed -i -e s/DHCP_UPPER/$DHCP_UPPER/g server.conf
-sed -i -e s/max-clients\ 1/max-clients\ 10/g server.conf
-
-echo "\npush \"route 10.255.255.1 255.255.255.255 $GATEWAY\"\n" >> server.conf
-echo "\npush \"route 10.255.255.253 255.255.255.255 $GATEWAY\"\n" >> server.conf
-echo "\nduplicate-cn\n" >> server.conf
-
-/etc/init.d/openvpn start
diff --git a/nova/cloudpipe/bootscript.template b/nova/cloudpipe/bootscript.template
new file mode 100755
index 000000000..11578c134
--- /dev/null
+++ b/nova/cloudpipe/bootscript.template
@@ -0,0 +1,50 @@
+#!/bin/bash
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2010 United States Government as represented by the
+# Administrator of the National Aeronautics and Space Administration.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+# This gets zipped and run on the cloudpipe-managed OpenVPN server
+
+export VPN_IP=`ifconfig  | grep 'inet addr:'| grep -v '127.0.0.1' | cut -d: -f2 | awk '{print $$1}'`
+export BROADCAST=`ifconfig  | grep 'inet addr:'| grep -v '127.0.0.1' | cut -d: -f3 | awk '{print $$1}'`
+export DHCP_MASK=`ifconfig  | grep 'inet addr:'| grep -v '127.0.0.1' | cut -d: -f4 | awk '{print $$1}'`
+export GATEWAY=`netstat -r | grep default | cut -d' ' -f10`
+
+DHCP_LOWER=`echo $$BROADCAST | awk -F. '{print $$1"."$$2"."$$3"." $$4 - ${num_vpn} }'`
+DHCP_UPPER=`echo $$BROADCAST | awk -F. '{print $$1"."$$2"."$$3"." $$4 - 1 }'`
+
+# generate a server DH
+openssl dhparam -out /etc/openvpn/dh1024.pem 1024
+
+cp crl.pem /etc/openvpn/
+cp server.key /etc/openvpn/
+cp ca.crt /etc/openvpn/
+cp server.crt /etc/openvpn/
+# Customize the server.conf.template
+cd /etc/openvpn
+
+sed -e s/VPN_IP/$$VPN_IP/g server.conf.template > server.conf
+sed -i -e s/DHCP_SUBNET/$$DHCP_MASK/g server.conf
+sed -i -e s/DHCP_LOWER/$$DHCP_LOWER/g server.conf
+sed -i -e s/DHCP_UPPER/$$DHCP_UPPER/g server.conf
+sed -i -e s/max-clients\ 1/max-clients\ 10/g server.conf
+
+echo "push \"route ${dmz_net} ${dmz_mask} $$GATEWAY\"" >> server.conf
+echo "duplicate-cn" >> server.conf
+echo "crl-verify /etc/openvpn/crl.pem" >> server.conf
+
+/etc/init.d/openvpn start
diff --git a/nova/cloudpipe/pipelib.py b/nova/cloudpipe/pipelib.py
index 3472201cd..09361828d 100644
--- a/nova/cloudpipe/pipelib.py
+++ b/nova/cloudpipe/pipelib.py
@@ -22,13 +22,15 @@ an instance with it.
 
 """
 
-import base64
 import logging
 import os
+import string
 import tempfile
 import zipfile
 
 from nova import context
+from nova import crypto
+from nova import db
 from nova import exception
 from nova import flags
 from nova import utils
@@ -39,8 +41,17 @@ from nova.api.ec2 import cloud
 
 FLAGS = flags.FLAGS
 flags.DEFINE_string('boot_script_template',
-                    utils.abspath('cloudpipe/bootscript.sh'),
-                    'Template for script to run on cloudpipe instance boot')
+                    utils.abspath('cloudpipe/bootscript.template'),
+                    _('Template for script to run on cloudpipe instance boot'))
+flags.DEFINE_string('dmz_net',
+                    '10.0.0.0',
+                    _('Network to push into openvpn config'))
+flags.DEFINE_string('dmz_mask',
+                    '255.255.255.0',
+                    _('Netmask to push into openvpn config'))
+
+
+LOG = logging.getLogger('nova-cloudpipe')
 
 
 class CloudPipe(object):
@@ -48,64 +59,96 @@ class CloudPipe(object):
         self.controller = cloud.CloudController()
         self.manager = manager.AuthManager()
 
-    def launch_vpn_instance(self, project_id):
-        logging.debug("Launching VPN for %s" % (project_id))
-        project = self.manager.get_project(project_id)
+    def get_encoded_zip(self, project_id):
         # Make a payload.zip
         tmpfolder = tempfile.mkdtemp()
         filename = "payload.zip"
         zippath = os.path.join(tmpfolder, filename)
         z = zipfile.ZipFile(zippath, "w", zipfile.ZIP_DEFLATED)
-
-        z.write(FLAGS.boot_script_template, 'autorun.sh')
+        shellfile = open(FLAGS.boot_script_template, "r")
+        s = string.Template(shellfile.read())
+        shellfile.close()
+        boot_script = s.substitute(cc_dmz=FLAGS.cc_dmz,
+                                   cc_port=FLAGS.cc_port,
+                                   dmz_net=FLAGS.dmz_net,
+                                   dmz_mask=FLAGS.dmz_mask,
+                                   num_vpn=FLAGS.cnt_vpn_clients)
+        # genvpn, sign csr
+        crypto.generate_vpn_files(project_id)
+        z.writestr('autorun.sh', boot_script)
+        crl = os.path.join(crypto.ca_folder(project_id), 'crl.pem')
+        z.write(crl, 'crl.pem')
+        server_key = os.path.join(crypto.ca_folder(project_id), 'server.key')
+        z.write(server_key, 'server.key')
+        ca_crt = os.path.join(crypto.ca_path(project_id))
+        z.write(ca_crt, 'ca.crt')
+        server_crt = os.path.join(crypto.ca_folder(project_id), 'server.crt')
+        z.write(server_crt, 'server.crt')
         z.close()
-
-        key_name = self.setup_key_pair(project.project_manager_id, project_id)
         zippy = open(zippath, "r")
-        context = context.RequestContext(user=project.project_manager,
-                                         project=project)
-
-        reservation = self.controller.run_instances(context,
-            # Run instances expects encoded userdata, it is decoded in the
-            # get_metadata_call. autorun.sh also decodes the zip file, hence
-            # the double encoding.
-            user_data=zippy.read().encode("base64").encode("base64"),
+        # NOTE(vish): run instances expects encoded userdata, it is decoded
+        # in the get_metadata_call. autorun.sh also decodes the zip file,
+        # hence the double encoding.
+        encoded = zippy.read().encode("base64").encode("base64")
+        zippy.close()
+        return encoded
+
+    def launch_vpn_instance(self, project_id):
+        LOG.debug(_("Launching VPN for %s") % (project_id))
+        project = self.manager.get_project(project_id)
+        ctxt = context.RequestContext(user=project.project_manager,
+                                      project=project)
+        key_name = self.setup_key_pair(ctxt)
+        group_name = self.setup_security_group(ctxt)
+
+        reservation = self.controller.run_instances(ctxt,
+            user_data=self.get_encoded_zip(project_id),
             max_count=1,
             min_count=1,
             instance_type='m1.tiny',
             image_id=FLAGS.vpn_image_id,
             key_name=key_name,
-            security_groups=["vpn-secgroup"])
-        zippy.close()
+            security_group=[group_name])
+
+    def setup_security_group(self, context):
+        group_name = '%s%s' % (context.project.id, FLAGS.vpn_key_suffix)
+        if db.security_group_exists(context, context.project.id, group_name):
+            return group_name
+        group = {'user_id': context.user.id,
+                 'project_id': context.project.id,
+                 'name': group_name,
+                 'description': 'Group for vpn'}
+        group_ref = db.security_group_create(context, group)
+        rule = {'parent_group_id': group_ref['id'],
+                'cidr': '0.0.0.0/0',
+                'protocol': 'udp',
+                'from_port': 1194,
+                'to_port': 1194}
+        db.security_group_rule_create(context, rule)
+        rule = {'parent_group_id': group_ref['id'],
+                'cidr': '0.0.0.0/0',
+                'protocol': 'icmp',
+                'from_port': -1,
+                'to_port': -1}
+        db.security_group_rule_create(context, rule)
+        # NOTE(vish): No need to trigger the group since the instance
+        #             has not been run yet.
+        return group_name
 
-    def setup_key_pair(self, user_id, project_id):
-        key_name = '%s%s' % (project_id, FLAGS.vpn_key_suffix)
+    def setup_key_pair(self, context):
+        key_name = '%s%s' % (context.project.id, FLAGS.vpn_key_suffix)
         try:
-            private_key, fingerprint = self.manager.generate_key_pair(user_id,
-                                                                      key_name)
+            result = cloud._gen_key(context, context.user.id, key_name)
+            private_key = result['private_key']
             try:
-                key_dir = os.path.join(FLAGS.keys_path, user_id)
+                key_dir = os.path.join(FLAGS.keys_path, context.user.id)
                 if not os.path.exists(key_dir):
                     os.makedirs(key_dir)
-                file_name = os.path.join(key_dir, '%s.pem' % key_name)
-                with open(file_name, 'w') as f:
+                key_path = os.path.join(key_dir, '%s.pem' % key_name)
+                with open(key_path, 'w') as f:
                     f.write(private_key)
             except:
                 pass
         except exception.Duplicate:
             pass
         return key_name
-
-    # def setup_secgroups(self, username):
-    #     conn = self.euca.connection_for(username)
-    #     try:
-    #         secgroup = conn.create_security_group("vpn-secgroup",
-    #                                               "vpn-secgroup")
-    #         secgroup.authorize(ip_protocol = "udp", from_port = "1194",
-    #                            to_port = "1194", cidr_ip = "0.0.0.0/0")
-    #         secgroup.authorize(ip_protocol = "tcp", from_port = "80",
-    #                            to_port = "80", cidr_ip = "0.0.0.0/0")
-    #         secgroup.authorize(ip_protocol = "tcp", from_port = "22",
-    #                            to_port = "22", cidr_ip = "0.0.0.0/0")
-    #     except:
-    #         pass
diff --git a/nova/compute/api.py b/nova/compute/api.py
index cb23dae55..4953fe559 100644
--- a/nova/compute/api.py
+++ b/nova/compute/api.py
@@ -53,11 +53,28 @@ class ComputeAPI(base.Base):
         self.image_service = image_service
         super(ComputeAPI, self).__init__(**kwargs)
 
+    def get_network_topic(self, context, instance_id):
+        try:
+            instance = self.db.instance_get_by_internal_id(context,
+                                                           instance_id)
+        except exception.NotFound as e:
+            logging.warning("Instance %d was not found in get_network_topic",
+                            instance_id)
+            raise e
+
+        host = instance['host']
+        if not host:
+            raise exception.Error("Instance %d has no host" % instance_id)
+        topic = self.db.queue_get_for(context, FLAGS.compute_topic, host)
+        return rpc.call(context,
+                        topic,
+                        {"method": "get_network_topic", "args": {'fake': 1}})
+
     def create_instances(self, context, instance_type, image_id, min_count=1,
                          max_count=1, kernel_id=None, ramdisk_id=None,
-                         display_name='', description='', user_data='',
-                         key_name=None, key_data=None,
-                         security_group='default',
+                         display_name='', description='', key_name=None,
+                         key_data=None, security_group='default',
+                         user_data=None,
                          generate_hostname=generate_default_hostname):
         """Create the number of instances requested if quote and
         other arguments check out ok."""
@@ -74,14 +91,19 @@ class ComputeAPI(base.Base):
         is_vpn = image_id == FLAGS.vpn_image_id
         if not is_vpn:
             image = self.image_service.show(context, image_id)
+
+            # If kernel_id/ramdisk_id isn't explicitly set in API call
+            # we take the defaults from the image's metadata
             if kernel_id is None:
-                kernel_id = image.get('kernelId', FLAGS.default_kernel)
+                kernel_id = image.get('kernelId', None)
             if ramdisk_id is None:
-                ramdisk_id = image.get('ramdiskId', FLAGS.default_ramdisk)
+                ramdisk_id = image.get('ramdiskId', None)
 
             # Make sure we have access to kernel and ramdisk
-            self.image_service.show(context, kernel_id)
-            self.image_service.show(context, ramdisk_id)
+            if kernel_id:
+                self.image_service.show(context, kernel_id)
+            if ramdisk_id:
+                self.image_service.show(context, ramdisk_id)
 
         if security_group is None:
             security_group = ['default']
@@ -104,8 +126,8 @@ class ComputeAPI(base.Base):
         base_options = {
             'reservation_id': utils.generate_uid('r'),
             'image_id': image_id,
-            'kernel_id': kernel_id,
-            'ramdisk_id': ramdisk_id,
+            'kernel_id': kernel_id or '',
+            'ramdisk_id': ramdisk_id or '',
             'state_description': 'scheduling',
             'user_id': context.user_id,
             'project_id': context.project_id,
@@ -116,12 +138,13 @@ class ComputeAPI(base.Base):
             'local_gb': type_data['local_gb'],
             'display_name': display_name,
             'display_description': description,
+            'user_data': user_data or '',
             'key_name': key_name,
             'key_data': key_data}
 
         elevated = context.elevated()
         instances = []
-        logging.debug("Going to run %s instances...", num_instances)
+        logging.debug(_("Going to run %s instances..."), num_instances)
         for num in range(num_instances):
             instance = dict(mac_address=utils.generate_mac(),
                             launch_index=num,
@@ -146,20 +169,8 @@ class ComputeAPI(base.Base):
             instance = self.update_instance(context, instance_id, **updates)
             instances.append(instance)
 
-            # TODO(vish): This probably should be done in the scheduler
-            #             or in compute as a call.  The network should be
-            #             allocated after the host is assigned and setup
-            #             can happen at the same time.
-            address = self.network_manager.allocate_fixed_ip(context,
-                                                             instance_id,
-                                                             is_vpn)
-            rpc.cast(elevated,
-                     self._get_network_topic(context),
-                     {"method": "setup_fixed_ip",
-                      "args": {"address": address}})
-
-            logging.debug("Casting to scheduler for %s/%s's instance %s" %
-                          (context.project_id, context.user_id, instance_id))
+            logging.debug(_("Casting to scheduler for %s/%s's instance %s"),
+                          context.project_id, context.user_id, instance_id)
             rpc.cast(context,
                      FLAGS.scheduler_topic,
                      {"method": "run_instance",
@@ -169,6 +180,12 @@ class ComputeAPI(base.Base):
         return instances
 
     def ensure_default_security_group(self, context):
+        """ Create security group for the security context if it
+        does not already exist
+
+        :param context: the security context
+
+        """
         try:
             db.security_group_get_by_name(context, context.project_id,
                                           'default')
@@ -177,7 +194,7 @@ class ComputeAPI(base.Base):
                       'description': 'default',
                       'user_id': context.user_id,
                       'project_id': context.project_id}
-            group = db.security_group_create(context, values)
+            db.security_group_create(context, values)
 
     def update_instance(self, context, instance_id, **kwargs):
         """Updates the instance in the datastore.
@@ -199,12 +216,12 @@ class ComputeAPI(base.Base):
             instance = self.db.instance_get_by_internal_id(context,
                                                            instance_id)
         except exception.NotFound as e:
-            logging.warning("Instance %d was not found during terminate",
+            logging.warning(_("Instance %d was not found during terminate"),
                             instance_id)
             raise e
 
         if (instance['state_description'] == 'terminating'):
-            logging.warning("Instance %d is already being terminated",
+            logging.warning(_("Instance %d is already being terminated"),
                             instance_id)
             return
 
@@ -214,28 +231,6 @@ class ComputeAPI(base.Base):
                              state=0,
                              terminated_at=datetime.datetime.utcnow())
 
-        # FIXME(ja): where should network deallocate occur?
-        address = self.db.instance_get_floating_address(context,
-                                                        instance['id'])
-        if address:
-            logging.debug("Disassociating address %s" % address)
-            # NOTE(vish): Right now we don't really care if the ip is
-            #             disassociated.  We may need to worry about
-            #             checking this later.  Perhaps in the scheduler?
-            rpc.cast(context,
-                     self._get_network_topic(context),
-                     {"method": "disassociate_floating_ip",
-                      "args": {"floating_address": address}})
-
-        address = self.db.instance_get_fixed_address(context, instance['id'])
-        if address:
-            logging.debug("Deallocating address %s" % address)
-            # NOTE(vish): Currently, nothing needs to be done on the
-            #             network node until release. If this changes,
-            #             we will need to cast here.
-            self.network_manager.deallocate_fixed_ip(context.elevated(),
-                                                     address)
-
         host = instance['host']
         if host:
             rpc.cast(context,
@@ -270,6 +265,24 @@ class ComputeAPI(base.Base):
                  {"method": "reboot_instance",
                   "args": {"instance_id": instance['id']}})
 
+    def pause(self, context, instance_id):
+        """Pause the given instance."""
+        instance = self.db.instance_get_by_internal_id(context, instance_id)
+        host = instance['host']
+        rpc.cast(context,
+                 self.db.queue_get_for(context, FLAGS.compute_topic, host),
+                 {"method": "pause_instance",
+                  "args": {"instance_id": instance['id']}})
+
+    def unpause(self, context, instance_id):
+        """Unpause the given instance."""
+        instance = self.db.instance_get_by_internal_id(context, instance_id)
+        host = instance['host']
+        rpc.cast(context,
+                 self.db.queue_get_for(context, FLAGS.compute_topic, host),
+                 {"method": "unpause_instance",
+                  "args": {"instance_id": instance['id']}})
+
     def rescue(self, context, instance_id):
         """Rescue the given instance."""
         instance = self.db.instance_get_by_internal_id(context, instance_id)
@@ -287,14 +300,3 @@ class ComputeAPI(base.Base):
                  self.db.queue_get_for(context, FLAGS.compute_topic, host),
                  {"method": "unrescue_instance",
                   "args": {"instance_id": instance['id']}})
-
-    def _get_network_topic(self, context):
-        """Retrieves the network host for a project"""
-        network_ref = self.network_manager.get_network(context)
-        host = network_ref['host']
-        if not host:
-            host = rpc.call(context,
-                            FLAGS.network_topic,
-                            {"method": "set_network_host",
-                             "args": {"network_id": network_ref['id']}})
-        return self.db.queue_get_for(context, FLAGS.network_topic, host)
diff --git a/nova/compute/disk.py b/nova/compute/disk.py
index 4338d39f0..814a258cd 100644
--- a/nova/compute/disk.py
+++ b/nova/compute/disk.py
@@ -26,8 +26,6 @@ import logging
 import os
 import tempfile
 
-from twisted.internet import defer
-
 from nova import exception
 from nova import flags
 
@@ -39,7 +37,6 @@ flags.DEFINE_integer('block_size', 1024 * 1024 * 256,
                      'block_size to use for dd')
 
 
-@defer.inlineCallbacks
 def partition(infile, outfile, local_bytes=0, resize=True,
               local_type='ext2', execute=None):
     """
@@ -64,18 +61,18 @@ def partition(infile, outfile, local_bytes=0, resize=True,
     file_size = os.path.getsize(infile)
     if resize and file_size < FLAGS.minimum_root_size:
         last_sector = FLAGS.minimum_root_size / sector_size - 1
-        yield execute('dd if=/dev/zero of=%s count=1 seek=%d bs=%d'
-                      % (infile, last_sector, sector_size))
-        yield execute('e2fsck -fp %s' % infile, check_exit_code=False)
-        yield execute('resize2fs %s' % infile)
+        execute('dd if=/dev/zero of=%s count=1 seek=%d bs=%d'
+                % (infile, last_sector, sector_size))
+        execute('e2fsck -fp %s' % infile, check_exit_code=False)
+        execute('resize2fs %s' % infile)
         file_size = FLAGS.minimum_root_size
     elif file_size % sector_size != 0:
-        logging.warn("Input partition size not evenly divisible by"
-                     " sector size: %d / %d", file_size, sector_size)
+        logging.warn(_("Input partition size not evenly divisible by"
+                       " sector size: %d / %d"), file_size, sector_size)
     primary_sectors = file_size / sector_size
     if local_bytes % sector_size != 0:
-        logging.warn("Bytes for local storage not evenly divisible"
-                     " by sector size: %d / %d", local_bytes, sector_size)
+        logging.warn(_("Bytes for local storage not evenly divisible"
+                       " by sector size: %d / %d"), local_bytes, sector_size)
     local_sectors = local_bytes / sector_size
 
     mbr_last = 62  # a
@@ -86,30 +83,36 @@ def partition(infile, outfile, local_bytes=0, resize=True,
     last_sector = local_last  # e
 
     # create an empty file
-    yield execute('dd if=/dev/zero of=%s count=1 seek=%d bs=%d'
-                  % (outfile, mbr_last, sector_size))
+    execute('dd if=/dev/zero of=%s count=1 seek=%d bs=%d'
+            % (outfile, mbr_last, sector_size))
 
     # make mbr partition
-    yield execute('parted --script %s mklabel msdos' % outfile)
+    execute('parted --script %s mklabel msdos' % outfile)
 
     # append primary file
-    yield execute('dd if=%s of=%s bs=%s conv=notrunc,fsync oflag=append'
-                  % (infile, outfile, FLAGS.block_size))
+    execute('dd if=%s of=%s bs=%s conv=notrunc,fsync oflag=append'
+            % (infile, outfile, FLAGS.block_size))
 
     # make primary partition
-    yield execute('parted --script %s mkpart primary %ds %ds'
-                  % (outfile, primary_first, primary_last))
+    execute('parted --script %s mkpart primary %ds %ds'
+            % (outfile, primary_first, primary_last))
 
     if local_bytes > 0:
         # make the file bigger
-        yield execute('dd if=/dev/zero of=%s count=1 seek=%d bs=%d'
-                      % (outfile, last_sector, sector_size))
+        execute('dd if=/dev/zero of=%s count=1 seek=%d bs=%d'
+                % (outfile, last_sector, sector_size))
         # make and format local partition
-        yield execute('parted --script %s mkpartfs primary %s %ds %ds'
-                      % (outfile, local_type, local_first, local_last))
+        execute('parted --script %s mkpartfs primary %s %ds %ds'
+                % (outfile, local_type, local_first, local_last))
+
+
+def extend(image, size, execute):
+    file_size = os.path.getsize(image)
+    if file_size >= size:
+        return
+    return execute('truncate -s size %s' % (image,))
 
 
-@defer.inlineCallbacks
 def inject_data(image, key=None, net=None, partition=None, execute=None):
     """Injects a ssh key and optionally net data into a disk image.
 
@@ -119,74 +122,83 @@ def inject_data(image, key=None, net=None, partition=None, execute=None):
     If partition is not specified it mounts the image as a single partition.
 
     """
-    out, err = yield execute('sudo losetup -f --show %s' % image)
+    out, err = execute('sudo losetup --find --show %s' % image)
     if err:
-        raise exception.Error('Could not attach image to loopback: %s' % err)
+        raise exception.Error(_('Could not attach image to loopback: %s')
+                              % err)
     device = out.strip()
     try:
         if not partition is None:
             # create partition
-            out, err = yield execute('sudo kpartx -a %s' % device)
+            out, err = execute('sudo kpartx -a %s' % device)
             if err:
-                raise exception.Error('Failed to load partition: %s' % err)
+                raise exception.Error(_('Failed to load partition: %s') % err)
             mapped_device = '/dev/mapper/%sp%s' % (device.split('/')[-1],
                                                    partition)
         else:
             mapped_device = device
-        out, err = yield execute('sudo tune2fs -c 0 -i 0 %s' % mapped_device)
+
+        # We can only loopback mount raw images. If the device isn't there,
+        # it's normally because it's a .vmdk or a .vdi etc
+        if not os.path.exists(mapped_device):
+            raise exception.Error('Mapped device was not found (we can'
+                                  ' only inject raw disk images): %s' %
+                                  mapped_device)
+
+        # Configure ext2fs so that it doesn't auto-check every N boots
+        out, err = execute('sudo tune2fs -c 0 -i 0 %s' % mapped_device)
 
         tmpdir = tempfile.mkdtemp()
         try:
             # mount loopback to dir
-            out, err = yield execute(
+            out, err = execute(
                     'sudo mount %s %s' % (mapped_device, tmpdir))
             if err:
-                raise exception.Error('Failed to mount filesystem: %s' % err)
+                raise exception.Error(_('Failed to mount filesystem: %s')
+                                      % err)
 
             try:
                 if key:
                     # inject key file
-                    yield _inject_key_into_fs(key, tmpdir, execute=execute)
+                    _inject_key_into_fs(key, tmpdir, execute=execute)
                 if net:
-                    yield _inject_net_into_fs(net, tmpdir, execute=execute)
+                    _inject_net_into_fs(net, tmpdir, execute=execute)
             finally:
                 # unmount device
-                yield execute('sudo umount %s' % mapped_device)
+                execute('sudo umount %s' % mapped_device)
         finally:
             # remove temporary directory
-            yield execute('rmdir %s' % tmpdir)
+            execute('rmdir %s' % tmpdir)
             if not partition is None:
                 # remove partitions
-                yield execute('sudo kpartx -d %s' % device)
+                execute('sudo kpartx -d %s' % device)
     finally:
         # remove loopback
-        yield execute('sudo losetup -d %s' % device)
+        execute('sudo losetup --detach %s' % device)
 
 
-@defer.inlineCallbacks
 def _inject_key_into_fs(key, fs, execute=None):
     """Add the given public ssh key to root's authorized_keys.
 
     key is an ssh key string.
     fs is the path to the base of the filesystem into which to inject the key.
     """
-    sshdir = os.path.join(os.path.join(fs, 'root'), '.ssh')
-    yield execute('sudo mkdir -p %s' % sshdir)  # existing dir doesn't matter
-    yield execute('sudo chown root %s' % sshdir)
-    yield execute('sudo chmod 700 %s' % sshdir)
+    sshdir = os.path.join(fs, 'root', '.ssh')
+    execute('sudo mkdir -p %s' % sshdir)  # existing dir doesn't matter
+    execute('sudo chown root %s' % sshdir)
+    execute('sudo chmod 700 %s' % sshdir)
     keyfile = os.path.join(sshdir, 'authorized_keys')
-    yield execute('sudo tee -a %s' % keyfile, '\n' + key.strip() + '\n')
+    execute('sudo tee -a %s' % keyfile, '\n' + key.strip() + '\n')
 
 
-@defer.inlineCallbacks
 def _inject_net_into_fs(net, fs, execute=None):
     """Inject /etc/network/interfaces into the filesystem rooted at fs.
 
     net is the contents of /etc/network/interfaces.
     """
     netdir = os.path.join(os.path.join(fs, 'etc'), 'network')
-    yield execute('sudo mkdir -p %s' % netdir)  # existing dir doesn't matter
-    yield execute('sudo chown root:root %s' % netdir)
-    yield execute('sudo chmod 755 %s' % netdir)
+    execute('sudo mkdir -p %s' % netdir)  # existing dir doesn't matter
+    execute('sudo chown root:root %s' % netdir)
+    execute('sudo chmod 755 %s' % netdir)
     netfile = os.path.join(netdir, 'interfaces')
-    yield execute('sudo tee %s' % netfile, net)
+    execute('sudo tee %s' % netfile, net)
diff --git a/nova/compute/instance_types.py b/nova/compute/instance_types.py
index a2679e0fc..196d6a8df 100644
--- a/nova/compute/instance_types.py
+++ b/nova/compute/instance_types.py
@@ -22,6 +22,7 @@ The built-in instance properties.
 """
 
 from nova import flags
+from nova import exception
 
 FLAGS = flags.FLAGS
 INSTANCE_TYPES = {
@@ -37,7 +38,7 @@ def get_by_type(instance_type):
     if instance_type is None:
         return FLAGS.default_instance_type
     if instance_type not in INSTANCE_TYPES:
-        raise exception.ApiError("Unknown instance type: %s",
+        raise exception.ApiError(_("Unknown instance type: %s"),
                                  instance_type)
     return instance_type
 
diff --git a/nova/compute/manager.py b/nova/compute/manager.py
index dd8d41129..de114bdeb 100644
--- a/nova/compute/manager.py
+++ b/nova/compute/manager.py
@@ -37,11 +37,10 @@ terminating it.
 import datetime
 import logging
 
-from twisted.internet import defer
-
 from nova import exception
 from nova import flags
 from nova import manager
+from nova import rpc
 from nova import utils
 from nova.compute import power_state
 
@@ -50,6 +49,8 @@ flags.DEFINE_string('instances_path', '$state_path/instances',
                     'where instances are stored on disk')
 flags.DEFINE_string('compute_driver', 'nova.virt.connection.get_connection',
                     'Driver to use for controlling virtualization')
+flags.DEFINE_string('stub_network', False,
+                    'Stub network related code')
 
 
 class ComputeManager(manager.Manager):
@@ -67,6 +68,12 @@ class ComputeManager(manager.Manager):
         self.volume_manager = utils.import_object(FLAGS.volume_manager)
         super(ComputeManager, self).__init__(*args, **kwargs)
 
+    def init_host(self):
+        """Do any initialization that needs to be run if this is a
+           standalone service.
+        """
+        self.driver.init_host()
+
     def _update_state(self, context, instance_id):
         """Update the state of an instance from the driver info."""
         # FIXME(ja): include other fields from state?
@@ -78,26 +85,57 @@ class ComputeManager(manager.Manager):
             state = power_state.NOSTATE
         self.db.instance_set_state(context, instance_id, state)
 
-    @defer.inlineCallbacks
+    def get_network_topic(self, context, **_kwargs):
+        """Retrieves the network host for a project on this host"""
+        # TODO(vish): This method should be memoized. This will make
+        #             the call to get_network_host cheaper, so that
+        #             it can pas messages instead of checking the db
+        #             locally.
+        if FLAGS.stub_network:
+            host = FLAGS.network_host
+        else:
+            host = self.network_manager.get_network_host(context)
+        return self.db.queue_get_for(context,
+                                     FLAGS.network_topic,
+                                     host)
+
     @exception.wrap_exception
     def refresh_security_group(self, context, security_group_id, **_kwargs):
         """This call passes stright through to the virtualization driver."""
-        yield self.driver.refresh_security_group(security_group_id)
+        self.driver.refresh_security_group(security_group_id)
 
-    @defer.inlineCallbacks
     @exception.wrap_exception
     def run_instance(self, context, instance_id, **_kwargs):
         """Launch a new instance with specified options."""
         context = context.elevated()
         instance_ref = self.db.instance_get(context, instance_id)
         if instance_ref['name'] in self.driver.list_instances():
-            raise exception.Error("Instance has already been created")
-        logging.debug("instance %s: starting...", instance_id)
-        self.network_manager.setup_compute_network(context, instance_id)
+            raise exception.Error(_("Instance has already been created"))
+        logging.debug(_("instance %s: starting..."), instance_id)
         self.db.instance_update(context,
                                 instance_id,
                                 {'host': self.host})
 
+        self.db.instance_set_state(context,
+                                   instance_id,
+                                   power_state.NOSTATE,
+                                   'networking')
+
+        is_vpn = instance_ref['image_id'] == FLAGS.vpn_image_id
+        # NOTE(vish): This could be a cast because we don't do anything
+        #             with the address currently, but I'm leaving it as
+        #             a call to ensure that network setup completes.  We
+        #             will eventually also need to save the address here.
+        if not FLAGS.stub_network:
+            address = rpc.call(context,
+                               self.get_network_topic(context),
+                               {"method": "allocate_fixed_ip",
+                                "args": {"instance_id": instance_id,
+                                         "vpn": is_vpn}})
+
+            self.network_manager.setup_compute_network(context,
+                                                       instance_id)
+
         # TODO(vish) check to make sure the availability zone matches
         self.db.instance_set_state(context,
                                    instance_id,
@@ -105,13 +143,13 @@ class ComputeManager(manager.Manager):
                                    'spawning')
 
         try:
-            yield self.driver.spawn(instance_ref)
+            self.driver.spawn(instance_ref)
             now = datetime.datetime.utcnow()
             self.db.instance_update(context,
                                     instance_id,
                                     {'launched_at': now})
         except Exception:  # pylint: disable-msg=W0702
-            logging.exception("instance %s: Failed to spawn",
+            logging.exception(_("instance %s: Failed to spawn"),
                               instance_ref['name'])
             self.db.instance_set_state(context,
                                        instance_id,
@@ -119,27 +157,50 @@ class ComputeManager(manager.Manager):
 
         self._update_state(context, instance_id)
 
-    @defer.inlineCallbacks
     @exception.wrap_exception
     def terminate_instance(self, context, instance_id):
         """Terminate an instance on this machine."""
         context = context.elevated()
-        logging.debug("instance %s: terminating", instance_id)
 
         instance_ref = self.db.instance_get(context, instance_id)
+
+        if not FLAGS.stub_network:
+            address = self.db.instance_get_floating_address(context,
+                                                            instance_ref['id'])
+            if address:
+                logging.debug(_("Disassociating address %s") % address)
+                # NOTE(vish): Right now we don't really care if the ip is
+                #             disassociated.  We may need to worry about
+                #             checking this later.
+                rpc.cast(context,
+                         self.get_network_topic(context),
+                         {"method": "disassociate_floating_ip",
+                          "args": {"floating_address": address}})
+
+            address = self.db.instance_get_fixed_address(context,
+                                                         instance_ref['id'])
+            if address:
+                logging.debug(_("Deallocating address %s") % address)
+                # NOTE(vish): Currently, nothing needs to be done on the
+                #             network node until release. If this changes,
+                #             we will need to cast here.
+                self.network_manager.deallocate_fixed_ip(context.elevated(),
+                                                         address)
+
+        logging.debug(_("instance %s: terminating"), instance_id)
+
         volumes = instance_ref.get('volumes', []) or []
         for volume in volumes:
             self.detach_volume(context, instance_id, volume['id'])
         if instance_ref['state'] == power_state.SHUTOFF:
             self.db.instance_destroy(context, instance_id)
-            raise exception.Error('trying to destroy already destroyed'
-                                  ' instance: %s' % instance_id)
-        yield self.driver.destroy(instance_ref)
+            raise exception.Error(_('trying to destroy already destroyed'
+                                    ' instance: %s') % instance_id)
+        self.driver.destroy(instance_ref)
 
         # TODO(ja): should we keep it in a terminated state for a bit?
         self.db.instance_destroy(context, instance_id)
 
-    @defer.inlineCallbacks
     @exception.wrap_exception
     def reboot_instance(self, context, instance_id):
         """Reboot an instance on this server."""
@@ -148,75 +209,113 @@ class ComputeManager(manager.Manager):
         self._update_state(context, instance_id)
 
         if instance_ref['state'] != power_state.RUNNING:
-            logging.warn('trying to reboot a non-running '
-                         'instance: %s (state: %s excepted: %s)',
+            logging.warn(_('trying to reboot a non-running '
+                           'instance: %s (state: %s excepted: %s)'),
                          instance_ref['internal_id'],
                          instance_ref['state'],
                          power_state.RUNNING)
 
-        logging.debug('instance %s: rebooting', instance_ref['name'])
+        logging.debug(_('instance %s: rebooting'), instance_ref['name'])
         self.db.instance_set_state(context,
                                    instance_id,
                                    power_state.NOSTATE,
                                    'rebooting')
-        yield self.driver.reboot(instance_ref)
+        self.driver.reboot(instance_ref)
         self._update_state(context, instance_id)
 
-    @defer.inlineCallbacks
     @exception.wrap_exception
     def rescue_instance(self, context, instance_id):
         """Rescue an instance on this server."""
         context = context.elevated()
         instance_ref = self.db.instance_get(context, instance_id)
 
-        logging.debug('instance %s: rescuing',
+        logging.debug(_('instance %s: rescuing'),
                       instance_ref['internal_id'])
         self.db.instance_set_state(context,
                                    instance_id,
                                    power_state.NOSTATE,
                                    'rescuing')
-        yield self.driver.rescue(instance_ref)
+        self.driver.rescue(instance_ref)
         self._update_state(context, instance_id)
 
-    @defer.inlineCallbacks
     @exception.wrap_exception
     def unrescue_instance(self, context, instance_id):
         """Rescue an instance on this server."""
         context = context.elevated()
         instance_ref = self.db.instance_get(context, instance_id)
 
-        logging.debug('instance %s: unrescuing',
+        logging.debug(_('instance %s: unrescuing'),
                       instance_ref['internal_id'])
         self.db.instance_set_state(context,
                                    instance_id,
                                    power_state.NOSTATE,
                                    'unrescuing')
-        yield self.driver.unrescue(instance_ref)
+        self.driver.unrescue(instance_ref)
+        self._update_state(context, instance_id)
+
+    @staticmethod
+    def _update_state_callback(self, context, instance_id, result):
+        """Update instance state when async task completes."""
         self._update_state(context, instance_id)
 
     @exception.wrap_exception
+    def pause_instance(self, context, instance_id):
+        """Pause an instance on this server."""
+        context = context.elevated()
+        instance_ref = self.db.instance_get(context, instance_id)
+
+        logging.debug('instance %s: pausing',
+                      instance_ref['internal_id'])
+        self.db.instance_set_state(context,
+                                   instance_id,
+                                   power_state.NOSTATE,
+                                   'pausing')
+        self.driver.pause(instance_ref,
+            lambda result: self._update_state_callback(self,
+                                                       context,
+                                                       instance_id,
+                                                       result))
+
+    @exception.wrap_exception
+    def unpause_instance(self, context, instance_id):
+        """Unpause a paused instance on this server."""
+        context = context.elevated()
+        instance_ref = self.db.instance_get(context, instance_id)
+
+        logging.debug('instance %s: unpausing',
+                      instance_ref['internal_id'])
+        self.db.instance_set_state(context,
+                                   instance_id,
+                                   power_state.NOSTATE,
+                                   'unpausing')
+        self.driver.unpause(instance_ref,
+            lambda result: self._update_state_callback(self,
+                                                       context,
+                                                       instance_id,
+                                                       result))
+
+    @exception.wrap_exception
     def get_console_output(self, context, instance_id):
         """Send the console output for an instance."""
         context = context.elevated()
-        logging.debug("instance %s: getting console output", instance_id)
+        logging.debug(_("instance %s: getting console output"), instance_id)
         instance_ref = self.db.instance_get(context, instance_id)
 
         return self.driver.get_console_output(instance_ref)
 
-    @defer.inlineCallbacks
     @exception.wrap_exception
     def attach_volume(self, context, instance_id, volume_id, mountpoint):
         """Attach a volume to an instance."""
         context = context.elevated()
-        logging.debug("instance %s: attaching volume %s to %s", instance_id,
+        logging.debug(_("instance %s: attaching volume %s to %s"), instance_id,
             volume_id, mountpoint)
         instance_ref = self.db.instance_get(context, instance_id)
-        dev_path = yield self.volume_manager.setup_compute_volume(context,
-                                                                  volume_id)
+        dev_path = self.volume_manager.setup_compute_volume(context,
+                                                            volume_id)
         try:
-            yield self.driver.attach_volume(instance_ref['name'],
-                                            dev_path,
-                                            mountpoint)
+            self.driver.attach_volume(instance_ref['name'],
+                                      dev_path,
+                                      mountpoint)
             self.db.volume_attached(context,
                                     volume_id,
                                     instance_id,
@@ -225,29 +324,29 @@ class ComputeManager(manager.Manager):
             # NOTE(vish): The inline callback eats the exception info so we
             #             log the traceback here and reraise the same
             #             ecxception below.
-            logging.exception("instance %s: attach failed %s, removing",
+            logging.exception(_("instance %s: attach failed %s, removing"),
                               instance_id, mountpoint)
-            yield self.volume_manager.remove_compute_volume(context,
-                                                            volume_id)
+            self.volume_manager.remove_compute_volume(context,
+                                                      volume_id)
             raise exc
-        defer.returnValue(True)
 
-    @defer.inlineCallbacks
+        return True
+
     @exception.wrap_exception
     def detach_volume(self, context, instance_id, volume_id):
         """Detach a volume from an instance."""
         context = context.elevated()
-        logging.debug("instance %s: detaching volume %s",
+        logging.debug(_("instance %s: detaching volume %s"),
                       instance_id,
                       volume_id)
         instance_ref = self.db.instance_get(context, instance_id)
         volume_ref = self.db.volume_get(context, volume_id)
         if instance_ref['name'] not in self.driver.list_instances():
-            logging.warn("Detaching volume from unknown instance %s",
+            logging.warn(_("Detaching volume from unknown instance %s"),
                          instance_ref['name'])
         else:
-            yield self.driver.detach_volume(instance_ref['name'],
-                                            volume_ref['mountpoint'])
-        yield self.volume_manager.remove_compute_volume(context, volume_id)
+            self.driver.detach_volume(instance_ref['name'],
+                                      volume_ref['mountpoint'])
+        self.volume_manager.remove_compute_volume(context, volume_id)
         self.db.volume_detached(context, volume_id)
-        defer.returnValue(True)
+        return True
diff --git a/nova/compute/monitor.py b/nova/compute/monitor.py
index 22653113a..60c347a5e 100644
--- a/nova/compute/monitor.py
+++ b/nova/compute/monitor.py
@@ -255,7 +255,7 @@ class Instance(object):
         Updates the instances statistics and stores the resulting graphs
         in the internal object store on the cloud controller.
         """
-        logging.debug('updating %s...', self.instance_id)
+        logging.debug(_('updating %s...'), self.instance_id)
 
         try:
             data = self.fetch_cpu_stats()
@@ -285,7 +285,7 @@ class Instance(object):
             graph_disk(self, '1w')
             graph_disk(self, '1m')
         except Exception:
-            logging.exception('unexpected error during update')
+            logging.exception(_('unexpected error during update'))
 
         self.last_updated = utcnow()
 
@@ -351,7 +351,7 @@ class Instance(object):
                 rd += rd_bytes
                 wr += wr_bytes
             except TypeError:
-                logging.error('Cannot get blockstats for "%s" on "%s"',
+                logging.error(_('Cannot get blockstats for "%s" on "%s"'),
                               disk, self.instance_id)
                 raise
 
@@ -373,7 +373,7 @@ class Instance(object):
                 rx += stats[0]
                 tx += stats[4]
             except TypeError:
-                logging.error('Cannot get ifstats for "%s" on "%s"',
+                logging.error(_('Cannot get ifstats for "%s" on "%s"'),
                               interface, self.instance_id)
                 raise
 
@@ -408,7 +408,7 @@ class InstanceMonitor(object, service.Service):
         try:
             conn = virt_connection.get_connection(read_only=True)
         except Exception, exn:
-            logging.exception('unexpected exception getting connection')
+            logging.exception(_('unexpected exception getting connection'))
             time.sleep(FLAGS.monitoring_instances_delay)
             return
 
@@ -423,7 +423,7 @@ class InstanceMonitor(object, service.Service):
             if not domain_id in self._instances:
                 instance = Instance(conn, domain_id)
                 self._instances[domain_id] = instance
-                logging.debug('Found instance: %s', domain_id)
+                logging.debug(_('Found instance: %s'), domain_id)
 
         for key in self._instances.keys():
             instance = self._instances[key]
diff --git a/nova/crypto.py b/nova/crypto.py
index aacc50b17..e4133ac85 100644
--- a/nova/crypto.py
+++ b/nova/crypto.py
@@ -19,7 +19,6 @@
 Wrappers around standard crypto data elements.
 
 Includes root and intermediate CAs, SSH key_pairs and x509 certificates.
-
 """
 
 import base64
@@ -34,28 +33,57 @@ import utils
 
 import M2Crypto
 
-from nova import exception
+from nova import context
+from nova import db
 from nova import flags
 
 
 FLAGS = flags.FLAGS
-flags.DEFINE_string('ca_file', 'cacert.pem', 'Filename of root CA')
+flags.DEFINE_string('ca_file', 'cacert.pem', _('Filename of root CA'))
+flags.DEFINE_string('key_file',
+                    os.path.join('private', 'cakey.pem'),
+                    _('Filename of private key'))
+flags.DEFINE_string('crl_file', 'crl.pem',
+                    _('Filename of root Certificate Revokation List'))
 flags.DEFINE_string('keys_path', '$state_path/keys',
-                    'Where we keep our keys')
+                    _('Where we keep our keys'))
 flags.DEFINE_string('ca_path', '$state_path/CA',
-                    'Where we keep our root CA')
-flags.DEFINE_boolean('use_intermediate_ca', False,
-                     'Should we use intermediate CAs for each project?')
+                    _('Where we keep our root CA'))
+flags.DEFINE_boolean('use_project_ca', False,
+                     _('Should we use a CA for each project?'))
+flags.DEFINE_string('user_cert_subject',
+                    '/C=US/ST=California/L=MountainView/O=AnsoLabs/'
+                    'OU=NovaDev/CN=%s-%s-%s',
+                    _('Subject for certificate for users, '
+                    '%s for project, user, timestamp'))
+flags.DEFINE_string('project_cert_subject',
+                    '/C=US/ST=California/L=MountainView/O=AnsoLabs/'
+                    'OU=NovaDev/CN=project-ca-%s-%s',
+                    _('Subject for certificate for projects, '
+                    '%s for project, timestamp'))
+flags.DEFINE_string('vpn_cert_subject',
+                    '/C=US/ST=California/L=MountainView/O=AnsoLabs/'
+                    'OU=NovaDev/CN=project-vpn-%s-%s',
+                    _('Subject for certificate for vpns, '
+                    '%s for project, timestamp'))
 
 
-def ca_path(project_id):
-    if project_id:
-        return "%s/INTER/%s/cacert.pem" % (FLAGS.ca_path, project_id)
-    return "%s/cacert.pem" % (FLAGS.ca_path)
+def ca_folder(project_id=None):
+    if FLAGS.use_project_ca and project_id:
+        return os.path.join(FLAGS.ca_path, 'projects', project_id)
+    return FLAGS.ca_path
+
+
+def ca_path(project_id=None):
+    return os.path.join(ca_folder(project_id), FLAGS.ca_file)
+
+
+def key_path(project_id=None):
+    return os.path.join(ca_folder(project_id), FLAGS.key_file)
 
 
 def fetch_ca(project_id=None, chain=True):
-    if not FLAGS.use_intermediate_ca:
+    if not FLAGS.use_project_ca:
         project_id = None
     buffer = ""
     if project_id:
@@ -92,8 +120,8 @@ def generate_key_pair(bits=1024):
 
 
 def ssl_pub_to_ssh_pub(ssl_public_key, name='root', suffix='nova'):
-    pub_key_buffer = M2Crypto.BIO.MemoryBuffer(ssl_public_key)
-    rsa_key = M2Crypto.RSA.load_pub_key_bio(pub_key_buffer)
+    buf = M2Crypto.BIO.MemoryBuffer(ssl_public_key)
+    rsa_key = M2Crypto.RSA.load_pub_key_bio(buf)
     e, n = rsa_key.pub()
 
     key_type = 'ssh-rsa'
@@ -106,53 +134,134 @@ def ssl_pub_to_ssh_pub(ssl_public_key, name='root', suffix='nova'):
     return '%s %s %s@%s\n' % (key_type, b64_blob, name, suffix)
 
 
-def generate_x509_cert(subject, bits=1024):
+def revoke_cert(project_id, file_name):
+    """Revoke a cert by file name"""
+    start = os.getcwd()
+    os.chdir(ca_folder(project_id))
+    # NOTE(vish): potential race condition here
+    utils.execute("openssl ca -config ./openssl.cnf -revoke '%s'" % file_name)
+    utils.execute("openssl ca -gencrl -config ./openssl.cnf -out '%s'" %
+                  FLAGS.crl_file)
+    os.chdir(start)
+
+
+def revoke_certs_by_user(user_id):
+    """Revoke all user certs"""
+    admin = context.get_admin_context()
+    for cert in db.certificate_get_all_by_user(admin, user_id):
+        revoke_cert(cert['project_id'], cert['file_name'])
+
+
+def revoke_certs_by_project(project_id):
+    """Revoke all project certs"""
+    # NOTE(vish): This is somewhat useless because we can just shut down
+    #             the vpn.
+    admin = context.get_admin_context()
+    for cert in db.certificate_get_all_by_project(admin, project_id):
+        revoke_cert(cert['project_id'], cert['file_name'])
+
+
+def revoke_certs_by_user_and_project(user_id, project_id):
+    """Revoke certs for user in project"""
+    admin = context.get_admin_context()
+    for cert in db.certificate_get_all_by_user(admin, user_id, project_id):
+        revoke_cert(cert['project_id'], cert['file_name'])
+
+
+def _project_cert_subject(project_id):
+    """Helper to generate user cert subject"""
+    return FLAGS.project_cert_subject % (project_id, utils.isotime())
+
+
+def _vpn_cert_subject(project_id):
+    """Helper to generate user cert subject"""
+    return FLAGS.vpn_cert_subject % (project_id, utils.isotime())
+
+
+def _user_cert_subject(user_id, project_id):
+    """Helper to generate user cert subject"""
+    return FLAGS.user_cert_subject % (project_id, user_id, utils.isotime())
+
+
+def generate_x509_cert(user_id, project_id, bits=1024):
+    """Generate and sign a cert for user in project"""
+    subject = _user_cert_subject(user_id, project_id)
     tmpdir = tempfile.mkdtemp()
     keyfile = os.path.abspath(os.path.join(tmpdir, 'temp.key'))
     csrfile = os.path.join(tmpdir, 'temp.csr')
-    logging.debug("openssl genrsa -out %s %s" % (keyfile, bits))
-    utils.runthis("Generating private key: %s",
-                  "openssl genrsa -out %s %s" % (keyfile, bits))
-    utils.runthis("Generating CSR: %s",
-                  "openssl req -new -key %s -out %s -batch -subj %s" %
+    utils.execute("openssl genrsa -out %s %s" % (keyfile, bits))
+    utils.execute("openssl req -new -key %s -out %s -batch -subj %s" %
                   (keyfile, csrfile, subject))
     private_key = open(keyfile).read()
     csr = open(csrfile).read()
     shutil.rmtree(tmpdir)
-    return (private_key, csr)
+    (serial, signed_csr) = sign_csr(csr, project_id)
+    fname = os.path.join(ca_folder(project_id), "newcerts/%s.pem" % serial)
+    cert = {'user_id': user_id,
+            'project_id': project_id,
+            'file_name': fname}
+    db.certificate_create(context.get_admin_context(), cert)
+    return (private_key, signed_csr)
 
 
-def sign_csr(csr_text, intermediate=None):
-    if not FLAGS.use_intermediate_ca:
-        intermediate = None
-    if not intermediate:
-        return _sign_csr(csr_text, FLAGS.ca_path)
-    user_ca = "%s/INTER/%s" % (FLAGS.ca_path, intermediate)
-    if not os.path.exists(user_ca):
+def _ensure_project_folder(project_id):
+    if not os.path.exists(ca_path(project_id)):
         start = os.getcwd()
-        os.chdir(FLAGS.ca_path)
-        utils.runthis("Generating intermediate CA: %s",
-                      "sh geninter.sh %s" % (intermediate))
+        os.chdir(ca_folder())
+        utils.execute("sh geninter.sh %s %s" %
+                      (project_id, _project_cert_subject(project_id)))
         os.chdir(start)
-    return _sign_csr(csr_text, user_ca)
+
+
+def generate_vpn_files(project_id):
+    project_folder = ca_folder(project_id)
+    csr_fn = os.path.join(project_folder, "server.csr")
+    crt_fn = os.path.join(project_folder, "server.crt")
+
+    if os.path.exists(crt_fn):
+        return
+    _ensure_project_folder(project_id)
+    start = os.getcwd()
+    os.chdir(ca_folder())
+    # TODO(vish): the shell scripts could all be done in python
+    utils.execute("sh genvpn.sh %s %s" %
+                  (project_id, _vpn_cert_subject(project_id)))
+    with open(csr_fn, "r") as csrfile:
+        csr_text = csrfile.read()
+    (serial, signed_csr) = sign_csr(csr_text, project_id)
+    with open(crt_fn, "w") as crtfile:
+        crtfile.write(signed_csr)
+    os.chdir(start)
+
+
+def sign_csr(csr_text, project_id=None):
+    if not FLAGS.use_project_ca:
+        project_id = None
+    if not project_id:
+        return _sign_csr(csr_text, ca_folder())
+    _ensure_project_folder(project_id)
+    project_folder = ca_folder(project_id)
+    return _sign_csr(csr_text, ca_folder(project_id))
 
 
 def _sign_csr(csr_text, ca_folder):
     tmpfolder = tempfile.mkdtemp()
-    csrfile = open("%s/inbound.csr" % (tmpfolder), "w")
+    inbound = os.path.join(tmpfolder, "inbound.csr")
+    outbound = os.path.join(tmpfolder, "outbound.csr")
+    csrfile = open(inbound, "w")
     csrfile.write(csr_text)
     csrfile.close()
-    logging.debug("Flags path: %s" % ca_folder)
+    logging.debug(_("Flags path: %s") % ca_folder)
     start = os.getcwd()
     # Change working dir to CA
     os.chdir(ca_folder)
-    utils.runthis("Signing cert: %s",
-                  "openssl ca -batch -out %s/outbound.crt "
-                  "-config ./openssl.cnf -infiles %s/inbound.csr" %
-                  (tmpfolder, tmpfolder))
+    utils.execute("openssl ca -batch -out %s -config "
+                  "./openssl.cnf -infiles %s" % (outbound, inbound))
+    out, _err = utils.execute("openssl x509 -in %s -serial -noout" % outbound)
+    serial = out.rpartition("=")[2]
     os.chdir(start)
-    with open("%s/outbound.crt" % (tmpfolder), "r") as crtfile:
-        return crtfile.read()
+    with open(outbound, "r") as crtfile:
+        return (serial, crtfile.read())
 
 
 def mkreq(bits, subject="foo", ca=0):
@@ -160,8 +269,7 @@ def mkreq(bits, subject="foo", ca=0):
     req = M2Crypto.X509.Request()
     rsa = M2Crypto.RSA.gen_key(bits, 65537, callback=lambda: None)
     pk.assign_rsa(rsa)
-    # Should not be freed here
-    rsa = None
+    rsa = None  # should not be freed here
     req.set_pubkey(pk)
     req.set_subject(subject)
     req.sign(pk, 'sha512')
@@ -225,7 +333,6 @@ def mkcacert(subject='nova', years=1):
 # IN THE SOFTWARE.
 # http://code.google.com/p/boto
 
-
 def compute_md5(fp):
     """
     :type fp: file
diff --git a/nova/db/api.py b/nova/db/api.py
index 8f9dc2443..fde3f0852 100644
--- a/nova/db/api.py
+++ b/nova/db/api.py
@@ -130,6 +130,45 @@ def service_update(context, service_id, values):
 ###################
 
 
+def certificate_create(context, values):
+    """Create a certificate from the values dictionary."""
+    return IMPL.certificate_create(context, values)
+
+
+def certificate_destroy(context, certificate_id):
+    """Destroy the certificate or raise if it does not exist."""
+    return IMPL.certificate_destroy(context, certificate_id)
+
+
+def certificate_get_all_by_project(context, project_id):
+    """Get all certificates for a project."""
+    return IMPL.certificate_get_all_by_project(context, project_id)
+
+
+def certificate_get_all_by_user(context, user_id):
+    """Get all certificates for a user."""
+    return IMPL.certificate_get_all_by_user(context, user_id)
+
+
+def certificate_get_all_by_user_and_project(context, user_id, project_id):
+    """Get all certificates for a user and project."""
+    return IMPL.certificate_get_all_by_user_and_project(context,
+                                                        user_id,
+                                                        project_id)
+
+
+def certificate_update(context, certificate_id, values):
+    """Set the given properties on an certificate and update it.
+
+    Raises NotFound if service does not exist.
+
+    """
+    return IMPL.service_update(context, certificate_id, values)
+
+
+###################
+
+
 def floating_ip_allocate_address(context, host, project_id):
     """Allocate free floating ip and return the address.
 
@@ -304,6 +343,11 @@ def instance_get_floating_address(context, instance_id):
     return IMPL.instance_get_floating_address(context, instance_id)
 
 
+def instance_get_project_vpn(context, project_id):
+    """Get a vpn instance by project or return None."""
+    return IMPL.instance_get_project_vpn(context, project_id)
+
+
 def instance_get_by_internal_id(context, internal_id):
     """Get an instance by internal id."""
     return IMPL.instance_get_by_internal_id(context, internal_id)
@@ -334,6 +378,11 @@ def instance_add_security_group(context, instance_id, security_group_id):
                                             security_group_id)
 
 
+def instance_action_create(context, values):
+    """Create an instance action from the values dictionary."""
+    return IMPL.instance_action_create(context, values)
+
+
 ###################
 
 
@@ -468,12 +517,14 @@ def network_update(context, network_id, values):
 ###################
 
 
-def project_get_network(context, project_id):
+def project_get_network(context, project_id, associate=True):
     """Return the network associated with the project.
 
-    Raises NotFound if no such network can be found.
+    If associate is true, it will attempt to associate a new
+    network if one is not found, otherwise it returns None.
 
     """
+
     return IMPL.project_get_network(context, project_id)
 
 
diff --git a/nova/db/sqlalchemy/api.py b/nova/db/sqlalchemy/api.py
index 55036d1d1..52d0c389d 100644
--- a/nova/db/sqlalchemy/api.py
+++ b/nova/db/sqlalchemy/api.py
@@ -41,7 +41,7 @@ FLAGS = flags.FLAGS
 def is_admin_context(context):
     """Indicates if the request context is an administrator."""
     if not context:
-        warnings.warn('Use of empty request context is deprecated',
+        warnings.warn(_('Use of empty request context is deprecated'),
                       DeprecationWarning)
         raise Exception('die')
     return context.is_admin
@@ -130,7 +130,7 @@ def service_get(context, service_id, session=None):
                      first()
 
     if not result:
-        raise exception.NotFound('No service for id %s' % service_id)
+        raise exception.NotFound(_('No service for id %s') % service_id)
 
     return result
 
@@ -227,7 +227,7 @@ def service_get_by_args(context, host, binary):
                      filter_by(deleted=can_read_deleted(context)).\
                      first()
     if not result:
-        raise exception.NotFound('No service for %s, %s' % (host, binary))
+        raise exception.NotFound(_('No service for %s, %s') % (host, binary))
 
     return result
 
@@ -252,6 +252,84 @@ def service_update(context, service_id, values):
 ###################
 
 
+@require_admin_context
+def certificate_get(context, certificate_id, session=None):
+    if not session:
+        session = get_session()
+
+    result = session.query(models.Certificate).\
+                     filter_by(id=certificate_id).\
+                     filter_by(deleted=can_read_deleted(context)).\
+                     first()
+
+    if not result:
+        raise exception.NotFound('No certificate for id %s' % certificate_id)
+
+    return result
+
+
+@require_admin_context
+def certificate_create(context, values):
+    certificate_ref = models.Certificate()
+    for (key, value) in values.iteritems():
+        certificate_ref[key] = value
+    certificate_ref.save()
+    return certificate_ref
+
+
+@require_admin_context
+def certificate_destroy(context, certificate_id):
+    session = get_session()
+    with session.begin():
+        certificate_ref = certificate_get(context,
+                                          certificate_id,
+                                          session=session)
+        certificate_ref.delete(session=session)
+
+
+@require_admin_context
+def certificate_get_all_by_project(context, project_id):
+    session = get_session()
+    return session.query(models.Certificate).\
+                   filter_by(project_id=project_id).\
+                   filter_by(deleted=False).\
+                   all()
+
+
+@require_admin_context
+def certificate_get_all_by_user(context, user_id):
+    session = get_session()
+    return session.query(models.Certificate).\
+                   filter_by(user_id=user_id).\
+                   filter_by(deleted=False).\
+                   all()
+
+
+@require_admin_context
+def certificate_get_all_by_user_and_project(_context, user_id, project_id):
+    session = get_session()
+    return session.query(models.Certificate).\
+                   filter_by(user_id=user_id).\
+                   filter_by(project_id=project_id).\
+                   filter_by(deleted=False).\
+                   all()
+
+
+@require_admin_context
+def certificate_update(context, certificate_id, values):
+    session = get_session()
+    with session.begin():
+        certificate_ref = certificate_get(context,
+                                          certificate_id,
+                                          session=session)
+        for (key, value) in values.iteritems():
+            certificate_ref[key] = value
+        certificate_ref.save(session=session)
+
+
+###################
+
+
 @require_context
 def floating_ip_allocate_address(context, host, project_id):
     authorize_project_context(context, project_id)
@@ -385,6 +463,7 @@ def floating_ip_get_by_address(context, address, session=None):
         session = get_session()
 
     result = session.query(models.FloatingIp).\
+                   options(joinedload_all('fixed_ip.network')).\
                      filter_by(address=address).\
                      filter_by(deleted=can_read_deleted(context)).\
                      first()
@@ -491,7 +570,7 @@ def fixed_ip_get_by_address(context, address, session=None):
                      options(joinedload('instance')).\
                      first()
     if not result:
-        raise exception.NotFound('No floating ip for address %s' % address)
+        raise exception.NotFound(_('No floating ip for address %s') % address)
 
     if is_user_context(context):
         authorize_project_context(context, result.instance.project_id)
@@ -528,6 +607,8 @@ def fixed_ip_update(context, address, values):
 #TODO(gundlach): instance_create and volume_create are nearly identical
 #and should be refactored.  I expect there are other copy-and-paste
 #functions between the two of them as well.
+
+
 @require_context
 def instance_create(context, values):
     """Create a new Instance record in the database.
@@ -579,19 +660,23 @@ def instance_get(context, instance_id, session=None):
 
     if is_admin_context(context):
         result = session.query(models.Instance).\
+                         options(joinedload_all('fixed_ip.floating_ips')).\
                          options(joinedload('security_groups')).\
+                         options(joinedload('volumes')).\
                          filter_by(id=instance_id).\
                          filter_by(deleted=can_read_deleted(context)).\
                          first()
     elif is_user_context(context):
         result = session.query(models.Instance).\
+                         options(joinedload_all('fixed_ip.floating_ips')).\
                          options(joinedload('security_groups')).\
+                         options(joinedload('volumes')).\
                          filter_by(project_id=context.project_id).\
                          filter_by(id=instance_id).\
                          filter_by(deleted=False).\
                          first()
     if not result:
-        raise exception.NotFound('No instance for id %s' % instance_id)
+        raise exception.NotFound(_('No instance for id %s') % instance_id)
 
     return result
 
@@ -651,6 +736,18 @@ def instance_get_all_by_reservation(context, reservation_id):
                        all()
 
 
+@require_admin_context
+def instance_get_project_vpn(context, project_id):
+    session = get_session()
+    return session.query(models.Instance).\
+                   options(joinedload_all('fixed_ip.floating_ips')).\
+                   options(joinedload('security_groups')).\
+                   filter_by(project_id=project_id).\
+                   filter_by(image_id=FLAGS.vpn_image_id).\
+                   filter_by(deleted=can_read_deleted(context)).\
+                   first()
+
+
 @require_context
 def instance_get_by_internal_id(context, internal_id):
     session = get_session()
@@ -669,7 +766,7 @@ def instance_get_by_internal_id(context, internal_id):
                          filter_by(deleted=False).\
                          first()
     if not result:
-        raise exception.NotFound('Instance %s not found' % (internal_id))
+        raise exception.NotFound(_('Instance %s not found') % (internal_id))
 
     return result
 
@@ -747,6 +844,18 @@ def instance_add_security_group(context, instance_id, security_group_id):
         instance_ref.save(session=session)
 
 
+@require_context
+def instance_action_create(context, values):
+    """Create an instance action from the values dictionary."""
+    action_ref = models.InstanceActions()
+    action_ref.update(values)
+
+    session = get_session()
+    with session.begin():
+        action_ref.save(session=session)
+    return action_ref
+
+
 ###################
 
 
@@ -790,7 +899,7 @@ def key_pair_get(context, user_id, name, session=None):
                      filter_by(deleted=can_read_deleted(context)).\
                      first()
     if not result:
-        raise exception.NotFound('no keypair for user %s, name %s' %
+        raise exception.NotFound(_('no keypair for user %s, name %s') %
                                  (user_id, name))
     return result
 
@@ -905,7 +1014,7 @@ def network_get(context, network_id, session=None):
                          filter_by(deleted=False).\
                          first()
     if not result:
-        raise exception.NotFound('No network for id %s' % network_id)
+        raise exception.NotFound(_('No network for id %s') % network_id)
 
     return result
 
@@ -913,6 +1022,8 @@ def network_get(context, network_id, session=None):
 # NOTE(vish): pylint complains because of the long method name, but
 #             it fits with the names of the rest of the methods
 # pylint: disable-msg=C0103
+
+
 @require_admin_context
 def network_get_associated_fixed_ips(context, network_id):
     session = get_session()
@@ -933,7 +1044,7 @@ def network_get_by_bridge(context, bridge):
                  first()
 
     if not result:
-        raise exception.NotFound('No network for bridge %s' % bridge)
+        raise exception.NotFound(_('No network for bridge %s') % bridge)
     return result
 
 
@@ -947,7 +1058,7 @@ def network_get_by_instance(_context, instance_id):
                  filter_by(deleted=False).\
                  first()
     if not rv:
-        raise exception.NotFound('No network for instance %s' % instance_id)
+        raise exception.NotFound(_('No network for instance %s') % instance_id)
     return rv
 
 
@@ -961,7 +1072,7 @@ def network_set_host(context, network_id, host_id):
                               with_lockmode('update').\
                               first()
         if not network_ref:
-            raise exception.NotFound('No network for id %s' % network_id)
+            raise exception.NotFound(_('No network for id %s') % network_id)
 
         # NOTE(vish): if with_lockmode isn't supported, as in sqlite,
         #             then this has concurrency issues
@@ -985,24 +1096,26 @@ def network_update(context, network_id, values):
 
 
 @require_context
-def project_get_network(context, project_id):
+def project_get_network(context, project_id, associate=True):
     session = get_session()
-    rv = session.query(models.Network).\
-                 filter_by(project_id=project_id).\
-                 filter_by(deleted=False).\
-                 first()
-    if not rv:
+    result = session.query(models.Network).\
+                     filter_by(project_id=project_id).\
+                     filter_by(deleted=False).\
+                     first()
+    if not result:
+        if not associate:
+            return None
         try:
             return network_associate(context, project_id)
         except IntegrityError:
             # NOTE(vish): We hit this if there is a race and two
             #             processes are attempting to allocate the
             #             network at the same time
-            rv = session.query(models.Network).\
-                         filter_by(project_id=project_id).\
-                         filter_by(deleted=False).\
-                         first()
-    return rv
+            result = session.query(models.Network).\
+                             filter_by(project_id=project_id).\
+                             filter_by(deleted=False).\
+                             first()
+    return result
 
 
 ###################
@@ -1073,7 +1186,7 @@ def auth_get_token(_context, token_hash):
                   filter_by(token_hash=token_hash).\
                   first()
     if not tk:
-        raise exception.NotFound('Token %s does not exist' % token_hash)
+        raise exception.NotFound(_('Token %s does not exist') % token_hash)
     return tk
 
 
@@ -1097,7 +1210,7 @@ def quota_get(context, project_id, session=None):
                      filter_by(deleted=can_read_deleted(context)).\
                      first()
     if not result:
-        raise exception.NotFound('No quota for project_id %s' % project_id)
+        raise exception.NotFound(_('No quota for project_id %s') % project_id)
 
     return result
 
@@ -1252,7 +1365,7 @@ def volume_get(context, volume_id, session=None):
                          filter_by(deleted=False).\
                          first()
     if not result:
-        raise exception.NotFound('No volume for id %s' % volume_id)
+        raise exception.NotFound(_('No volume for id %s') % volume_id)
 
     return result
 
@@ -1308,7 +1421,7 @@ def volume_get_by_ec2_id(context, ec2_id):
         raise exception.NotAuthorized()
 
     if not result:
-        raise exception.NotFound('Volume %s not found' % ec2_id)
+        raise exception.NotFound(_('Volume %s not found') % ec2_id)
 
     return result
 
@@ -1332,7 +1445,7 @@ def volume_get_instance(context, volume_id):
                      options(joinedload('instance')).\
                      first()
     if not result:
-        raise exception.NotFound('Volume %s not found' % ec2_id)
+        raise exception.NotFound(_('Volume %s not found') % ec2_id)
 
     return result.instance
 
@@ -1344,7 +1457,7 @@ def volume_get_shelf_and_blade(context, volume_id):
                      filter_by(volume_id=volume_id).\
                      first()
     if not result:
-        raise exception.NotFound('No export device found for volume %s' %
+        raise exception.NotFound(_('No export device found for volume %s') %
                                  volume_id)
 
     return (result.shelf_id, result.blade_id)
@@ -1357,7 +1470,7 @@ def volume_get_iscsi_target_num(context, volume_id):
                      filter_by(volume_id=volume_id).\
                      first()
     if not result:
-        raise exception.NotFound('No target id found for volume %s' %
+        raise exception.NotFound(_('No target id found for volume %s') %
                                  volume_id)
 
     return result.target_num
@@ -1402,7 +1515,7 @@ def security_group_get(context, security_group_id, session=None):
                          options(joinedload_all('rules')).\
                          first()
     if not result:
-        raise exception.NotFound("No secuity group with id %s" %
+        raise exception.NotFound(_("No security group with id %s") %
                                  security_group_id)
     return result
 
@@ -1419,7 +1532,7 @@ def security_group_get_by_name(context, project_id, group_name):
                         first()
     if not result:
         raise exception.NotFound(
-            'No security group named %s for project: %s' \
+            _('No security group named %s for project: %s')
              % (group_name, project_id))
     return result
 
@@ -1507,7 +1620,7 @@ def security_group_rule_get(context, security_group_rule_id, session=None):
                          filter_by(id=security_group_rule_id).\
                          first()
     if not result:
-        raise exception.NotFound("No secuity group rule with id %s" %
+        raise exception.NotFound(_("No secuity group rule with id %s") %
                                  security_group_rule_id)
     return result
 
@@ -1543,7 +1656,7 @@ def user_get(context, id, session=None):
                      first()
 
     if not result:
-        raise exception.NotFound('No user for id %s' % id)
+        raise exception.NotFound(_('No user for id %s') % id)
 
     return result
 
@@ -1559,7 +1672,7 @@ def user_get_by_access_key(context, access_key, session=None):
                    first()
 
     if not result:
-        raise exception.NotFound('No user for access key %s' % access_key)
+        raise exception.NotFound(_('No user for access key %s') % access_key)
 
     return result
 
@@ -1621,7 +1734,7 @@ def project_get(context, id, session=None):
                      first()
 
     if not result:
-        raise exception.NotFound("No project with id %s" % id)
+        raise exception.NotFound(_("No project with id %s") % id)
 
     return result
 
diff --git a/nova/db/sqlalchemy/models.py b/nova/db/sqlalchemy/models.py
index fe0a9a921..693db8d23 100644
--- a/nova/db/sqlalchemy/models.py
+++ b/nova/db/sqlalchemy/models.py
@@ -22,7 +22,7 @@ SQLAlchemy models for nova data.
 import datetime
 
 from sqlalchemy.orm import relationship, backref, object_mapper
-from sqlalchemy import Column, Integer, String, schema
+from sqlalchemy import Column, Integer, Float, String, schema
 from sqlalchemy import ForeignKey, DateTime, Boolean, Text
 from sqlalchemy.exc import IntegrityError
 from sqlalchemy.ext.declarative import declarative_base
@@ -151,6 +151,16 @@ class Service(BASE, NovaBase):
     disabled = Column(Boolean, default=False)
 
 
+class Certificate(BASE, NovaBase):
+    """Represents a an x509 certificate"""
+    __tablename__ = 'certificates'
+    id = Column(Integer, primary_key=True)
+
+    user_id = Column(String(255))
+    project_id = Column(String(255))
+    file_name = Column(String(255))
+
+
 class Instance(BASE, NovaBase):
     """Represents a guest vm."""
     __tablename__ = 'instances'
@@ -226,6 +236,31 @@ class Instance(BASE, NovaBase):
     #                     'shutdown', 'shutoff', 'crashed'])
 
 
+class InstanceDiagnostics(BASE, NovaBase):
+    """Represents a guest VM's diagnostics"""
+    __tablename__ = "instance_diagnostics"
+    id = Column(Integer, primary_key=True)
+    instance_id = Column(Integer, ForeignKey('instances.id'))
+
+    memory_available = Column(Float)
+    memory_free = Column(Float)
+    cpu_load = Column(Float)
+    disk_read = Column(Float)
+    disk_write = Column(Float)
+    net_tx = Column(Float)
+    net_rx = Column(Float)
+
+
+class InstanceActions(BASE, NovaBase):
+    """Represents a guest VM's actions and results"""
+    __tablename__ = "instance_actions"
+    id = Column(Integer, primary_key=True)
+    instance_id = Column(Integer, ForeignKey('instances.id'))
+
+    action = Column(String(255))
+    error = Column(Text)
+
+
 class Volume(BASE, NovaBase):
     """Represents a block storage device that can be attached to a vm."""
     __tablename__ = 'volumes'
@@ -526,10 +561,11 @@ def register_models():
     it will never need to be called explicitly elsewhere.
     """
     from sqlalchemy import create_engine
-    models = (Service, Instance, Volume, ExportDevice, IscsiTarget, FixedIp,
-              FloatingIp, Network, SecurityGroup,
-              SecurityGroupIngressRule, SecurityGroupInstanceAssociation,
-              AuthToken, User, Project)  # , Image, Host
+    models = (Service, Instance, InstanceDiagnostics, InstanceActions,
+              Volume, ExportDevice, IscsiTarget, FixedIp, FloatingIp,
+              Network, SecurityGroup, SecurityGroupIngressRule,
+              SecurityGroupInstanceAssociation, AuthToken, User,
+              Project, Certificate)  # , Image, Host
     engine = create_engine(FLAGS.sql_connection, echo=False)
     for model in models:
         model.metadata.create_all(engine)
diff --git a/nova/exception.py b/nova/exception.py
index 6d6c37338..277033e0f 100644
--- a/nova/exception.py
+++ b/nova/exception.py
@@ -27,23 +27,26 @@ import traceback
 
 
 class ProcessExecutionError(IOError):
+
     def __init__(self, stdout=None, stderr=None, exit_code=None, cmd=None,
                  description=None):
         if description is None:
-            description = "Unexpected error while running command."
+            description = _("Unexpected error while running command.")
         if exit_code is None:
             exit_code = '-'
-        message = "%s\nCommand: %s\nExit code: %s\nStdout: %r\nStderr: %r" % (
-                  description, cmd, exit_code, stdout, stderr)
+        message = _("%s\nCommand: %s\nExit code: %s\nStdout: %r\nStderr: %r")\
+                % (description, cmd, exit_code, stdout, stderr)
         IOError.__init__(self, message)
 
 
 class Error(Exception):
+
     def __init__(self, message=None):
         super(Error, self).__init__(message)
 
 
 class ApiError(Error):
+
     def __init__(self, message='Unknown', code='Unknown'):
         self.message = message
         self.code = code
@@ -81,7 +84,7 @@ def wrap_exception(f):
         except Exception, e:
             if not isinstance(e, Error):
                 #exc_type, exc_value, exc_traceback = sys.exc_info()
-                logging.exception('Uncaught exception')
+                logging.exception(_('Uncaught exception'))
                 #logging.error(traceback.extract_stack(exc_traceback))
                 raise Error(str(e))
             raise
diff --git a/nova/fakememcache.py b/nova/fakememcache.py
new file mode 100644
index 000000000..67f46dbdc
--- /dev/null
+++ b/nova/fakememcache.py
@@ -0,0 +1,59 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2010 United States Government as represented by the
+# Administrator of the National Aeronautics and Space Administration.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+"""Super simple fake memcache client."""
+
+import utils
+
+
+class Client(object):
+    """Replicates a tiny subset of memcached client interface."""
+
+    def __init__(self, *args, **kwargs):
+        """Ignores the passed in args"""
+        self.cache = {}
+
+    def get(self, key):
+        """Retrieves the value for a key or None."""
+        (timeout, value) = self.cache.get(key, (0, None))
+        if timeout == 0 or utils.utcnow_ts() < timeout:
+            return value
+        return None
+
+    def set(self, key, value, time=0, min_compress_len=0):
+        """Sets the value for a key."""
+        timeout = 0
+        if time != 0:
+            timeout = utils.utcnow_ts() + time
+        self.cache[key] = (timeout, value)
+        return True
+
+    def add(self, key, value, time=0, min_compress_len=0):
+        """Sets the value for a key if it doesn't exist."""
+        if not self.get(key) is None:
+            return False
+        return self.set(key, value, time, min_compress_len)
+
+    def incr(self, key, delta=1):
+        """Increments the value for a key."""
+        value = self.get(key)
+        if value is None:
+            return None
+        new_value = int(value) + delta
+        self.cache[key] = (self.cache[key][0], str(new_value))
+        return new_value
diff --git a/nova/fakerabbit.py b/nova/fakerabbit.py
index c64617931..79d8b894d 100644
--- a/nova/fakerabbit.py
+++ b/nova/fakerabbit.py
@@ -25,6 +25,10 @@ from carrot.backends import base
 from eventlet import greenthread
 
 
+EXCHANGES = {}
+QUEUES = {}
+
+
 class Message(base.BaseMessage):
     pass
 
@@ -37,12 +41,12 @@ class Exchange(object):
         self._routes = {}
 
     def publish(self, message, routing_key=None):
-        logging.debug('(%s) publish (key: %s) %s',
+        logging.debug(_('(%s) publish (key: %s) %s'),
                       self.name, routing_key, message)
         routing_key = routing_key.split('.')[0]
         if routing_key in self._routes:
             for f in self._routes[routing_key]:
-                logging.debug('Publishing to route %s', f)
+                logging.debug(_('Publishing to route %s'), f)
                 f(message, routing_key=routing_key)
 
     def bind(self, callback, routing_key):
@@ -68,81 +72,63 @@ class Queue(object):
         return self._queue.get()
 
 
-class Backend(object):
-    """ Singleton backend for testing """
-    class __impl(base.BaseBackend):
-        def __init__(self, *args, **kwargs):
-            #super(__impl, self).__init__(*args, **kwargs)
-            self._exchanges = {}
-            self._queues = {}
-
-        def _reset_all(self):
-            self._exchanges = {}
-            self._queues = {}
-
-        def queue_declare(self, queue, **kwargs):
-            if queue not in self._queues:
-                logging.debug('Declaring queue %s', queue)
-                self._queues[queue] = Queue(queue)
-
-        def exchange_declare(self, exchange, type, *args, **kwargs):
-            if exchange not in self._exchanges:
-                logging.debug('Declaring exchange %s', exchange)
-                self._exchanges[exchange] = Exchange(exchange, type)
-
-        def queue_bind(self, queue, exchange, routing_key, **kwargs):
-            logging.debug('Binding %s to %s with key %s',
-                          queue, exchange, routing_key)
-            self._exchanges[exchange].bind(self._queues[queue].push,
-                                           routing_key)
-
-        def declare_consumer(self, queue, callback, *args, **kwargs):
-            self.current_queue = queue
-            self.current_callback = callback
-
-        def consume(self, *args, **kwargs):
-            while True:
-                item = self.get(self.current_queue)
-                if item:
-                    self.current_callback(item)
-                    raise StopIteration()
-                greenthread.sleep(0)
-
-        def get(self, queue, no_ack=False):
-            if not queue in self._queues or not self._queues[queue].size():
-                return None
-            (message_data, content_type, content_encoding) = \
-                    self._queues[queue].pop()
-            message = Message(backend=self, body=message_data,
-                              content_type=content_type,
-                              content_encoding=content_encoding)
-            message.result = True
-            logging.debug('Getting from %s: %s', queue, message)
-            return message
-
-        def prepare_message(self, message_data, delivery_mode,
-                            content_type, content_encoding, **kwargs):
-            """Prepare message for sending."""
-            return (message_data, content_type, content_encoding)
-
-        def publish(self, message, exchange, routing_key, **kwargs):
-            if exchange in self._exchanges:
-                self._exchanges[exchange].publish(
-                        message, routing_key=routing_key)
-
-    __instance = None
-
-    def __init__(self, *args, **kwargs):
-        if Backend.__instance is None:
-            Backend.__instance = Backend.__impl(*args, **kwargs)
-        self.__dict__['_Backend__instance'] = Backend.__instance
-
-    def __getattr__(self, attr):
-        return getattr(self.__instance, attr)
-
-    def __setattr__(self, attr, value):
-        return setattr(self.__instance, attr, value)
+class Backend(base.BaseBackend):
+    def queue_declare(self, queue, **kwargs):
+        global QUEUES
+        if queue not in QUEUES:
+            logging.debug(_('Declaring queue %s'), queue)
+            QUEUES[queue] = Queue(queue)
+
+    def exchange_declare(self, exchange, type, *args, **kwargs):
+        global EXCHANGES
+        if exchange not in EXCHANGES:
+            logging.debug(_('Declaring exchange %s'), exchange)
+            EXCHANGES[exchange] = Exchange(exchange, type)
+
+    def queue_bind(self, queue, exchange, routing_key, **kwargs):
+        global EXCHANGES
+        global QUEUES
+        logging.debug(_('Binding %s to %s with key %s'),
+                      queue, exchange, routing_key)
+        EXCHANGES[exchange].bind(QUEUES[queue].push, routing_key)
+
+    def declare_consumer(self, queue, callback, *args, **kwargs):
+        self.current_queue = queue
+        self.current_callback = callback
+
+    def consume(self, limit=None):
+        while True:
+            item = self.get(self.current_queue)
+            if item:
+                self.current_callback(item)
+                raise StopIteration()
+            greenthread.sleep(0)
+
+    def get(self, queue, no_ack=False):
+        global QUEUES
+        if not queue in QUEUES or not QUEUES[queue].size():
+            return None
+        (message_data, content_type, content_encoding) = QUEUES[queue].pop()
+        message = Message(backend=self, body=message_data,
+                          content_type=content_type,
+                          content_encoding=content_encoding)
+        message.result = True
+        logging.debug(_('Getting from %s: %s'), queue, message)
+        return message
+
+    def prepare_message(self, message_data, delivery_mode,
+                        content_type, content_encoding, **kwargs):
+        """Prepare message for sending."""
+        return (message_data, content_type, content_encoding)
+
+    def publish(self, message, exchange, routing_key, **kwargs):
+        global EXCHANGES
+        if exchange in EXCHANGES:
+            EXCHANGES[exchange].publish(message, routing_key=routing_key)
 
 
 def reset_all():
-    Backend()._reset_all()
+    global EXCHANGES
+    global QUEUES
+    EXCHANGES = {}
+    QUEUES = {}
diff --git a/nova/flags.py b/nova/flags.py
index c6578023d..76a98d35a 100644
--- a/nova/flags.py
+++ b/nova/flags.py
@@ -29,6 +29,8 @@ import sys
 
 import gflags
 
+from nova import utils
+
 
 class FlagValues(gflags.FlagValues):
     """Extension of gflags.FlagValues that allows undefined and runtime flags.
@@ -159,6 +161,7 @@ class StrWrapper(object):
                 return str(val)
         raise KeyError(name)
 
+
 FLAGS = FlagValues()
 gflags.FLAGS = FLAGS
 gflags.DEFINE_flag(gflags.HelpFlag(), FLAGS)
@@ -183,6 +186,12 @@ DEFINE_list = _wrapper(gflags.DEFINE_list)
 DEFINE_spaceseplist = _wrapper(gflags.DEFINE_spaceseplist)
 DEFINE_multistring = _wrapper(gflags.DEFINE_multistring)
 DEFINE_multi_int = _wrapper(gflags.DEFINE_multi_int)
+DEFINE_flag = _wrapper(gflags.DEFINE_flag)
+
+
+HelpFlag = gflags.HelpFlag
+HelpshortFlag = gflags.HelpshortFlag
+HelpXMLFlag = gflags.HelpXMLFlag
 
 
 def DECLARE(name, module_string, flag_values=FLAGS):
@@ -204,7 +213,8 @@ DEFINE_string('connection_type', 'libvirt', 'libvirt, xenapi or fake')
 DEFINE_string('aws_access_key_id', 'admin', 'AWS Access ID')
 DEFINE_string('aws_secret_access_key', 'admin', 'AWS Access Key')
 DEFINE_integer('s3_port', 3333, 's3 port')
-DEFINE_string('s3_host', '127.0.0.1', 's3 host')
+DEFINE_string('s3_host', utils.get_my_ip(), 's3 host (for infrastructure)')
+DEFINE_string('s3_dmz', utils.get_my_ip(), 's3 dmz ip (for instances)')
 DEFINE_string('compute_topic', 'compute', 'the topic compute nodes listen on')
 DEFINE_string('scheduler_topic', 'scheduler',
               'the topic scheduler nodes listen on')
@@ -223,22 +233,24 @@ DEFINE_string('rabbit_virtual_host', '/', 'rabbit virtual host')
 DEFINE_integer('rabbit_retry_interval', 10, 'rabbit connection retry interval')
 DEFINE_integer('rabbit_max_retries', 12, 'rabbit connection attempts')
 DEFINE_string('control_exchange', 'nova', 'the main exchange to connect to')
-DEFINE_string('ec2_url', 'http://127.0.0.1:8773/services/Cloud',
-              'Url to ec2 api server')
+DEFINE_string('ec2_prefix', 'http', 'prefix for ec2')
+DEFINE_string('cc_host', utils.get_my_ip(), 'ip of api server')
+DEFINE_string('cc_dmz', utils.get_my_ip(), 'internal ip of api server')
+DEFINE_integer('cc_port', 8773, 'cloud controller port')
+DEFINE_string('ec2_suffix', '/services/Cloud', 'suffix for ec2')
 
 DEFINE_string('default_image', 'ami-11111',
               'default image to use, testing only')
-DEFINE_string('default_kernel', 'aki-11111',
-              'default kernel to use, testing only')
-DEFINE_string('default_ramdisk', 'ari-11111',
-              'default ramdisk to use, testing only')
 DEFINE_string('default_instance_type', 'm1.small',
               'default instance type to use, testing only')
+DEFINE_string('null_kernel', 'nokernel',
+              'kernel image that indicates not to use a kernel,'
+              ' but to use a raw disk image instead')
 
-DEFINE_string('vpn_image_id', 'ami-CLOUDPIPE', 'AMI for cloudpipe vpn server')
+DEFINE_string('vpn_image_id', 'ami-cloudpipe', 'AMI for cloudpipe vpn server')
 DEFINE_string('vpn_key_suffix',
-              '-key',
-              'Suffix to add to project name for vpn key')
+              '-vpn',
+              'Suffix to add to project name for vpn key and secgroups')
 
 DEFINE_integer('auth_token_ttl', 3600, 'Seconds for auth tokens to linger')
 
diff --git a/nova/image/glance.py b/nova/image/glance.py
index 1ca6cf2eb..cb3936df1 100644
--- a/nova/image/glance.py
+++ b/nova/image/glance.py
@@ -77,8 +77,8 @@ class ParallaxClient(object):
                 data = json.loads(res.read())['images']
                 return data
             else:
-                logging.warn("Parallax returned HTTP error %d from "
-                             "request for /images", res.status_int)
+                logging.warn(_("Parallax returned HTTP error %d from "
+                               "request for /images"), res.status_int)
                 return []
         finally:
             c.close()
@@ -96,8 +96,8 @@ class ParallaxClient(object):
                 data = json.loads(res.read())['images']
                 return data
             else:
-                logging.warn("Parallax returned HTTP error %d from "
-                             "request for /images/detail", res.status_int)
+                logging.warn(_("Parallax returned HTTP error %d from "
+                               "request for /images/detail"), res.status_int)
                 return []
         finally:
             c.close()
diff --git a/nova/image/s3.py b/nova/image/s3.py
index 0a25161de..7b04aa072 100644
--- a/nova/image/s3.py
+++ b/nova/image/s3.py
@@ -79,7 +79,8 @@ class S3ImageService(service.BaseImageService):
         result = self.index(context)
         result = [i for i in result if i['imageId'] == image_id]
         if not result:
-            raise exception.NotFound('Image %s could not be found' % image_id)
+            raise exception.NotFound(_('Image %s could not be found')
+                                     % image_id)
         image = result[0]
         return image
 
diff --git a/nova/manager.py b/nova/manager.py
index 5b61f7a4c..3d38504bd 100644
--- a/nova/manager.py
+++ b/nova/manager.py
@@ -55,7 +55,6 @@ from nova import utils
 from nova import flags
 from nova.db import base
 
-from twisted.internet import defer
 
 FLAGS = flags.FLAGS
 
@@ -67,10 +66,9 @@ class Manager(base.Base):
         self.host = host
         super(Manager, self).__init__(db_driver)
 
-    @defer.inlineCallbacks
     def periodic_tasks(self, context=None):
         """Tasks to be run at a periodic interval"""
-        yield
+        pass
 
     def init_host(self):
         """Do any initialization that needs to be run if this is a standalone
diff --git a/nova/network/linux_net.py b/nova/network/linux_net.py
index 0fefd9415..931a89554 100644
--- a/nova/network/linux_net.py
+++ b/nova/network/linux_net.py
@@ -19,7 +19,6 @@ Implements vlans, bridges, and iptables rules using linux utilities.
 
 import logging
 import os
-import signal
 
 # TODO(ja): does the definition of network_path belong here?
 
@@ -46,41 +45,90 @@ flags.DEFINE_string('vlan_interface', 'eth0',
                     'network device for vlans')
 flags.DEFINE_string('dhcpbridge', _bin_file('nova-dhcpbridge'),
                         'location of nova-dhcpbridge')
-flags.DEFINE_string('cc_host', utils.get_my_ip(), 'ip of api server')
-flags.DEFINE_integer('cc_port', 8773, 'cloud controller port')
-flags.DEFINE_string('routing_source_ip', '127.0.0.1',
+flags.DEFINE_string('routing_source_ip', utils.get_my_ip(),
                     'Public IP of network host')
 flags.DEFINE_bool('use_nova_chains', False,
                   'use the nova_ routing chains instead of default')
-
-DEFAULT_PORTS = [("tcp", 80), ("tcp", 22), ("udp", 1194), ("tcp", 443)]
+flags.DEFINE_string('dns_server', None,
+                    'if set, uses specific dns server for dnsmasq')
+flags.DEFINE_string('dmz_cidr', '10.128.0.0/24',
+                    'dmz range that should be accepted')
 
 
 def metadata_forward():
     """Create forwarding rule for metadata"""
     _confirm_rule("PREROUTING", "-t nat -s 0.0.0.0/0 "
              "-d 169.254.169.254/32 -p tcp -m tcp --dport 80 -j DNAT "
-             "--to-destination %s:%s" % (FLAGS.cc_host, FLAGS.cc_port))
+             "--to-destination %s:%s" % (FLAGS.cc_dmz, FLAGS.cc_port))
 
 
 def init_host():
     """Basic networking setup goes here"""
+
+    if FLAGS.use_nova_chains:
+        _execute("sudo iptables -N nova_input", check_exit_code=False)
+        _execute("sudo iptables -D %s -j nova_input" % FLAGS.input_chain,
+                 check_exit_code=False)
+        _execute("sudo iptables -A %s -j nova_input" % FLAGS.input_chain)
+
+        _execute("sudo iptables -N nova_forward", check_exit_code=False)
+        _execute("sudo iptables -D FORWARD -j nova_forward",
+                 check_exit_code=False)
+        _execute("sudo iptables -A FORWARD -j nova_forward")
+
+        _execute("sudo iptables -N nova_output", check_exit_code=False)
+        _execute("sudo iptables -D OUTPUT -j nova_output",
+                 check_exit_code=False)
+        _execute("sudo iptables -A OUTPUT -j nova_output")
+
+        _execute("sudo iptables -t nat -N nova_prerouting",
+                 check_exit_code=False)
+        _execute("sudo iptables -t nat -D PREROUTING -j nova_prerouting",
+                 check_exit_code=False)
+        _execute("sudo iptables -t nat -A PREROUTING -j nova_prerouting")
+
+        _execute("sudo iptables -t nat -N nova_postrouting",
+                 check_exit_code=False)
+        _execute("sudo iptables -t nat -D POSTROUTING -j nova_postrouting",
+                 check_exit_code=False)
+        _execute("sudo iptables -t nat -A POSTROUTING -j nova_postrouting")
+
+        _execute("sudo iptables -t nat -N nova_snatting",
+                 check_exit_code=False)
+        _execute("sudo iptables -t nat -D POSTROUTING -j nova_snatting",
+                 check_exit_code=False)
+        _execute("sudo iptables -t nat -A POSTROUTING -j nova_snatting")
+
+        _execute("sudo iptables -t nat -N nova_output", check_exit_code=False)
+        _execute("sudo iptables -t nat -D OUTPUT -j nova_output",
+                 check_exit_code=False)
+        _execute("sudo iptables -t nat -A OUTPUT -j nova_output")
+    else:
+        # NOTE(vish): This makes it easy to ensure snatting rules always
+        #             come after the accept rules in the postrouting chain
+        _execute("sudo iptables -t nat -N SNATTING",
+                 check_exit_code=False)
+        _execute("sudo iptables -t nat -D POSTROUTING -j SNATTING",
+                 check_exit_code=False)
+        _execute("sudo iptables -t nat -A POSTROUTING -j SNATTING")
+
     # NOTE(devcamcar): Cloud public SNAT entries and the default
     # SNAT rule for outbound traffic.
-    _confirm_rule("POSTROUTING", "-t nat -s %s "
+    _confirm_rule("SNATTING", "-t nat -s %s "
              "-j SNAT --to-source %s"
-             % (FLAGS.fixed_range, FLAGS.routing_source_ip))
+             % (FLAGS.fixed_range, FLAGS.routing_source_ip), append=True)
 
-    _confirm_rule("POSTROUTING", "-t nat -s %s -j MASQUERADE" %
-                  FLAGS.fixed_range)
+    _confirm_rule("POSTROUTING", "-t nat -s %s -d %s -j ACCEPT" %
+                  (FLAGS.fixed_range, FLAGS.dmz_cidr))
     _confirm_rule("POSTROUTING", "-t nat -s %(range)s -d %(range)s -j ACCEPT" %
                   {'range': FLAGS.fixed_range})
 
 
-def bind_floating_ip(floating_ip):
+def bind_floating_ip(floating_ip, check_exit_code=True):
     """Bind ip to public interface"""
     _execute("sudo ip addr add %s dev %s" % (floating_ip,
-                                             FLAGS.public_interface))
+                                             FLAGS.public_interface),
+             check_exit_code=check_exit_code)
 
 
 def unbind_floating_ip(floating_ip):
@@ -102,27 +150,16 @@ def ensure_floating_forward(floating_ip, fixed_ip):
     """Ensure floating ip forwarding rule"""
     _confirm_rule("PREROUTING", "-t nat -d %s -j DNAT --to %s"
                            % (floating_ip, fixed_ip))
-    _confirm_rule("POSTROUTING", "-t nat -s %s -j SNAT --to %s"
+    _confirm_rule("SNATTING", "-t nat -s %s -j SNAT --to %s"
                            % (fixed_ip, floating_ip))
-    # TODO(joshua): Get these from the secgroup datastore entries
-    _confirm_rule("FORWARD", "-d %s -p icmp -j ACCEPT"
-                           % (fixed_ip))
-    for (protocol, port) in DEFAULT_PORTS:
-        _confirm_rule("FORWARD", "-d %s -p %s --dport %s -j ACCEPT"
-            % (fixed_ip, protocol, port))
 
 
 def remove_floating_forward(floating_ip, fixed_ip):
     """Remove forwarding for floating ip"""
     _remove_rule("PREROUTING", "-t nat -d %s -j DNAT --to %s"
                           % (floating_ip, fixed_ip))
-    _remove_rule("POSTROUTING", "-t nat -s %s -j SNAT --to %s"
+    _remove_rule("SNATTING", "-t nat -s %s -j SNAT --to %s"
                           % (fixed_ip, floating_ip))
-    _remove_rule("FORWARD", "-d %s -p icmp -j ACCEPT"
-                          % (fixed_ip))
-    for (protocol, port) in DEFAULT_PORTS:
-        _remove_rule("FORWARD", "-d %s -p %s --dport %s -j ACCEPT"
-                              % (fixed_ip, protocol, port))
 
 
 def ensure_vlan_bridge(vlan_num, bridge, net_attrs=None):
@@ -135,7 +172,7 @@ def ensure_vlan(vlan_num):
     """Create a vlan unless it already exists"""
     interface = "vlan%s" % vlan_num
     if not _device_exists(interface):
-        logging.debug("Starting VLAN inteface %s", interface)
+        logging.debug(_("Starting VLAN inteface %s"), interface)
         _execute("sudo vconfig set_name_type VLAN_PLUS_VID_NO_PAD")
         _execute("sudo vconfig add %s %s" % (FLAGS.vlan_interface, vlan_num))
         _execute("sudo ifconfig %s up" % interface)
@@ -145,7 +182,7 @@ def ensure_vlan(vlan_num):
 def ensure_bridge(bridge, interface, net_attrs=None):
     """Create a bridge unless it already exists"""
     if not _device_exists(bridge):
-        logging.debug("Starting Bridge interface for %s", interface)
+        logging.debug(_("Starting Bridge interface for %s"), interface)
         _execute("sudo brctl addbr %s" % bridge)
         _execute("sudo brctl setfd %s 0" % bridge)
         # _execute("sudo brctl setageing %s 10" % bridge)
@@ -160,6 +197,15 @@ def ensure_bridge(bridge, interface, net_attrs=None):
                  net_attrs['netmask']))
     else:
         _execute("sudo ifconfig %s up" % bridge)
+    if FLAGS.use_nova_chains:
+        (out, err) = _execute("sudo iptables -N nova_forward",
+                              check_exit_code=False)
+        if err != 'iptables: Chain already exists.\n':
+            # NOTE(vish): chain didn't exist link chain
+            _execute("sudo iptables -D FORWARD -j nova_forward",
+                     check_exit_code=False)
+            _execute("sudo iptables -A FORWARD -j nova_forward")
+
     _confirm_rule("FORWARD", "--in-interface %s -j ACCEPT" % bridge)
     _confirm_rule("FORWARD", "--out-interface %s -j ACCEPT" % bridge)
 
@@ -202,9 +248,9 @@ def update_dhcp(context, network_id):
                 _execute('sudo kill -HUP %d' % pid)
                 return
             except Exception as exc:  # pylint: disable-msg=W0703
-                logging.debug("Hupping dnsmasq threw %s", exc)
+                logging.debug(_("Hupping dnsmasq threw %s"), exc)
         else:
-            logging.debug("Pid %d is stale, relaunching dnsmasq", pid)
+            logging.debug(_("Pid %d is stale, relaunching dnsmasq"), pid)
 
     # FLAGFILE and DNSMASQ_INTERFACE in env
     env = {'FLAGFILE': FLAGS.dhcpbridge_flagfile,
@@ -236,13 +282,17 @@ def _device_exists(device):
     return not err
 
 
-def _confirm_rule(chain, cmd):
+def _confirm_rule(chain, cmd, append=False):
     """Delete and re-add iptables rule"""
     if FLAGS.use_nova_chains:
         chain = "nova_%s" % chain.lower()
+    if append:
+        loc = "-A"
+    else:
+        loc = "-I"
     _execute("sudo iptables --delete %s %s" % (chain, cmd),
              check_exit_code=False)
-    _execute("sudo iptables -I %s %s" % (chain, cmd))
+    _execute("sudo iptables %s %s %s" % (loc, chain, cmd))
 
 
 def _remove_rule(chain, cmd):
@@ -265,6 +315,8 @@ def _dnsmasq_cmd(net):
            ' --dhcp-hostsfile=%s' % _dhcp_file(net['bridge'], 'conf'),
            ' --dhcp-script=%s' % FLAGS.dhcpbridge,
            ' --leasefile-ro']
+    if FLAGS.dns_server:
+        cmd.append(' -h -R --server=%s' % FLAGS.dns_server)
     return ''.join(cmd)
 
 
@@ -276,7 +328,7 @@ def _stop_dnsmasq(network):
         try:
             _execute('sudo kill -TERM %d' % pid)
         except Exception as exc:  # pylint: disable-msg=W0703
-            logging.debug("Killing dnsmasq threw %s", exc)
+            logging.debug(_("Killing dnsmasq threw %s"), exc)
 
 
 def _dhcp_file(bridge, kind):
diff --git a/nova/network/manager.py b/nova/network/manager.py
index a7298b47f..16aa8f895 100644
--- a/nova/network/manager.py
+++ b/nova/network/manager.py
@@ -47,9 +47,9 @@ topologies.  All of the network commands are issued to a subclass of
 import datetime
 import logging
 import math
+import socket
 
 import IPy
-from twisted.internet import defer
 
 from nova import context
 from nova import db
@@ -57,6 +57,7 @@ from nova import exception
 from nova import flags
 from nova import manager
 from nova import utils
+from nova import rpc
 
 
 FLAGS = flags.FLAGS
@@ -88,6 +89,10 @@ flags.DEFINE_bool('update_dhcp_on_disassociate', False,
                   'Whether to update dhcp when fixed_ip is disassociated')
 flags.DEFINE_integer('fixed_ip_disassociate_timeout', 600,
                      'Seconds after which a deallocated ip is disassociated')
+flags.DEFINE_string('network_host', socket.gethostname(),
+                    'Network host to use for ip allocation in flat modes')
+flags.DEFINE_bool('fake_call', False,
+                  'If True, skip using the queue and make local calls')
 
 
 class AddressAlreadyAllocated(exception.Error):
@@ -113,10 +118,20 @@ class NetworkManager(manager.Manager):
         ctxt = context.get_admin_context()
         for network in self.db.host_get_networks(ctxt, self.host):
             self._on_set_network_host(ctxt, network['id'])
+        floating_ips = self.db.floating_ip_get_all_by_host(ctxt,
+                                                           self.host)
+        for floating_ip in floating_ips:
+            if floating_ip.get('fixed_ip', None):
+                fixed_address = floating_ip['fixed_ip']['address']
+                # NOTE(vish): The False here is because we ignore the case
+                #             that the ip is already bound.
+                self.driver.bind_floating_ip(floating_ip['address'], False)
+                self.driver.ensure_floating_forward(floating_ip['address'],
+                                                    fixed_address)
 
     def set_network_host(self, context, network_id):
         """Safely sets the host of the network."""
-        logging.debug("setting network host")
+        logging.debug(_("setting network host"))
         host = self.db.network_set_host(context,
                                         network_id,
                                         self.host)
@@ -175,10 +190,10 @@ class NetworkManager(manager.Manager):
         fixed_ip_ref = self.db.fixed_ip_get_by_address(context, address)
         instance_ref = fixed_ip_ref['instance']
         if not instance_ref:
-            raise exception.Error("IP %s leased that isn't associated" %
+            raise exception.Error(_("IP %s leased that isn't associated") %
                                   address)
         if instance_ref['mac_address'] != mac:
-            raise exception.Error("IP %s leased to bad mac %s vs %s" %
+            raise exception.Error(_("IP %s leased to bad mac %s vs %s") %
                                   (address, instance_ref['mac_address'], mac))
         now = datetime.datetime.utcnow()
         self.db.fixed_ip_update(context,
@@ -186,7 +201,8 @@ class NetworkManager(manager.Manager):
                                 {'leased': True,
                                  'updated_at': now})
         if not fixed_ip_ref['allocated']:
-            logging.warn("IP %s leased that was already deallocated", address)
+            logging.warn(_("IP %s leased that was already deallocated"),
+                         address)
 
     def release_fixed_ip(self, context, mac, address):
         """Called by dhcp-bridge when ip is released."""
@@ -194,13 +210,13 @@ class NetworkManager(manager.Manager):
         fixed_ip_ref = self.db.fixed_ip_get_by_address(context, address)
         instance_ref = fixed_ip_ref['instance']
         if not instance_ref:
-            raise exception.Error("IP %s released that isn't associated" %
+            raise exception.Error(_("IP %s released that isn't associated") %
                                   address)
         if instance_ref['mac_address'] != mac:
-            raise exception.Error("IP %s released from bad mac %s vs %s" %
+            raise exception.Error(_("IP %s released from bad mac %s vs %s") %
                                   (address, instance_ref['mac_address'], mac))
         if not fixed_ip_ref['leased']:
-            logging.warn("IP %s released that was not leased", address)
+            logging.warn(_("IP %s released that was not leased"), address)
         self.db.fixed_ip_update(context,
                                 fixed_ip_ref['address'],
                                 {'leased': False})
@@ -213,8 +229,8 @@ class NetworkManager(manager.Manager):
                 network_ref = self.db.fixed_ip_get_network(context, address)
                 self.driver.update_dhcp(context, network_ref['id'])
 
-    def get_network(self, context):
-        """Get the network for the current context."""
+    def get_network_host(self, context):
+        """Get the network host for the current context."""
         raise NotImplementedError()
 
     def create_networks(self, context, num_networks, network_size,
@@ -302,10 +318,6 @@ class FlatManager(NetworkManager):
         """Network is created manually."""
         pass
 
-    def setup_fixed_ip(self, context, address):
-        """Currently no setup."""
-        pass
-
     def create_networks(self, context, cidr, num_networks, network_size,
                         *args, **kwargs):
         """Create networks based on parameters."""
@@ -326,14 +338,25 @@ class FlatManager(NetworkManager):
             if network_ref:
                 self._create_fixed_ips(context, network_ref['id'])
 
-    def get_network(self, context):
-        """Get the network for the current context."""
-        # NOTE(vish): To support mutilple network hosts, This could randomly
-        #             select from multiple networks instead of just
-        #             returning the one. It could also potentially be done
-        #             in the scheduler.
-        return self.db.network_get_by_bridge(context,
-                                             FLAGS.flat_network_bridge)
+    def get_network_host(self, context):
+        """Get the network host for the current context."""
+        network_ref = self.db.network_get_by_bridge(context,
+                                                    FLAGS.flat_network_bridge)
+        # NOTE(vish): If the network has no host, use the network_host flag.
+        #             This could eventually be a a db lookup of some sort, but
+        #             a flag is easy to handle for now.
+        host = network_ref['host']
+        if not host:
+            topic = self.db.queue_get_for(context,
+                                          FLAGS.network_topic,
+                                          FLAGS.network_host)
+            if FLAGS.fake_call:
+                return self.set_network_host(context, network_ref['id'])
+            host = rpc.call(context,
+                            FLAGS.network_topic,
+                            {"method": "set_network_host",
+                             "args": {"network_id": network_ref['id']}})
+        return host
 
     def _on_set_network_host(self, context, network_id):
         """Called when this host becomes the host for a network."""
@@ -362,13 +385,18 @@ class FlatDHCPManager(FlatManager):
         """Sets up matching network for compute hosts."""
         network_ref = db.network_get_by_instance(context, instance_id)
         self.driver.ensure_bridge(network_ref['bridge'],
-                                  FLAGS.flat_interface,
-                                  network_ref)
+                                  FLAGS.flat_interface)
 
-    def setup_fixed_ip(self, context, address):
+    def allocate_fixed_ip(self, context, instance_id, *args, **kwargs):
         """Setup dhcp for this network."""
+        address = super(FlatDHCPManager, self).allocate_fixed_ip(context,
+                                                                 instance_id,
+                                                                 *args,
+                                                                 **kwargs)
         network_ref = db.fixed_ip_get_network(context, address)
-        self.driver.update_dhcp(context, network_ref['id'])
+        if not FLAGS.fake_network:
+            self.driver.update_dhcp(context, network_ref['id'])
+        return address
 
     def deallocate_fixed_ip(self, context, address, *args, **kwargs):
         """Returns a fixed ip to the pool."""
@@ -399,10 +427,9 @@ class VlanManager(NetworkManager):
     instances in its subnet.
     """
 
-    @defer.inlineCallbacks
     def periodic_tasks(self, context=None):
         """Tasks to be run at a periodic interval."""
-        yield super(VlanManager, self).periodic_tasks(context)
+        super(VlanManager, self).periodic_tasks(context)
         now = datetime.datetime.utcnow()
         timeout = FLAGS.fixed_ip_disassociate_timeout
         time = now - datetime.timedelta(seconds=timeout)
@@ -410,7 +437,7 @@ class VlanManager(NetworkManager):
                                                            self.host,
                                                            time)
         if num:
-            logging.debug("Dissassociated %s stale fixed ip(s)", num)
+            logging.debug(_("Dissassociated %s stale fixed ip(s)"), num)
 
     def init_host(self):
         """Do any initialization that needs to be run if this is a
@@ -438,33 +465,20 @@ class VlanManager(NetworkManager):
                                                       network_ref['id'],
                                                       instance_id)
         self.db.fixed_ip_update(context, address, {'allocated': True})
+        if not FLAGS.fake_network:
+            self.driver.update_dhcp(context, network_ref['id'])
         return address
 
     def deallocate_fixed_ip(self, context, address, *args, **kwargs):
         """Returns a fixed ip to the pool."""
         self.db.fixed_ip_update(context, address, {'allocated': False})
 
-    def setup_fixed_ip(self, context, address):
-        """Sets forwarding rules and dhcp for fixed ip."""
-        fixed_ip_ref = self.db.fixed_ip_get_by_address(context, address)
-        network_ref = self.db.fixed_ip_get_network(context, address)
-        if self.db.instance_is_vpn(context, fixed_ip_ref['instance_id']):
-            self.driver.ensure_vlan_forward(network_ref['vpn_public_address'],
-                                            network_ref['vpn_public_port'],
-                                            network_ref['vpn_private_address'])
-        self.driver.update_dhcp(context, network_ref['id'])
-
     def setup_compute_network(self, context, instance_id):
         """Sets up matching network for compute hosts."""
         network_ref = db.network_get_by_instance(context, instance_id)
         self.driver.ensure_vlan_bridge(network_ref['vlan'],
                                        network_ref['bridge'])
 
-    def restart_nets(self):
-        """Ensure the network for each user is enabled."""
-        # TODO(vish): Implement this
-        pass
-
     def create_networks(self, context, cidr, num_networks, network_size,
                         vlan_start, vpn_start):
         """Create networks based on parameters."""
@@ -491,21 +505,45 @@ class VlanManager(NetworkManager):
             if network_ref:
                 self._create_fixed_ips(context, network_ref['id'])
 
-    def get_network(self, context):
+    def get_network_host(self, context):
         """Get the network for the current context."""
-        return self.db.project_get_network(context.elevated(),
-                                           context.project_id)
+        network_ref = self.db.project_get_network(context.elevated(),
+                                                  context.project_id)
+        # NOTE(vish): If the network has no host, do a call to get an
+        #             available host.  This should be changed to go through
+        #             the scheduler at some point.
+        host = network_ref['host']
+        if not host:
+            if FLAGS.fake_call:
+                return self.set_network_host(context, network_ref['id'])
+            host = rpc.call(context,
+                            FLAGS.network_topic,
+                            {"method": "set_network_host",
+                             "args": {"network_id": network_ref['id']}})
+
+        return host
 
     def _on_set_network_host(self, context, network_id):
         """Called when this host becomes the host for a network."""
         network_ref = self.db.network_get(context, network_id)
-        net = {}
-        net['vpn_public_address'] = FLAGS.vpn_ip
-        db.network_update(context, network_id, net)
+        if not network_ref['vpn_public_address']:
+            net = {}
+            address = FLAGS.vpn_ip
+            net['vpn_public_address'] = address
+            db.network_update(context, network_id, net)
+        else:
+            address = network_ref['vpn_public_address']
         self.driver.ensure_vlan_bridge(network_ref['vlan'],
                                        network_ref['bridge'],
                                        network_ref)
-        self.driver.update_dhcp(context, network_id)
+        # NOTE(vish): only ensure this forward if the address hasn't been set
+        #             manually.
+        if address == FLAGS.vpn_ip:
+            self.driver.ensure_vlan_forward(FLAGS.vpn_ip,
+                                            network_ref['vpn_public_port'],
+                                            network_ref['vpn_private_address'])
+        if not FLAGS.fake_network:
+            self.driver.update_dhcp(context, network_id)
 
     @property
     def _bottom_reserved_ips(self):
diff --git a/nova/objectstore/handler.py b/nova/objectstore/handler.py
index c8920b00c..52257f69f 100644
--- a/nova/objectstore/handler.py
+++ b/nova/objectstore/handler.py
@@ -102,7 +102,7 @@ def _render_parts(value, write_cb):
                 _render_parts(subsubvalue, write_cb)
                 write_cb('</' + utils.utf8(name) + '>')
     else:
-        raise Exception("Unknown S3 value type %r", value)
+        raise Exception(_("Unknown S3 value type %r"), value)
 
 
 def get_argument(request, key, default_value):
@@ -134,7 +134,7 @@ def get_context(request):
                                           check_type='s3')
         return context.RequestContext(user, project)
     except exception.Error as ex:
-        logging.debug("Authentication Failure: %s", ex)
+        logging.debug(_("Authentication Failure: %s"), ex)
         raise exception.NotAuthorized()
 
 
@@ -227,7 +227,7 @@ class BucketResource(ErrorHandlingResource):
 
     def render_PUT(self, request):
         "Creates the bucket resource"""
-        logging.debug("Creating bucket %s", self.name)
+        logging.debug(_("Creating bucket %s"), self.name)
         logging.debug("calling bucket.Bucket.create(%r, %r)",
                       self.name,
                       request.context)
@@ -237,7 +237,7 @@ class BucketResource(ErrorHandlingResource):
 
     def render_DELETE(self, request):
         """Deletes the bucket resource"""
-        logging.debug("Deleting bucket %s", self.name)
+        logging.debug(_("Deleting bucket %s"), self.name)
         bucket_object = bucket.Bucket(self.name)
 
         if not bucket_object.is_authorized(request.context):
@@ -261,7 +261,9 @@ class ObjectResource(ErrorHandlingResource):
         Raises NotAuthorized if user in request context is not
         authorized to delete the object.
         """
-        logging.debug("Getting object: %s / %s", self.bucket.name, self.name)
+        logging.debug(_("Getting object: %s / %s"),
+                      self.bucket.name,
+                      self.name)
 
         if not self.bucket.is_authorized(request.context):
             raise exception.NotAuthorized()
@@ -279,7 +281,9 @@ class ObjectResource(ErrorHandlingResource):
         Raises NotAuthorized if user in request context is not
         authorized to delete the object.
         """
-        logging.debug("Putting object: %s / %s", self.bucket.name, self.name)
+        logging.debug(_("Putting object: %s / %s"),
+                      self.bucket.name,
+                      self.name)
 
         if not self.bucket.is_authorized(request.context):
             raise exception.NotAuthorized()
@@ -298,7 +302,7 @@ class ObjectResource(ErrorHandlingResource):
         authorized to delete the object.
         """
 
-        logging.debug("Deleting object: %s / %s",
+        logging.debug(_("Deleting object: %s / %s"),
                       self.bucket.name,
                       self.name)
 
@@ -394,17 +398,17 @@ class ImagesResource(resource.Resource):
         image_id = get_argument(request, 'image_id', u'')
         image_object = image.Image(image_id)
         if not image_object.is_authorized(request.context):
-            logging.debug("not authorized for render_POST in images")
+            logging.debug(_("not authorized for render_POST in images"))
             raise exception.NotAuthorized()
 
         operation = get_argument(request, 'operation', u'')
         if operation:
             # operation implies publicity toggle
-            logging.debug("handling publicity toggle")
+            logging.debug(_("handling publicity toggle"))
             image_object.set_public(operation == 'add')
         else:
             # other attributes imply update
-            logging.debug("update user fields")
+            logging.debug(_("update user fields"))
             clean_args = {}
             for arg in request.args.keys():
                 clean_args[arg] = request.args[arg][0]
diff --git a/nova/objectstore/image.py b/nova/objectstore/image.py
index 7292dbab8..abc28182e 100644
--- a/nova/objectstore/image.py
+++ b/nova/objectstore/image.py
@@ -21,7 +21,6 @@ Take uploaded bucket contents and register them as disk images (AMIs).
 Requires decryption using keys in the manifest.
 """
 
-# TODO(jesse): Got these from Euca2ools, will need to revisit them
 
 import binascii
 import glob
@@ -29,7 +28,6 @@ import json
 import os
 import shutil
 import tarfile
-import tempfile
 from xml.etree import ElementTree
 
 from nova import exception
@@ -199,12 +197,17 @@ class Image(object):
         except:
             ramdisk_id = None
 
+        try:
+            arch = manifest.find("machine_configuration/architecture").text
+        except:
+            arch = 'x86_64'
+
         info = {
             'imageId': image_id,
             'imageLocation': image_location,
             'imageOwnerId': context.project_id,
             'isPublic': False,  # FIXME: grab public from manifest
-            'architecture': 'x86_64',  # FIXME: grab architecture from manifest
+            'architecture': arch,
             'imageType': image_type}
 
         if kernel_id:
@@ -264,6 +267,7 @@ class Image(object):
         if err:
             raise exception.Error("Failed to decrypt initialization "
                                   "vector: %s" % err)
+
         _out, err = utils.execute(
                 'openssl enc -d -aes-128-cbc -in %s -K %s -iv %s -out %s'
                  % (encrypted_filename, key, iv, decrypted_filename),
diff --git a/nova/process.py b/nova/process.py
deleted file mode 100644
index b33df048b..000000000
--- a/nova/process.py
+++ /dev/null
@@ -1,209 +0,0 @@
-# vim: tabstop=4 shiftwidth=4 softtabstop=4
-
-# Copyright 2010 United States Government as represented by the
-# Administrator of the National Aeronautics and Space Administration.
-# Copyright 2010 FathomDB Inc.
-# All Rights Reserved.
-#
-#    Licensed under the Apache License, Version 2.0 (the "License"); you may
-#    not use this file except in compliance with the License. You may obtain
-#    a copy of the License at
-#
-#         http://www.apache.org/licenses/LICENSE-2.0
-#
-#    Unless required by applicable law or agreed to in writing, software
-#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-#    License for the specific language governing permissions and limitations
-#    under the License.
-
-"""
-Process pool using twisted threading
-"""
-
-import logging
-import StringIO
-
-from twisted.internet import defer
-from twisted.internet import error
-from twisted.internet import protocol
-from twisted.internet import reactor
-
-from nova import flags
-from nova.exception import ProcessExecutionError
-
-FLAGS = flags.FLAGS
-flags.DEFINE_integer('process_pool_size', 4,
-                     'Number of processes to use in the process pool')
-
-
-# This is based on _BackRelay from twister.internal.utils, but modified to
-#  capture both stdout and stderr, without odd stderr handling, and also to
-#  handle stdin
-class BackRelayWithInput(protocol.ProcessProtocol):
-    """
-    Trivial protocol for communicating with a process and turning its output
-    into the result of a L{Deferred}.
-
-    @ivar deferred: A L{Deferred} which will be called back with all of stdout
-        and all of stderr as well (as a tuple).  C{terminate_on_stderr} is true
-        and any bytes are received over stderr, this will fire with an
-        L{_ProcessExecutionError} instance and the attribute will be set to
-        C{None}.
-
-    @ivar onProcessEnded: If C{terminate_on_stderr} is false and bytes are
-        received over stderr, this attribute will refer to a L{Deferred} which
-        will be called back when the process ends.  This C{Deferred} is also
-        associated with the L{_ProcessExecutionError} which C{deferred} fires
-        with earlier in this case so that users can determine when the process
-        has actually ended, in addition to knowing when bytes have been
-        received via stderr.
-    """
-
-    def __init__(self, deferred, cmd, started_deferred=None,
-                 terminate_on_stderr=False, check_exit_code=True,
-                 process_input=None):
-        self.deferred = deferred
-        self.cmd = cmd
-        self.stdout = StringIO.StringIO()
-        self.stderr = StringIO.StringIO()
-        self.started_deferred = started_deferred
-        self.terminate_on_stderr = terminate_on_stderr
-        self.check_exit_code = check_exit_code
-        self.process_input = process_input
-        self.on_process_ended = None
-
-    def _build_execution_error(self, exit_code=None):
-        return ProcessExecutionError(cmd=self.cmd,
-                                     exit_code=exit_code,
-                                     stdout=self.stdout.getvalue(),
-                                     stderr=self.stderr.getvalue())
-
-    def errReceived(self, text):
-        self.stderr.write(text)
-        if self.terminate_on_stderr and (self.deferred is not None):
-            self.on_process_ended = defer.Deferred()
-            self.deferred.errback(self._build_execution_error())
-            self.deferred = None
-            self.transport.loseConnection()
-
-    def outReceived(self, text):
-        self.stdout.write(text)
-
-    def processEnded(self, reason):
-        if self.deferred is not None:
-            stdout, stderr = self.stdout.getvalue(), self.stderr.getvalue()
-            exit_code = reason.value.exitCode
-            if self.check_exit_code and exit_code != 0:
-                self.deferred.errback(self._build_execution_error(exit_code))
-            else:
-                try:
-                    if self.check_exit_code:
-                        reason.trap(error.ProcessDone)
-                    self.deferred.callback((stdout, stderr))
-                except:
-                    # NOTE(justinsb): This logic is a little suspicious to me.
-                    # If the callback throws an exception, then errback will
-                    # be called also. However, this is what the unit tests
-                    # test for.
-                    exec_error = self._build_execution_error(exit_code)
-                    self.deferred.errback(exec_error)
-        elif self.on_process_ended is not None:
-            self.on_process_ended.errback(reason)
-
-    def connectionMade(self):
-        if self.started_deferred:
-            self.started_deferred.callback(self)
-        if self.process_input:
-            self.transport.write(str(self.process_input))
-        self.transport.closeStdin()
-
-
-def get_process_output(executable, args=None, env=None, path=None,
-                       process_reactor=None, check_exit_code=True,
-                       process_input=None, started_deferred=None,
-                       terminate_on_stderr=False):
-    if process_reactor is None:
-        process_reactor = reactor
-    args = args and args or ()
-    env = env and env and {}
-    deferred = defer.Deferred()
-    cmd = executable
-    if args:
-        cmd = " ".join([cmd] + args)
-    logging.debug("Running cmd: %s", cmd)
-    process_handler = BackRelayWithInput(
-            deferred,
-            cmd,
-            started_deferred=started_deferred,
-            check_exit_code=check_exit_code,
-            process_input=process_input,
-            terminate_on_stderr=terminate_on_stderr)
-    # NOTE(vish): commands come in as unicode, but self.executes needs
-    #             strings or process.spawn raises a deprecation warning
-    executable = str(executable)
-    if not args is None:
-        args = [str(x) for x in args]
-    process_reactor.spawnProcess(process_handler, executable,
-                                 (executable,) + tuple(args), env, path)
-    return deferred
-
-
-class ProcessPool(object):
-    """ A simple process pool implementation using Twisted's Process bits.
-
-    This is pretty basic right now, but hopefully the API will be the correct
-    one so that it can be optimized later.
-    """
-    def __init__(self, size=None):
-        self.size = size and size or FLAGS.process_pool_size
-        self._pool = defer.DeferredSemaphore(self.size)
-
-    def simple_execute(self, cmd, **kw):
-        """ Weak emulation of the old utils.execute() function.
-
-        This only exists as a way to quickly move old execute methods to
-        this new style of code.
-
-        NOTE(termie): This will break on args with spaces in them.
-        """
-        parsed = cmd.split(' ')
-        executable, args = parsed[0], parsed[1:]
-        return self.execute(executable, args, **kw)
-
-    def execute(self, *args, **kw):
-        deferred = self._pool.acquire()
-
-        def _associate_process(proto):
-            deferred.process = proto.transport
-            return proto.transport
-
-        started = defer.Deferred()
-        started.addCallback(_associate_process)
-        kw.setdefault('started_deferred', started)
-
-        deferred.process = None
-        deferred.started = started
-
-        deferred.addCallback(lambda _: get_process_output(*args, **kw))
-        deferred.addBoth(self._release)
-        return deferred
-
-    def _release(self, retval=None):
-        self._pool.release()
-        return retval
-
-
-class SharedPool(object):
-    _instance = None
-
-    def __init__(self):
-        if SharedPool._instance is None:
-            self.__class__._instance = ProcessPool()
-
-    def __getattr__(self, key):
-        return getattr(self._instance, key)
-
-
-def simple_execute(cmd, **kwargs):
-    return SharedPool().simple_execute(cmd, **kwargs)
diff --git a/nova/rpc.py b/nova/rpc.py
index 86a29574f..844088348 100644
--- a/nova/rpc.py
+++ b/nova/rpc.py
@@ -25,18 +25,18 @@ import json
 import logging
 import sys
 import time
+import traceback
 import uuid
 
 from carrot import connection as carrot_connection
 from carrot import messaging
 from eventlet import greenthread
-from twisted.internet import defer
-from twisted.internet import task
 
+from nova import context
 from nova import exception
 from nova import fakerabbit
 from nova import flags
-from nova import context
+from nova import utils
 
 
 FLAGS = flags.FLAGS
@@ -91,15 +91,15 @@ class Consumer(messaging.Consumer):
                 self.failed_connection = False
                 break
             except:  # Catching all because carrot sucks
-                logging.exception("AMQP server on %s:%d is unreachable." \
-                    " Trying again in %d seconds." % (
+                logging.exception(_("AMQP server on %s:%d is unreachable."
+                    " Trying again in %d seconds.") % (
                     FLAGS.rabbit_host,
                     FLAGS.rabbit_port,
                     FLAGS.rabbit_retry_interval))
                 self.failed_connection = True
         if self.failed_connection:
-            logging.exception("Unable to connect to AMQP server" \
-                " after %d tries. Shutting down." % FLAGS.rabbit_max_retries)
+            logging.exception(_("Unable to connect to AMQP server"
+                " after %d tries. Shutting down.") % FLAGS.rabbit_max_retries)
             sys.exit(1)
 
     def fetch(self, no_ack=None, auto_ack=None, enable_callbacks=False):
@@ -116,29 +116,21 @@ class Consumer(messaging.Consumer):
                 self.declare()
             super(Consumer, self).fetch(no_ack, auto_ack, enable_callbacks)
             if self.failed_connection:
-                logging.error("Reconnected to queue")
+                logging.error(_("Reconnected to queue"))
                 self.failed_connection = False
         # NOTE(vish): This is catching all errors because we really don't
         #             exceptions to be logged 10 times a second if some
         #             persistent failure occurs.
         except Exception:  # pylint: disable-msg=W0703
             if not self.failed_connection:
-                logging.exception("Failed to fetch message from queue")
+                logging.exception(_("Failed to fetch message from queue"))
                 self.failed_connection = True
 
     def attach_to_eventlet(self):
         """Only needed for unit tests!"""
-        def fetch_repeatedly():
-            while True:
-                self.fetch(enable_callbacks=True)
-                greenthread.sleep(0.1)
-        greenthread.spawn(fetch_repeatedly)
-
-    def attach_to_twisted(self):
-        """Attach a callback to twisted that fires 10 times a second"""
-        loop = task.LoopingCall(self.fetch, enable_callbacks=True)
-        loop.start(interval=0.1)
-        return loop
+        timer = utils.LoopingCall(self.fetch, enable_callbacks=True)
+        timer.start(0.1)
+        return timer
 
 
 class Publisher(messaging.Publisher):
@@ -161,7 +153,7 @@ class TopicConsumer(Consumer):
 class AdapterConsumer(TopicConsumer):
     """Calls methods on a proxy object based on method and args"""
     def __init__(self, connection=None, topic="broadcast", proxy=None):
-        LOG.debug('Initing the Adapter Consumer for %s' % (topic))
+        LOG.debug(_('Initing the Adapter Consumer for %s') % (topic))
         self.proxy = proxy
         super(AdapterConsumer, self).__init__(connection=connection,
                                               topic=topic)
@@ -176,7 +168,7 @@ class AdapterConsumer(TopicConsumer):
 
         Example: {'method': 'echo', 'args': {'value': 42}}
         """
-        LOG.debug('received %s' % (message_data))
+        LOG.debug(_('received %s') % (message_data))
         msg_id = message_data.pop('_msg_id', None)
 
         ctxt = _unpack_context(message_data)
@@ -189,18 +181,20 @@ class AdapterConsumer(TopicConsumer):
             #             messages stay in the queue indefinitely, so for now
             #             we just log the message and send an error string
             #             back to the caller
-            LOG.warn('no method for message: %s' % (message_data))
-            msg_reply(msg_id, 'No method for message: %s' % message_data)
+            LOG.warn(_('no method for message: %s') % (message_data))
+            msg_reply(msg_id, _('No method for message: %s') % message_data)
             return
 
         node_func = getattr(self.proxy, str(method))
         node_args = dict((str(k), v) for k, v in args.iteritems())
         # NOTE(vish): magic is fun!
-        # pylint: disable-msg=W0142
-        d = defer.maybeDeferred(node_func, context=ctxt, **node_args)
-        if msg_id:
-            d.addCallback(lambda rval: msg_reply(msg_id, rval, None))
-            d.addErrback(lambda e: msg_reply(msg_id, None, e))
+        try:
+            rval = node_func(context=ctxt, **node_args)
+            if msg_id:
+                msg_reply(msg_id, rval, None)
+        except Exception as e:
+            if msg_id:
+                msg_reply(msg_id, None, sys.exc_info())
         return
 
 
@@ -242,14 +236,16 @@ class DirectPublisher(Publisher):
 def msg_reply(msg_id, reply=None, failure=None):
     """Sends a reply or an error on the channel signified by msg_id
 
-    failure should be a twisted failure object"""
+    failure should be a sys.exc_info() tuple.
+
+    """
     if failure:
-        message = failure.getErrorMessage()
-        traceback = failure.getTraceback()
-        logging.error("Returning exception %s to caller", message)
-        logging.error(traceback)
-        failure = (failure.type.__name__, str(failure.value), traceback)
-    conn = Connection.instance()
+        message = str(failure[1])
+        tb = traceback.format_exception(*failure)
+        logging.error(_("Returning exception %s to caller"), message)
+        logging.error(tb)
+        failure = (failure[0].__name__, str(failure[1]), tb)
+    conn = Connection.instance(True)
     publisher = DirectPublisher(connection=conn, msg_id=msg_id)
     try:
         publisher.send({'result': reply, 'failure': failure})
@@ -287,7 +283,7 @@ def _unpack_context(msg):
         if key.startswith('_context_'):
             value = msg.pop(key)
             context_dict[key[9:]] = value
-    LOG.debug('unpacked context: %s', context_dict)
+    LOG.debug(_('unpacked context: %s'), context_dict)
     return context.RequestContext.from_dict(context_dict)
 
 
@@ -306,14 +302,13 @@ def _pack_context(msg, context):
 
 def call(context, topic, msg):
     """Sends a message on a topic and wait for a response"""
-    LOG.debug("Making asynchronous call...")
+    LOG.debug(_("Making asynchronous call..."))
     msg_id = uuid.uuid4().hex
     msg.update({'_msg_id': msg_id})
-    LOG.debug("MSG_ID is %s" % (msg_id))
+    LOG.debug(_("MSG_ID is %s") % (msg_id))
     _pack_context(msg, context)
 
     class WaitMessage(object):
-
         def __call__(self, data, message):
             """Acks message and sets result."""
             message.ack()
@@ -337,41 +332,15 @@ def call(context, topic, msg):
     except StopIteration:
         pass
     consumer.close()
+    # NOTE(termie): this is a little bit of a change from the original
+    #               non-eventlet code where returning a Failure
+    #               instance from a deferred call is very similar to
+    #               raising an exception
+    if isinstance(wait_msg.result, Exception):
+        raise wait_msg.result
     return wait_msg.result
 
 
-def call_twisted(context, topic, msg):
-    """Sends a message on a topic and wait for a response"""
-    LOG.debug("Making asynchronous call...")
-    msg_id = uuid.uuid4().hex
-    msg.update({'_msg_id': msg_id})
-    LOG.debug("MSG_ID is %s" % (msg_id))
-    _pack_context(msg, context)
-
-    conn = Connection.instance()
-    d = defer.Deferred()
-    consumer = DirectConsumer(connection=conn, msg_id=msg_id)
-
-    def deferred_receive(data, message):
-        """Acks message and callbacks or errbacks"""
-        message.ack()
-        if data['failure']:
-            return d.errback(RemoteError(*data['failure']))
-        else:
-            return d.callback(data['result'])
-
-    consumer.register_callback(deferred_receive)
-    injected = consumer.attach_to_twisted()
-
-    # clean up after the injected listened and return x
-    d.addCallback(lambda x: injected.stop() and x or x)
-
-    publisher = TopicPublisher(connection=conn, topic=topic)
-    publisher.send(msg)
-    publisher.close()
-    return d
-
-
 def cast(context, topic, msg):
     """Sends a message on a topic without waiting for a response"""
     LOG.debug("Making asynchronous cast...")
@@ -384,7 +353,7 @@ def cast(context, topic, msg):
 
 def generic_response(message_data, message):
     """Logs a result and exits"""
-    LOG.debug('response %s', message_data)
+    LOG.debug(_('response %s'), message_data)
     message.ack()
     sys.exit(0)
 
@@ -393,8 +362,8 @@ def send_message(topic, message, wait=True):
     """Sends a message for testing"""
     msg_id = uuid.uuid4().hex
     message.update({'_msg_id': msg_id})
-    LOG.debug('topic is %s', topic)
-    LOG.debug('message %s', message)
+    LOG.debug(_('topic is %s'), topic)
+    LOG.debug(_('message %s'), message)
 
     if wait:
         consumer = messaging.Consumer(connection=Connection.instance(),
diff --git a/nova/scheduler/chance.py b/nova/scheduler/chance.py
index 7fd09b053..9deaa2777 100644
--- a/nova/scheduler/chance.py
+++ b/nova/scheduler/chance.py
@@ -34,5 +34,5 @@ class ChanceScheduler(driver.Scheduler):
 
         hosts = self.hosts_up(context, topic)
         if not hosts:
-            raise driver.NoValidHost("No hosts found")
+            raise driver.NoValidHost(_("No hosts found"))
         return hosts[int(random.random() * len(hosts))]
diff --git a/nova/scheduler/driver.py b/nova/scheduler/driver.py
index f271d573f..08d7033f5 100644
--- a/nova/scheduler/driver.py
+++ b/nova/scheduler/driver.py
@@ -58,4 +58,4 @@ class Scheduler(object):
 
     def schedule(self, context, topic, *_args, **_kwargs):
         """Must override at least this method for scheduler to work."""
-        raise NotImplementedError("Must implement a fallback schedule")
+        raise NotImplementedError(_("Must implement a fallback schedule"))
diff --git a/nova/scheduler/manager.py b/nova/scheduler/manager.py
index 60a3d2b4b..44e21f2fd 100644
--- a/nova/scheduler/manager.py
+++ b/nova/scheduler/manager.py
@@ -65,4 +65,4 @@ class SchedulerManager(manager.Manager):
                  db.queue_get_for(context, topic, host),
                  {"method": method,
                   "args": kwargs})
-        logging.debug("Casting to %s %s for %s", topic, host, method)
+        logging.debug(_("Casting to %s %s for %s"), topic, host, method)
diff --git a/nova/scheduler/simple.py b/nova/scheduler/simple.py
index 7f5093656..f9171ab35 100644
--- a/nova/scheduler/simple.py
+++ b/nova/scheduler/simple.py
@@ -47,7 +47,7 @@ class SimpleScheduler(chance.ChanceScheduler):
         for result in results:
             (service, instance_cores) = result
             if instance_cores + instance_ref['vcpus'] > FLAGS.max_cores:
-                raise driver.NoValidHost("All hosts have too many cores")
+                raise driver.NoValidHost(_("All hosts have too many cores"))
             if self.service_is_up(service):
                 # NOTE(vish): this probably belongs in the manager, if we
                 #             can generalize this somehow
@@ -57,7 +57,7 @@ class SimpleScheduler(chance.ChanceScheduler):
                                    {'host': service['host'],
                                     'scheduled_at': now})
                 return service['host']
-        raise driver.NoValidHost("No hosts found")
+        raise driver.NoValidHost(_("No hosts found"))
 
     def schedule_create_volume(self, context, volume_id, *_args, **_kwargs):
         """Picks a host that is up and has the fewest volumes."""
@@ -66,7 +66,8 @@ class SimpleScheduler(chance.ChanceScheduler):
         for result in results:
             (service, volume_gigabytes) = result
             if volume_gigabytes + volume_ref['size'] > FLAGS.max_gigabytes:
-                raise driver.NoValidHost("All hosts have too many gigabytes")
+                raise driver.NoValidHost(_("All hosts have too many "
+                                           "gigabytes"))
             if self.service_is_up(service):
                 # NOTE(vish): this probably belongs in the manager, if we
                 #             can generalize this somehow
@@ -76,7 +77,7 @@ class SimpleScheduler(chance.ChanceScheduler):
                                  {'host': service['host'],
                                   'scheduled_at': now})
                 return service['host']
-        raise driver.NoValidHost("No hosts found")
+        raise driver.NoValidHost(_("No hosts found"))
 
     def schedule_set_network_host(self, context, *_args, **_kwargs):
         """Picks a host that is up and has the fewest networks."""
@@ -85,7 +86,7 @@ class SimpleScheduler(chance.ChanceScheduler):
         for result in results:
             (service, instance_count) = result
             if instance_count >= FLAGS.max_networks:
-                raise driver.NoValidHost("All hosts have too many networks")
+                raise driver.NoValidHost(_("All hosts have too many networks"))
             if self.service_is_up(service):
                 return service['host']
-        raise driver.NoValidHost("No hosts found")
+        raise driver.NoValidHost(_("No hosts found"))
diff --git a/nova/server.py b/nova/server.py
deleted file mode 100644
index a0ee54681..000000000
--- a/nova/server.py
+++ /dev/null
@@ -1,151 +0,0 @@
-# vim: tabstop=4 shiftwidth=4 softtabstop=4
-
-# Copyright 2010 United States Government as represented by the
-# Administrator of the National Aeronautics and Space Administration.
-# All Rights Reserved.
-#
-#    Licensed under the Apache License, Version 2.0 (the "License"); you may
-#    not use this file except in compliance with the License. You may obtain
-#    a copy of the License at
-#
-#         http://www.apache.org/licenses/LICENSE-2.0
-#
-#    Unless required by applicable law or agreed to in writing, software
-#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-#    License for the specific language governing permissions and limitations
-#    under the License.
-
-"""
-Base functionality for nova daemons - gradually being replaced with twistd.py.
-"""
-
-import daemon
-from daemon import pidlockfile
-import logging
-import logging.handlers
-import os
-import signal
-import sys
-import time
-
-from nova import flags
-
-
-FLAGS = flags.FLAGS
-flags.DEFINE_bool('daemonize', False, 'daemonize this process')
-# NOTE(termie): right now I am defaulting to using syslog when we daemonize
-#               it may be better to do something else -shrug-
-# NOTE(Devin): I think we should let each process have its own log file
-#              and put it in /var/logs/nova/(appname).log
-#              This makes debugging much easier and cuts down on sys log
-#              clutter.
-flags.DEFINE_bool('use_syslog', True, 'output to syslog when daemonizing')
-flags.DEFINE_string('logfile', None, 'log file to output to')
-flags.DEFINE_string('logdir',  None, 'directory to keep log files in '
-                                     '(will be prepended to $logfile)')
-flags.DEFINE_string('pidfile', None, 'pid file to output to')
-flags.DEFINE_string('working_directory', './', 'working directory...')
-flags.DEFINE_integer('uid', os.getuid(), 'uid under which to run')
-flags.DEFINE_integer('gid', os.getgid(), 'gid under which to run')
-
-
-def stop(pidfile):
-    """
-    Stop the daemon
-    """
-    # Get the pid from the pidfile
-    try:
-        pid = int(open(pidfile, 'r').read().strip())
-    except IOError:
-        message = "pidfile %s does not exist. Daemon not running?\n"
-        sys.stderr.write(message % pidfile)
-        return
-
-    # Try killing the daemon process
-    try:
-        while 1:
-            os.kill(pid, signal.SIGTERM)
-            time.sleep(0.1)
-    except OSError, err:
-        err = str(err)
-        if err.find("No such process") > 0:
-            if os.path.exists(pidfile):
-                os.remove(pidfile)
-        else:
-            print str(err)
-            sys.exit(1)
-
-
-def serve(name, main):
-    """Controller for server"""
-    argv = FLAGS(sys.argv)
-
-    if not FLAGS.pidfile:
-        FLAGS.pidfile = '%s.pid' % name
-
-    logging.debug("Full set of FLAGS: \n\n\n")
-    for flag in FLAGS:
-        logging.debug("%s : %s", flag, FLAGS.get(flag, None))
-
-    action = 'start'
-    if len(argv) > 1:
-        action = argv.pop()
-
-    if action == 'stop':
-        stop(FLAGS.pidfile)
-        sys.exit()
-    elif action == 'restart':
-        stop(FLAGS.pidfile)
-    elif action == 'start':
-        pass
-    else:
-        print 'usage: %s [options] [start|stop|restart]' % argv[0]
-        sys.exit(1)
-    daemonize(argv, name, main)
-
-
-def daemonize(args, name, main):
-    """Does the work of daemonizing the process"""
-    logging.getLogger('amqplib').setLevel(logging.WARN)
-    files_to_keep = []
-    if FLAGS.daemonize:
-        logger = logging.getLogger()
-        formatter = logging.Formatter(
-                name + '(%(name)s): %(levelname)s %(message)s')
-        if FLAGS.use_syslog and not FLAGS.logfile:
-            syslog = logging.handlers.SysLogHandler(address='/dev/log')
-            syslog.setFormatter(formatter)
-            logger.addHandler(syslog)
-            files_to_keep.append(syslog.socket)
-        else:
-            if not FLAGS.logfile:
-                FLAGS.logfile = '%s.log' % name
-            if FLAGS.logdir:
-                FLAGS.logfile = os.path.join(FLAGS.logdir, FLAGS.logfile)
-            logfile = logging.FileHandler(FLAGS.logfile)
-            logfile.setFormatter(formatter)
-            logger.addHandler(logfile)
-            files_to_keep.append(logfile.stream)
-        stdin, stdout, stderr = None, None, None
-    else:
-        stdin, stdout, stderr = sys.stdin, sys.stdout, sys.stderr
-
-    if FLAGS.verbose:
-        logging.getLogger().setLevel(logging.DEBUG)
-    else:
-        logging.getLogger().setLevel(logging.WARNING)
-
-    with daemon.DaemonContext(
-            detach_process=FLAGS.daemonize,
-            working_directory=FLAGS.working_directory,
-            pidfile=pidlockfile.TimeoutPIDLockFile(FLAGS.pidfile,
-                                                   acquire_timeout=1,
-                                                   threaded=False),
-            stdin=stdin,
-            stdout=stdout,
-            stderr=stderr,
-            uid=FLAGS.uid,
-            gid=FLAGS.gid,
-            files_preserve=files_to_keep):
-        main(args)
diff --git a/nova/service.py b/nova/service.py
index 9454d4049..f1f90742f 100644
--- a/nova/service.py
+++ b/nova/service.py
@@ -17,21 +17,17 @@
 #    under the License.
 
 """
-A service is a very thin wrapper around a Manager object.  It exposes the
-manager's public methods to other components of the system via rpc.  It will
-report state periodically to the database and is responsible for initiating
-any periodic tasts that need to be executed on a given host.
-
-This module contains Service, a generic baseclass for all workers.
+Generic Node baseclass for all workers that run on hosts
 """
 
 import inspect
 import logging
 import os
+import sys
 
-from twisted.internet import defer
-from twisted.internet import task
-from twisted.application import service
+from eventlet import event
+from eventlet import greenthread
+from eventlet import greenpool
 
 from nova import context
 from nova import db
@@ -50,8 +46,16 @@ flags.DEFINE_integer('periodic_interval', 60,
                      'seconds between running periodic tasks',
                      lower_bound=1)
 
+flags.DEFINE_string('pidfile', None,
+                    'pidfile to use for this service')
+
+
+flags.DEFINE_flag(flags.HelpFlag())
+flags.DEFINE_flag(flags.HelpshortFlag())
+flags.DEFINE_flag(flags.HelpXMLFlag())
+
 
-class Service(object, service.Service):
+class Service(object):
     """Base class for workers that run on hosts."""
 
     def __init__(self, host, binary, topic, manager, report_interval=None,
@@ -64,8 +68,9 @@ class Service(object, service.Service):
         self.periodic_interval = periodic_interval
         super(Service, self).__init__(*args, **kwargs)
         self.saved_args, self.saved_kwargs = args, kwargs
+        self.timers = []
 
-    def startService(self):  # pylint: disable-msg C0103
+    def start(self):
         manager_class = utils.import_class(self.manager_class_name)
         self.manager = manager_class(host=self.host, *self.saved_args,
                                                      **self.saved_kwargs)
@@ -80,26 +85,29 @@ class Service(object, service.Service):
         except exception.NotFound:
             self._create_service_ref(ctxt)
 
-        conn = rpc.Connection.instance()
+        conn1 = rpc.Connection.instance(new=True)
+        conn2 = rpc.Connection.instance(new=True)
         if self.report_interval:
             consumer_all = rpc.AdapterConsumer(
-                    connection=conn,
+                    connection=conn1,
                     topic=self.topic,
                     proxy=self)
             consumer_node = rpc.AdapterConsumer(
-                    connection=conn,
+                    connection=conn2,
                     topic='%s.%s' % (self.topic, self.host),
                     proxy=self)
 
-            consumer_all.attach_to_twisted()
-            consumer_node.attach_to_twisted()
+            self.timers.append(consumer_all.attach_to_eventlet())
+            self.timers.append(consumer_node.attach_to_eventlet())
 
-            pulse = task.LoopingCall(self.report_state)
+            pulse = utils.LoopingCall(self.report_state)
             pulse.start(interval=self.report_interval, now=False)
+            self.timers.append(pulse)
 
         if self.periodic_interval:
-            pulse = task.LoopingCall(self.periodic_tasks)
-            pulse.start(interval=self.periodic_interval, now=False)
+            periodic = utils.LoopingCall(self.periodic_tasks)
+            periodic.start(interval=self.periodic_interval, now=False)
+            self.timers.append(periodic)
 
     def _create_service_ref(self, context):
         service_ref = db.service_create(context,
@@ -143,29 +151,32 @@ class Service(object, service.Service):
             report_interval = FLAGS.report_interval
         if not periodic_interval:
             periodic_interval = FLAGS.periodic_interval
-        logging.warn("Starting %s node", topic)
+        logging.warn(_("Starting %s node"), topic)
         service_obj = cls(host, binary, topic, manager,
                           report_interval, periodic_interval)
 
-        # This is the parent service that twistd will be looking for when it
-        # parses this file, return it so that we can get it into globals.
-        application = service.Application(binary)
-        service_obj.setServiceParent(application)
-        return application
+        return service_obj
 
     def kill(self):
         """Destroy the service object in the datastore"""
+        self.stop()
         try:
             db.service_destroy(context.get_admin_context(), self.service_id)
         except exception.NotFound:
-            logging.warn("Service killed that has no database entry")
+            logging.warn(_("Service killed that has no database entry"))
+
+    def stop(self):
+        for x in self.timers:
+            try:
+                x.stop()
+            except Exception:
+                pass
+        self.timers = []
 
-    @defer.inlineCallbacks
     def periodic_tasks(self):
         """Tasks to be run at a periodic interval"""
-        yield self.manager.periodic_tasks(context.get_admin_context())
+        self.manager.periodic_tasks(context.get_admin_context())
 
-    @defer.inlineCallbacks
     def report_state(self):
         """Update the state of this service in the datastore."""
         ctxt = context.get_admin_context()
@@ -173,8 +184,8 @@ class Service(object, service.Service):
             try:
                 service_ref = db.service_get(ctxt, self.service_id)
             except exception.NotFound:
-                logging.debug("The service database object disappeared, "
-                              "Recreating it.")
+                logging.debug(_("The service database object disappeared, "
+                                "Recreating it."))
                 self._create_service_ref(ctxt)
                 service_ref = db.service_get(ctxt, self.service_id)
 
@@ -185,11 +196,39 @@ class Service(object, service.Service):
             # TODO(termie): make this pattern be more elegant.
             if getattr(self, "model_disconnected", False):
                 self.model_disconnected = False
-                logging.error("Recovered model server connection!")
+                logging.error(_("Recovered model server connection!"))
 
         # TODO(vish): this should probably only catch connection errors
         except Exception:  # pylint: disable-msg=W0702
             if not getattr(self, "model_disconnected", False):
                 self.model_disconnected = True
-                logging.exception("model server went away")
-        yield
+                logging.exception(_("model server went away"))
+
+
+def serve(*services):
+    argv = FLAGS(sys.argv)
+
+    if not services:
+        services = [Service.create()]
+
+    name = '_'.join(x.binary for x in services)
+    logging.debug("Serving %s" % name)
+
+    logging.getLogger('amqplib').setLevel(logging.WARN)
+
+    if FLAGS.verbose:
+        logging.getLogger().setLevel(logging.DEBUG)
+    else:
+        logging.getLogger().setLevel(logging.WARNING)
+
+    logging.debug(_("Full set of FLAGS:"))
+    for flag in FLAGS:
+        logging.debug("%s : %s" % (flag, FLAGS.get(flag, None)))
+
+    for x in services:
+        x.start()
+
+
+def wait():
+    while True:
+        greenthread.sleep(5)
diff --git a/nova/test.py b/nova/test.py
index 5c2a72819..7076f1bf4 100644
--- a/nova/test.py
+++ b/nova/test.py
@@ -25,11 +25,12 @@ and some black magic for inline callbacks.
 import datetime
 import sys
 import time
+import unittest
 
 import mox
 import stubout
 from twisted.internet import defer
-from twisted.trial import unittest
+from twisted.trial import unittest as trial_unittest
 
 from nova import context
 from nova import db
@@ -55,11 +56,11 @@ def skip_if_fake(func):
     return _skipper
 
 
-class TrialTestCase(unittest.TestCase):
+class TestCase(unittest.TestCase):
     """Test case base class for all unit tests"""
     def setUp(self):
         """Run before each test method to initialize test environment"""
-        super(TrialTestCase, self).setUp()
+        super(TestCase, self).setUp()
         # NOTE(vish): We need a better method for creating fixtures for tests
         #             now that we have some required db setup for the system
         #             to work properly.
@@ -94,7 +95,87 @@ class TrialTestCase(unittest.TestCase):
             db.fixed_ip_disassociate_all_by_timeout(ctxt, FLAGS.host,
                                                     self.start)
             db.network_disassociate_all(ctxt)
-            rpc.Consumer.attach_to_twisted = self.originalAttach
+            rpc.Consumer.attach_to_eventlet = self.originalAttach
+            for x in self.injected:
+                try:
+                    x.stop()
+                except AssertionError:
+                    pass
+
+            if FLAGS.fake_rabbit:
+                fakerabbit.reset_all()
+
+            db.security_group_destroy_all(ctxt)
+            super(TestCase, self).tearDown()
+        finally:
+            self.reset_flags()
+
+    def flags(self, **kw):
+        """Override flag variables for a test"""
+        for k, v in kw.iteritems():
+            if k in self.flag_overrides:
+                self.reset_flags()
+                raise Exception(
+                        'trying to override already overriden flag: %s' % k)
+            self.flag_overrides[k] = getattr(FLAGS, k)
+            setattr(FLAGS, k, v)
+
+    def reset_flags(self):
+        """Resets all flag variables for the test.  Runs after each test"""
+        FLAGS.Reset()
+        for k, v in self._original_flags.iteritems():
+            setattr(FLAGS, k, v)
+
+    def _monkey_patch_attach(self):
+        self.originalAttach = rpc.Consumer.attach_to_eventlet
+
+        def _wrapped(innerSelf):
+            rv = self.originalAttach(innerSelf)
+            self.injected.append(rv)
+            return rv
+
+        _wrapped.func_name = self.originalAttach.func_name
+        rpc.Consumer.attach_to_eventlet = _wrapped
+
+
+class TrialTestCase(trial_unittest.TestCase):
+    """Test case base class for all unit tests"""
+    def setUp(self):
+        """Run before each test method to initialize test environment"""
+        super(TrialTestCase, self).setUp()
+        # NOTE(vish): We need a better method for creating fixtures for tests
+        #             now that we have some required db setup for the system
+        #             to work properly.
+        self.start = datetime.datetime.utcnow()
+        ctxt = context.get_admin_context()
+        if db.network_count(ctxt) != 5:
+            network_manager.VlanManager().create_networks(ctxt,
+                                                          FLAGS.fixed_range,
+                                                          5, 16,
+                                                          FLAGS.vlan_start,
+                                                          FLAGS.vpn_start)
+
+        # emulate some of the mox stuff, we can't use the metaclass
+        # because it screws with our generators
+        self.mox = mox.Mox()
+        self.stubs = stubout.StubOutForTesting()
+        self.flag_overrides = {}
+        self.injected = []
+        self._original_flags = FLAGS.FlagValuesDict()
+
+    def tearDown(self):
+        """Runs after each test method to finalize/tear down test
+        environment."""
+        try:
+            self.mox.UnsetStubs()
+            self.stubs.UnsetAll()
+            self.stubs.SmartUnsetAll()
+            self.mox.VerifyAll()
+            # NOTE(vish): Clean up any ips associated during the test.
+            ctxt = context.get_admin_context()
+            db.fixed_ip_disassociate_all_by_timeout(ctxt, FLAGS.host,
+                                                    self.start)
+            db.network_disassociate_all(ctxt)
             for x in self.injected:
                 try:
                     x.stop()
@@ -147,14 +228,3 @@ class TrialTestCase(unittest.TestCase):
             return d
         _wrapped.func_name = func.func_name
         return _wrapped
-
-    def _monkey_patch_attach(self):
-        self.originalAttach = rpc.Consumer.attach_to_twisted
-
-        def _wrapped(innerSelf):
-            rv = self.originalAttach(innerSelf)
-            self.injected.append(rv)
-            return rv
-
-        _wrapped.func_name = self.originalAttach.func_name
-        rpc.Consumer.attach_to_twisted = _wrapped
diff --git a/nova/tests/__init__.py b/nova/tests/__init__.py
index aaf213923..8dc87d0e2 100644
--- a/nova/tests/__init__.py
+++ b/nova/tests/__init__.py
@@ -29,3 +29,8 @@
 .. moduleauthor:: Manish Singh <yosh@gimp.org>
 .. moduleauthor:: Andy Smith <andy@anarkystic.com>
 """
+
+# See http://code.google.com/p/python-nose/issues/detail?id=373
+# The code below enables nosetests to work with i18n _() blocks
+import __builtin__
+setattr(__builtin__, '_', lambda x: x)
diff --git a/nova/tests/access_unittest.py b/nova/tests/access_unittest.py
index 0f66c0a26..58fdea3b5 100644
--- a/nova/tests/access_unittest.py
+++ b/nova/tests/access_unittest.py
@@ -35,7 +35,7 @@ class Context(object):
     pass
 
 
-class AccessTestCase(test.TrialTestCase):
+class AccessTestCase(test.TestCase):
     def setUp(self):
         super(AccessTestCase, self).setUp()
         um = manager.AuthManager()
diff --git a/nova/tests/api/openstack/fakes.py b/nova/tests/api/openstack/fakes.py
index c3f129a32..21b8aac1c 100644
--- a/nova/tests/api/openstack/fakes.py
+++ b/nova/tests/api/openstack/fakes.py
@@ -24,9 +24,10 @@ import webob
 import webob.dec
 
 from nova import auth
-from nova import utils
-from nova import flags
+from nova import context
 from nova import exception as exc
+from nova import flags
+from nova import utils
 import nova.api.openstack.auth
 from nova.image import service
 from nova.image import glance
@@ -58,7 +59,7 @@ def fake_auth_init(self):
 
 @webob.dec.wsgify
 def fake_wsgi(self, req):
-    req.environ['nova.context'] = dict(user=dict(id=1))
+    req.environ['nova.context'] = context.RequestContext(1, 1)
     if req.body:
         req.environ['inst_dict'] = json.loads(req.body)
     return self.application
@@ -171,6 +172,12 @@ class FakeToken(object):
             setattr(self, k, v)
 
 
+class FakeRequestContext(object):
+    def __init__(self, user, project):
+        self.user_id = 1
+        self.project_id = 1
+
+
 class FakeAuthDatabase(object):
     data = {}
 
diff --git a/nova/tests/api/openstack/test_adminapi.py b/nova/tests/api/openstack/test_adminapi.py
new file mode 100644
index 000000000..1b2e1654d
--- /dev/null
+++ b/nova/tests/api/openstack/test_adminapi.py
@@ -0,0 +1,61 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2010 OpenStack LLC.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+import unittest
+
+import stubout
+import webob
+
+import nova.api
+from nova import flags
+from nova.tests.api.openstack import fakes
+
+FLAGS = flags.FLAGS
+
+
+class AdminAPITest(unittest.TestCase):
+    def setUp(self):
+        self.stubs = stubout.StubOutForTesting()
+        fakes.FakeAuthManager.auth_data = {}
+        fakes.FakeAuthDatabase.data = {}
+        fakes.stub_out_networking(self.stubs)
+        fakes.stub_out_rate_limiting(self.stubs)
+        fakes.stub_out_auth(self.stubs)
+        self.allow_admin = FLAGS.allow_admin_api
+
+    def tearDown(self):
+        self.stubs.UnsetAll()
+        FLAGS.allow_admin_api = self.allow_admin
+
+    def test_admin_enabled(self):
+        FLAGS.allow_admin_api = True
+        # We should still be able to access public operations.
+        req = webob.Request.blank('/v1.0/flavors')
+        res = req.get_response(nova.api.API('os'))
+        self.assertEqual(res.status_int, 200)
+        # TODO: Confirm admin operations are available.
+
+    def test_admin_disabled(self):
+        FLAGS.allow_admin_api = False
+        # We should still be able to access public operations.
+        req = webob.Request.blank('/v1.0/flavors')
+        res = req.get_response(nova.api.API('os'))
+        self.assertEqual(res.status_int, 200)
+        # TODO: Confirm admin operations are unavailable.
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/nova/tests/api/openstack/test_auth.py b/nova/tests/api/openstack/test_auth.py
index 14e720be4..7b427c2db 100644
--- a/nova/tests/api/openstack/test_auth.py
+++ b/nova/tests/api/openstack/test_auth.py
@@ -26,6 +26,7 @@ import nova.api
 import nova.api.openstack.auth
 import nova.auth.manager
 from nova import auth
+from nova import context
 from nova.tests.api.openstack import fakes
 
 
@@ -35,6 +36,7 @@ class Test(unittest.TestCase):
         self.stubs = stubout.StubOutForTesting()
         self.stubs.Set(nova.api.openstack.auth.BasicApiAuthManager,
             '__init__', fakes.fake_auth_init)
+        self.stubs.Set(context, 'RequestContext', fakes.FakeRequestContext)
         fakes.FakeAuthManager.auth_data = {}
         fakes.FakeAuthDatabase.data = {}
         fakes.stub_out_rate_limiting(self.stubs)
@@ -131,6 +133,7 @@ class TestLimiter(unittest.TestCase):
         self.stubs = stubout.StubOutForTesting()
         self.stubs.Set(nova.api.openstack.auth.BasicApiAuthManager,
             '__init__', fakes.fake_auth_init)
+        self.stubs.Set(context, 'RequestContext', fakes.FakeRequestContext)
         fakes.FakeAuthManager.auth_data = {}
         fakes.FakeAuthDatabase.data = {}
         fakes.stub_out_networking(self.stubs)
diff --git a/nova/tests/api/openstack/test_servers.py b/nova/tests/api/openstack/test_servers.py
index 8444b6fce..3820f5f27 100644
--- a/nova/tests/api/openstack/test_servers.py
+++ b/nova/tests/api/openstack/test_servers.py
@@ -56,11 +56,16 @@ def instance_address(context, instance_id):
 
 
 def stub_instance(id, user_id=1):
-    return Instance(id=id + 123456, state=0, image_id=10, user_id=user_id,
+    return Instance(id=int(id) + 123456, state=0, image_id=10, user_id=user_id,
                     display_name='server%s' % id, internal_id=id)
 
 
+def fake_compute_api(cls, req, id):
+    return True
+
+
 class ServersTest(unittest.TestCase):
+
     def setUp(self):
         self.stubs = stubout.StubOutForTesting()
         fakes.FakeAuthManager.auth_data = {}
@@ -82,9 +87,15 @@ class ServersTest(unittest.TestCase):
                        instance_address)
         self.stubs.Set(nova.db.api, 'instance_get_floating_address',
                        instance_address)
+        self.stubs.Set(nova.compute.api.ComputeAPI, 'pause',
+            fake_compute_api)
+        self.stubs.Set(nova.compute.api.ComputeAPI, 'unpause',
+            fake_compute_api)
+        self.allow_admin = FLAGS.allow_admin_api
 
     def tearDown(self):
         self.stubs.UnsetAll()
+        FLAGS.allow_admin_api = self.allow_admin
 
     def test_get_server_by_id(self):
         req = webob.Request.blank('/v1.0/servers/1')
@@ -211,6 +222,30 @@ class ServersTest(unittest.TestCase):
             self.assertEqual(s['imageId'], 10)
             i += 1
 
+    def test_server_pause(self):
+        FLAGS.allow_admin_api = True
+        body = dict(server=dict(
+            name='server_test', imageId=2, flavorId=2, metadata={},
+            personality={}))
+        req = webob.Request.blank('/v1.0/servers/1/pause')
+        req.method = 'POST'
+        req.content_type = 'application/json'
+        req.body = json.dumps(body)
+        res = req.get_response(nova.api.API('os'))
+        self.assertEqual(res.status_int, 202)
+
+    def test_server_unpause(self):
+        FLAGS.allow_admin_api = True
+        body = dict(server=dict(
+            name='server_test', imageId=2, flavorId=2, metadata={},
+            personality={}))
+        req = webob.Request.blank('/v1.0/servers/1/unpause')
+        req.method = 'POST'
+        req.content_type = 'application/json'
+        req.body = json.dumps(body)
+        res = req.get_response(nova.api.API('os'))
+        self.assertEqual(res.status_int, 202)
+
     def test_server_reboot(self):
         body = dict(server=dict(
             name='server_test', imageId=2, flavorId=2, metadata={},
diff --git a/nova/tests/auth_unittest.py b/nova/tests/auth_unittest.py
index fe891beee..15d40bc53 100644
--- a/nova/tests/auth_unittest.py
+++ b/nova/tests/auth_unittest.py
@@ -208,17 +208,13 @@ class AuthManagerTestCase(object):
         #             so it probably belongs in crypto_unittest
         #             but I'm leaving it where I found it.
         with user_and_project_generator(self.manager) as (user, project):
-            # NOTE(todd): Should mention why we must setup controller first
-            #             (somebody please clue me in)
-            cloud_controller = cloud.CloudController()
-            cloud_controller.setup()
-            _key, cert_str = self.manager._generate_x509_cert('test1',
-                                                              'testproj')
+            # NOTE(vish): Setup runs genroot.sh if it hasn't been run
+            cloud.CloudController().setup()
+            _key, cert_str = crypto.generate_x509_cert(user.id, project.id)
             logging.debug(cert_str)
 
-            # Need to verify that it's signed by the right intermediate CA
-            full_chain = crypto.fetch_ca(project_id='testproj', chain=True)
-            int_cert = crypto.fetch_ca(project_id='testproj', chain=False)
+            full_chain = crypto.fetch_ca(project_id=project.id, chain=True)
+            int_cert = crypto.fetch_ca(project_id=project.id, chain=False)
             cloud_cert = crypto.fetch_ca()
             logging.debug("CA chain:\n\n =====\n%s\n\n=====" % full_chain)
             signed_cert = X509.load_cert_string(cert_str)
@@ -227,7 +223,8 @@ class AuthManagerTestCase(object):
             cloud_cert = X509.load_cert_string(cloud_cert)
             self.assertTrue(signed_cert.verify(chain_cert.get_pubkey()))
             self.assertTrue(signed_cert.verify(int_cert.get_pubkey()))
-            if not FLAGS.use_intermediate_ca:
+
+            if not FLAGS.use_project_ca:
                 self.assertTrue(signed_cert.verify(cloud_cert.get_pubkey()))
             else:
                 self.assertFalse(signed_cert.verify(cloud_cert.get_pubkey()))
@@ -326,24 +323,20 @@ class AuthManagerTestCase(object):
             self.assertTrue(user.is_admin())
 
 
-class AuthManagerLdapTestCase(AuthManagerTestCase, test.TrialTestCase):
+class AuthManagerLdapTestCase(AuthManagerTestCase, test.TestCase):
     auth_driver = 'nova.auth.ldapdriver.FakeLdapDriver'
 
     def __init__(self, *args, **kwargs):
         AuthManagerTestCase.__init__(self)
-        test.TrialTestCase.__init__(self, *args, **kwargs)
+        test.TestCase.__init__(self, *args, **kwargs)
         import nova.auth.fakeldap as fakeldap
-        FLAGS.redis_db = 8
         if FLAGS.flush_db:
-            logging.info("Flushing redis datastore")
-            try:
-                r = fakeldap.Redis.instance()
-                r.flushdb()
-            except:
-                self.skip = True
+            logging.info("Flushing datastore")
+            r = fakeldap.Store.instance()
+            r.flushdb()
 
 
-class AuthManagerDbTestCase(AuthManagerTestCase, test.TrialTestCase):
+class AuthManagerDbTestCase(AuthManagerTestCase, test.TestCase):
     auth_driver = 'nova.auth.dbdriver.DbDriver'
 
 
diff --git a/nova/tests/cloud_unittest.py b/nova/tests/cloud_unittest.py
index 9886a2449..70d2c44da 100644
--- a/nova/tests/cloud_unittest.py
+++ b/nova/tests/cloud_unittest.py
@@ -22,22 +22,18 @@ import logging
 from M2Crypto import BIO
 from M2Crypto import RSA
 import os
-import StringIO
 import tempfile
 import time
 
 from eventlet import greenthread
-from twisted.internet import defer
-import unittest
-from xml.etree import ElementTree
 
 from nova import context
 from nova import crypto
 from nova import db
 from nova import flags
 from nova import rpc
+from nova import service
 from nova import test
-from nova import utils
 from nova.auth import manager
 from nova.compute import power_state
 from nova.api.ec2 import cloud
@@ -53,10 +49,11 @@ IMAGES_PATH = os.path.join(OSS_TEMPDIR, 'images')
 os.makedirs(IMAGES_PATH)
 
 
-class CloudTestCase(test.TrialTestCase):
+class CloudTestCase(test.TestCase):
     def setUp(self):
         super(CloudTestCase, self).setUp()
-        self.flags(connection_type='fake', images_path=IMAGES_PATH)
+        self.flags(connection_type='fake',
+                   images_path=IMAGES_PATH)
 
         self.conn = rpc.Connection.instance()
         logging.getLogger().setLevel(logging.DEBUG)
@@ -64,27 +61,23 @@ class CloudTestCase(test.TrialTestCase):
         # set up our cloud
         self.cloud = cloud.CloudController()
 
-        # set up a service
-        self.compute = utils.import_object(FLAGS.compute_manager)
-        self.compute_consumer = rpc.AdapterConsumer(connection=self.conn,
-                                                    topic=FLAGS.compute_topic,
-                                                    proxy=self.compute)
-        self.compute_consumer.attach_to_eventlet()
-        self.network = utils.import_object(FLAGS.network_manager)
-        self.network_consumer = rpc.AdapterConsumer(connection=self.conn,
-                                                    topic=FLAGS.network_topic,
-                                                    proxy=self.network)
-        self.network_consumer.attach_to_eventlet()
+        # set up services
+        self.compute = service.Service.create(binary='nova-compute')
+        self.compute.start()
+        self.network = service.Service.create(binary='nova-network')
+        self.network.start()
 
         self.manager = manager.AuthManager()
         self.user = self.manager.create_user('admin', 'admin', 'admin', True)
         self.project = self.manager.create_project('proj', 'admin', 'proj')
         self.context = context.RequestContext(user=self.user,
-                                                 project=self.project)
+                                              project=self.project)
 
     def tearDown(self):
         self.manager.delete_project(self.project)
         self.manager.delete_user(self.user)
+        self.compute.kill()
+        self.network.kill()
         super(CloudTestCase, self).tearDown()
 
     def _create_key(self, name):
@@ -111,12 +104,13 @@ class CloudTestCase(test.TrialTestCase):
                               {'address': address,
                                'host': FLAGS.host})
         self.cloud.allocate_address(self.context)
-        inst = db.instance_create(self.context, {})
+        inst = db.instance_create(self.context, {'host': FLAGS.host})
         fixed = self.network.allocate_fixed_ip(self.context, inst['id'])
         ec2_id = cloud.internal_id_to_ec2_id(inst['internal_id'])
         self.cloud.associate_address(self.context,
                                      instance_id=ec2_id,
                                      public_ip=address)
+        greenthread.sleep(0.3)
         self.cloud.disassociate_address(self.context,
                                         public_ip=address)
         self.cloud.release_address(self.context,
@@ -126,6 +120,19 @@ class CloudTestCase(test.TrialTestCase):
         db.instance_destroy(self.context, inst['id'])
         db.floating_ip_destroy(self.context, address)
 
+    def test_describe_volumes(self):
+        """Makes sure describe_volumes works and filters results."""
+        vol1 = db.volume_create(self.context, {})
+        vol2 = db.volume_create(self.context, {})
+        result = self.cloud.describe_volumes(self.context)
+        self.assertEqual(len(result['volumeSet']), 2)
+        result = self.cloud.describe_volumes(self.context,
+                                             volume_id=[vol2['ec2_id']])
+        self.assertEqual(len(result['volumeSet']), 1)
+        self.assertEqual(result['volumeSet'][0]['volumeId'], vol2['ec2_id'])
+        db.volume_destroy(self.context, vol1['id'])
+        db.volume_destroy(self.context, vol2['id'])
+
     def test_console_output(self):
         image_id = FLAGS.default_image
         instance_type = FLAGS.default_instance_type
@@ -186,7 +193,7 @@ class CloudTestCase(test.TrialTestCase):
         logging.debug("Need to watch instance %s until it's running..." %
                       instance['instance_id'])
         while True:
-            rv = yield defer.succeed(time.sleep(1))
+            greenthread.sleep(1)
             info = self.cloud._get_instance(instance['instance_id'])
             logging.debug(info['state'])
             if info['state'] == power_state.RUNNING:
diff --git a/nova/tests/compute_unittest.py b/nova/tests/compute_unittest.py
index 6f3ef96cb..348bb3351 100644
--- a/nova/tests/compute_unittest.py
+++ b/nova/tests/compute_unittest.py
@@ -22,8 +22,6 @@ Tests For Compute
 import datetime
 import logging
 
-from twisted.internet import defer
-
 from nova import context
 from nova import db
 from nova import exception
@@ -33,15 +31,17 @@ from nova import utils
 from nova.auth import manager
 from nova.compute import api as compute_api
 
+
 FLAGS = flags.FLAGS
 
 
-class ComputeTestCase(test.TrialTestCase):
+class ComputeTestCase(test.TestCase):
     """Test case for compute"""
     def setUp(self):
         logging.getLogger().setLevel(logging.DEBUG)
         super(ComputeTestCase, self).setUp()
         self.flags(connection_type='fake',
+                   stub_network=True,
                    network_manager='nova.network.manager.FlatManager')
         self.compute = utils.import_object(FLAGS.compute_manager)
         self.compute_api = compute_api.ComputeAPI()
@@ -94,24 +94,22 @@ class ComputeTestCase(test.TrialTestCase):
             db.security_group_destroy(self.context, group['id'])
             db.instance_destroy(self.context, ref[0]['id'])
 
-    @defer.inlineCallbacks
     def test_run_terminate(self):
         """Make sure it is possible to  run and terminate instance"""
         instance_id = self._create_instance()
 
-        yield self.compute.run_instance(self.context, instance_id)
+        self.compute.run_instance(self.context, instance_id)
 
         instances = db.instance_get_all(context.get_admin_context())
         logging.info("Running instances: %s", instances)
         self.assertEqual(len(instances), 1)
 
-        yield self.compute.terminate_instance(self.context, instance_id)
+        self.compute.terminate_instance(self.context, instance_id)
 
         instances = db.instance_get_all(context.get_admin_context())
         logging.info("After terminating instances: %s", instances)
         self.assertEqual(len(instances), 0)
 
-    @defer.inlineCallbacks
     def test_run_terminate_timestamps(self):
         """Make sure timestamps are set for launched and destroyed"""
         instance_id = self._create_instance()
@@ -119,42 +117,48 @@ class ComputeTestCase(test.TrialTestCase):
         self.assertEqual(instance_ref['launched_at'], None)
         self.assertEqual(instance_ref['deleted_at'], None)
         launch = datetime.datetime.utcnow()
-        yield self.compute.run_instance(self.context, instance_id)
+        self.compute.run_instance(self.context, instance_id)
         instance_ref = db.instance_get(self.context, instance_id)
         self.assert_(instance_ref['launched_at'] > launch)
         self.assertEqual(instance_ref['deleted_at'], None)
         terminate = datetime.datetime.utcnow()
-        yield self.compute.terminate_instance(self.context, instance_id)
+        self.compute.terminate_instance(self.context, instance_id)
         self.context = self.context.elevated(True)
         instance_ref = db.instance_get(self.context, instance_id)
         self.assert_(instance_ref['launched_at'] < terminate)
         self.assert_(instance_ref['deleted_at'] > terminate)
 
-    @defer.inlineCallbacks
+    def test_pause(self):
+        """Ensure instance can be paused"""
+        instance_id = self._create_instance()
+        self.compute.run_instance(self.context, instance_id)
+        self.compute.pause_instance(self.context, instance_id)
+        self.compute.unpause_instance(self.context, instance_id)
+        self.compute.terminate_instance(self.context, instance_id)
+
     def test_reboot(self):
         """Ensure instance can be rebooted"""
         instance_id = self._create_instance()
-        yield self.compute.run_instance(self.context, instance_id)
-        yield self.compute.reboot_instance(self.context, instance_id)
-        yield self.compute.terminate_instance(self.context, instance_id)
+        self.compute.run_instance(self.context, instance_id)
+        self.compute.reboot_instance(self.context, instance_id)
+        self.compute.terminate_instance(self.context, instance_id)
 
-    @defer.inlineCallbacks
     def test_console_output(self):
         """Make sure we can get console output from instance"""
         instance_id = self._create_instance()
-        yield self.compute.run_instance(self.context, instance_id)
+        self.compute.run_instance(self.context, instance_id)
 
-        console = yield self.compute.get_console_output(self.context,
+        console = self.compute.get_console_output(self.context,
                                                         instance_id)
         self.assert_(console)
-        yield self.compute.terminate_instance(self.context, instance_id)
+        self.compute.terminate_instance(self.context, instance_id)
 
-    @defer.inlineCallbacks
     def test_run_instance_existing(self):
         """Ensure failure when running an instance that already exists"""
         instance_id = self._create_instance()
-        yield self.compute.run_instance(self.context, instance_id)
-        self.assertFailure(self.compute.run_instance(self.context,
-                                                     instance_id),
-                           exception.Error)
-        yield self.compute.terminate_instance(self.context, instance_id)
+        self.compute.run_instance(self.context, instance_id)
+        self.assertRaises(exception.Error,
+                          self.compute.run_instance,
+                          self.context,
+                          instance_id)
+        self.compute.terminate_instance(self.context, instance_id)
diff --git a/nova/tests/flags_unittest.py b/nova/tests/flags_unittest.py
index b97df075d..707300fcf 100644
--- a/nova/tests/flags_unittest.py
+++ b/nova/tests/flags_unittest.py
@@ -24,7 +24,7 @@ FLAGS = flags.FLAGS
 flags.DEFINE_string('flags_unittest', 'foo', 'for testing purposes only')
 
 
-class FlagsTestCase(test.TrialTestCase):
+class FlagsTestCase(test.TestCase):
 
     def setUp(self):
         super(FlagsTestCase, self).setUp()
diff --git a/nova/tests/middleware_unittest.py b/nova/tests/middleware_unittest.py
new file mode 100644
index 000000000..0febf52d6
--- /dev/null
+++ b/nova/tests/middleware_unittest.py
@@ -0,0 +1,86 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2010 United States Government as represented by the
+# Administrator of the National Aeronautics and Space Administration.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+import datetime
+import webob
+import webob.dec
+import webob.exc
+
+from nova.api import ec2
+from nova import flags
+from nova import test
+from nova import utils
+
+
+FLAGS = flags.FLAGS
+
+
+@webob.dec.wsgify
+def conditional_forbid(req):
+    """Helper wsgi app returns 403 if param 'die' is 1."""
+    if 'die' in req.params and req.params['die'] == '1':
+        raise webob.exc.HTTPForbidden()
+    return 'OK'
+
+
+class LockoutTestCase(test.TrialTestCase):
+    """Test case for the Lockout middleware."""
+    def setUp(self):  # pylint: disable-msg=C0103
+        super(LockoutTestCase, self).setUp()
+        utils.set_time_override()
+        self.lockout = ec2.Lockout(conditional_forbid)
+
+    def tearDown(self):  # pylint: disable-msg=C0103
+        utils.clear_time_override()
+        super(LockoutTestCase, self).tearDown()
+
+    def _send_bad_attempts(self, access_key, num_attempts=1):
+        """Fail x."""
+        for i in xrange(num_attempts):
+            req = webob.Request.blank('/?AWSAccessKeyId=%s&die=1' % access_key)
+            self.assertEqual(req.get_response(self.lockout).status_int, 403)
+
+    def _is_locked_out(self, access_key):
+        """Sends a test request to see if key is locked out."""
+        req = webob.Request.blank('/?AWSAccessKeyId=%s' % access_key)
+        return (req.get_response(self.lockout).status_int == 403)
+
+    def test_lockout(self):
+        self._send_bad_attempts('test', FLAGS.lockout_attempts)
+        self.assertTrue(self._is_locked_out('test'))
+
+    def test_timeout(self):
+        self._send_bad_attempts('test', FLAGS.lockout_attempts)
+        self.assertTrue(self._is_locked_out('test'))
+        utils.advance_time_seconds(FLAGS.lockout_minutes * 60)
+        self.assertFalse(self._is_locked_out('test'))
+
+    def test_multiple_keys(self):
+        self._send_bad_attempts('test1', FLAGS.lockout_attempts)
+        self.assertTrue(self._is_locked_out('test1'))
+        self.assertFalse(self._is_locked_out('test2'))
+        utils.advance_time_seconds(FLAGS.lockout_minutes * 60)
+        self.assertFalse(self._is_locked_out('test1'))
+        self.assertFalse(self._is_locked_out('test2'))
+
+    def test_window_timeout(self):
+        self._send_bad_attempts('test', FLAGS.lockout_attempts - 1)
+        self.assertFalse(self._is_locked_out('test'))
+        utils.advance_time_seconds(FLAGS.lockout_window * 60)
+        self._send_bad_attempts('test', FLAGS.lockout_attempts - 1)
+        self.assertFalse(self._is_locked_out('test'))
diff --git a/nova/tests/misc_unittest.py b/nova/tests/misc_unittest.py
index 667c63ad0..3d947427a 100644
--- a/nova/tests/misc_unittest.py
+++ b/nova/tests/misc_unittest.py
@@ -20,7 +20,7 @@ from nova import test
 from nova.utils import parse_mailmap, str_dict_replace
 
 
-class ProjectTestCase(test.TrialTestCase):
+class ProjectTestCase(test.TestCase):
     def test_authors_up_to_date(self):
         if os.path.exists('../.bzr'):
             contributors = set()
@@ -30,23 +30,26 @@ class ProjectTestCase(test.TrialTestCase):
             import bzrlib.workingtree
             tree = bzrlib.workingtree.WorkingTree.open('..')
             tree.lock_read()
-            parents = tree.get_parent_ids()
-            g = tree.branch.repository.get_graph()
-            for p in parents[1:]:
-                rev_ids = [r for r, _ in g.iter_ancestry(parents)
-                           if r != "null:"]
-                revs = tree.branch.repository.get_revisions(rev_ids)
-                for r in revs:
-                    for author in r.get_apparent_authors():
-                        email = author.split(' ')[-1]
-                        contributors.add(str_dict_replace(email, mailmap))
-
-            authors_file = open('../Authors', 'r').read()
-
-            missing = set()
-            for contributor in contributors:
-                if not contributor in authors_file:
-                    missing.add(contributor)
-
-            self.assertTrue(len(missing) == 0,
-                            '%r not listed in Authors' % missing)
+            try:
+                parents = tree.get_parent_ids()
+                g = tree.branch.repository.get_graph()
+                for p in parents[1:]:
+                    rev_ids = [r for r, _ in g.iter_ancestry(parents)
+                               if r != "null:"]
+                    revs = tree.branch.repository.get_revisions(rev_ids)
+                    for r in revs:
+                        for author in r.get_apparent_authors():
+                            email = author.split(' ')[-1]
+                            contributors.add(str_dict_replace(email, mailmap))
+
+                authors_file = open('../Authors', 'r').read()
+
+                missing = set()
+                for contributor in contributors:
+                    if not contributor in authors_file:
+                        missing.add(contributor)
+
+                self.assertTrue(len(missing) == 0,
+                                '%r not listed in Authors' % missing)
+            finally:
+                tree.unlock()
diff --git a/nova/tests/network_unittest.py b/nova/tests/network_unittest.py
index 6f4705719..96473ac7c 100644
--- a/nova/tests/network_unittest.py
+++ b/nova/tests/network_unittest.py
@@ -26,6 +26,7 @@ from nova import context
 from nova import db
 from nova import exception
 from nova import flags
+from nova import service
 from nova import test
 from nova import utils
 from nova.auth import manager
@@ -33,13 +34,14 @@ from nova.auth import manager
 FLAGS = flags.FLAGS
 
 
-class NetworkTestCase(test.TrialTestCase):
+class NetworkTestCase(test.TestCase):
     """Test cases for network code"""
     def setUp(self):
         super(NetworkTestCase, self).setUp()
         # NOTE(vish): if you change these flags, make sure to change the
         #             flags in the corresponding section in nova-dhcpbridge
         self.flags(connection_type='fake',
+                   fake_call=True,
                    fake_network=True,
                    network_size=16,
                    num_networks=5)
@@ -56,16 +58,13 @@ class NetworkTestCase(test.TrialTestCase):
             # create the necessary network data for the project
             user_context = context.RequestContext(project=self.projects[i],
                                                      user=self.user)
-            network_ref = self.network.get_network(user_context)
-            self.network.set_network_host(context.get_admin_context(),
-                                          network_ref['id'])
+            host = self.network.get_network_host(user_context.elevated())
         instance_ref = self._create_instance(0)
         self.instance_id = instance_ref['id']
         instance_ref = self._create_instance(1)
         self.instance2_id = instance_ref['id']
 
     def tearDown(self):
-        super(NetworkTestCase, self).tearDown()
         # TODO(termie): this should really be instantiating clean datastores
         #               in between runs, one failure kills all the tests
         db.instance_destroy(context.get_admin_context(), self.instance_id)
@@ -73,6 +72,7 @@ class NetworkTestCase(test.TrialTestCase):
         for project in self.projects:
             self.manager.delete_project(project)
         self.manager.delete_user(self.user)
+        super(NetworkTestCase, self).tearDown()
 
     def _create_instance(self, project_num, mac=None):
         if not mac:
diff --git a/nova/tests/objectstore_unittest.py b/nova/tests/objectstore_unittest.py
index 061799923..ceac17adb 100644
--- a/nova/tests/objectstore_unittest.py
+++ b/nova/tests/objectstore_unittest.py
@@ -54,7 +54,7 @@ os.makedirs(os.path.join(OSS_TEMPDIR, 'images'))
 os.makedirs(os.path.join(OSS_TEMPDIR, 'buckets'))
 
 
-class ObjectStoreTestCase(test.TrialTestCase):
+class ObjectStoreTestCase(test.TestCase):
     """Test objectstore API directly."""
 
     def setUp(self):
@@ -191,7 +191,7 @@ class TestSite(server.Site):
     protocol = TestHTTPChannel
 
 
-class S3APITestCase(test.TrialTestCase):
+class S3APITestCase(test.TestCase):
     """Test objectstore through S3 API."""
 
     def setUp(self):
diff --git a/nova/tests/process_unittest.py b/nova/tests/process_unittest.py
deleted file mode 100644
index 67245af03..000000000
--- a/nova/tests/process_unittest.py
+++ /dev/null
@@ -1,132 +0,0 @@
-# vim: tabstop=4 shiftwidth=4 softtabstop=4
-
-# Copyright 2010 United States Government as represented by the
-# Administrator of the National Aeronautics and Space Administration.
-# All Rights Reserved.
-#
-#    Licensed under the Apache License, Version 2.0 (the "License"); you may
-#    not use this file except in compliance with the License. You may obtain
-#    a copy of the License at
-#
-#         http://www.apache.org/licenses/LICENSE-2.0
-#
-#    Unless required by applicable law or agreed to in writing, software
-#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-#    License for the specific language governing permissions and limitations
-#    under the License.
-
-import logging
-from twisted.internet import defer
-from twisted.internet import reactor
-from xml.etree import ElementTree
-
-from nova import exception
-from nova import flags
-from nova import process
-from nova import test
-from nova import utils
-
-FLAGS = flags.FLAGS
-
-
-class ProcessTestCase(test.TrialTestCase):
-    def setUp(self):
-        logging.getLogger().setLevel(logging.DEBUG)
-        super(ProcessTestCase, self).setUp()
-
-    def test_execute_stdout(self):
-        pool = process.ProcessPool(2)
-        d = pool.simple_execute('echo test')
-
-        def _check(rv):
-            self.assertEqual(rv[0], 'test\n')
-            self.assertEqual(rv[1], '')
-
-        d.addCallback(_check)
-        d.addErrback(self.fail)
-        return d
-
-    def test_execute_stderr(self):
-        pool = process.ProcessPool(2)
-        d = pool.simple_execute('cat BAD_FILE', check_exit_code=False)
-
-        def _check(rv):
-            self.assertEqual(rv[0], '')
-            self.assert_('No such file' in rv[1])
-
-        d.addCallback(_check)
-        d.addErrback(self.fail)
-        return d
-
-    def test_execute_unexpected_stderr(self):
-        pool = process.ProcessPool(2)
-        d = pool.simple_execute('cat BAD_FILE')
-        d.addCallback(lambda x: self.fail('should have raised an error'))
-        d.addErrback(lambda failure: failure.trap(IOError))
-        return d
-
-    def test_max_processes(self):
-        pool = process.ProcessPool(2)
-        d1 = pool.simple_execute('sleep 0.01')
-        d2 = pool.simple_execute('sleep 0.01')
-        d3 = pool.simple_execute('sleep 0.005')
-        d4 = pool.simple_execute('sleep 0.005')
-
-        called = []
-
-        def _called(rv, name):
-            called.append(name)
-
-        d1.addCallback(_called, 'd1')
-        d2.addCallback(_called, 'd2')
-        d3.addCallback(_called, 'd3')
-        d4.addCallback(_called, 'd4')
-
-        # Make sure that d3 and d4 had to wait on the other two and were called
-        # in order
-        # NOTE(termie): there may be a race condition in this test if for some
-        #               reason one of the sleeps takes longer to complete
-        #               than it should
-        d4.addCallback(lambda x: self.assertEqual(called[2], 'd3'))
-        d4.addCallback(lambda x: self.assertEqual(called[3], 'd4'))
-        d4.addErrback(self.fail)
-        return d4
-
-    def test_kill_long_process(self):
-        pool = process.ProcessPool(2)
-
-        d1 = pool.simple_execute('sleep 1')
-        d2 = pool.simple_execute('sleep 0.005')
-
-        timeout = reactor.callLater(0.1, self.fail, 'should have been killed')
-
-        # kill d1 and wait on it to end then cancel the timeout
-        d2.addCallback(lambda _: d1.process.signalProcess('KILL'))
-        d2.addCallback(lambda _: d1)
-        d2.addBoth(lambda _: timeout.active() and timeout.cancel())
-        d2.addErrback(self.fail)
-        return d2
-
-    def test_process_exit_is_contained(self):
-        pool = process.ProcessPool(2)
-
-        d1 = pool.simple_execute('sleep 1')
-        d1.addCallback(lambda x: self.fail('should have errbacked'))
-        d1.addErrback(lambda fail: fail.trap(IOError))
-        reactor.callLater(0.05, d1.process.signalProcess, 'KILL')
-
-        return d1
-
-    def test_shared_pool_is_singleton(self):
-        pool1 = process.SharedPool()
-        pool2 = process.SharedPool()
-        self.assertEqual(id(pool1._instance), id(pool2._instance))
-
-    def test_shared_pool_works_as_singleton(self):
-        d1 = process.simple_execute('sleep 1')
-        d2 = process.simple_execute('sleep 0.005')
-        # lp609749: would have failed with
-        # exceptions.AssertionError: Someone released me too many times:
-        # too many tokens!
-        return d1
diff --git a/nova/tests/quota_unittest.py b/nova/tests/quota_unittest.py
index 1966b51f7..8cf2a5e54 100644
--- a/nova/tests/quota_unittest.py
+++ b/nova/tests/quota_unittest.py
@@ -32,7 +32,7 @@ from nova.api.ec2 import cloud
 FLAGS = flags.FLAGS
 
 
-class QuotaTestCase(test.TrialTestCase):
+class QuotaTestCase(test.TestCase):
     def setUp(self):
         logging.getLogger().setLevel(logging.DEBUG)
         super(QuotaTestCase, self).setUp()
diff --git a/nova/tests/rpc_unittest.py b/nova/tests/rpc_unittest.py
index f35b65a39..6ea2edcab 100644
--- a/nova/tests/rpc_unittest.py
+++ b/nova/tests/rpc_unittest.py
@@ -20,8 +20,6 @@ Unit Tests for remote procedure calls using queue
 """
 import logging
 
-from twisted.internet import defer
-
 from nova import context
 from nova import flags
 from nova import rpc
@@ -31,32 +29,31 @@ from nova import test
 FLAGS = flags.FLAGS
 
 
-class RpcTestCase(test.TrialTestCase):
+class RpcTestCase(test.TestCase):
     """Test cases for rpc"""
     def setUp(self):
         super(RpcTestCase, self).setUp()
-        self.conn = rpc.Connection.instance()
+        self.conn = rpc.Connection.instance(True)
         self.receiver = TestReceiver()
         self.consumer = rpc.AdapterConsumer(connection=self.conn,
                                             topic='test',
                                             proxy=self.receiver)
-        self.consumer.attach_to_twisted()
+        self.consumer.attach_to_eventlet()
         self.context = context.get_admin_context()
 
     def test_call_succeed(self):
         """Get a value through rpc call"""
         value = 42
-        result = yield rpc.call_twisted(self.context,
-                                        'test', {"method": "echo",
+        result = rpc.call(self.context, 'test', {"method": "echo",
                                                  "args": {"value": value}})
         self.assertEqual(value, result)
 
     def test_context_passed(self):
         """Makes sure a context is passed through rpc call"""
         value = 42
-        result = yield rpc.call_twisted(self.context,
-                                        'test', {"method": "context",
-                                                 "args": {"value": value}})
+        result = rpc.call(self.context,
+                          'test', {"method": "context",
+                                   "args": {"value": value}})
         self.assertEqual(self.context.to_dict(), result)
 
     def test_call_exception(self):
@@ -67,18 +64,48 @@ class RpcTestCase(test.TrialTestCase):
         to an int in the test.
         """
         value = 42
-        self.assertFailure(rpc.call_twisted(self.context, 'test',
-                                            {"method": "fail",
-                                             "args": {"value": value}}),
-                           rpc.RemoteError)
+        self.assertRaises(rpc.RemoteError,
+                          rpc.call,
+                          self.context,
+                          'test',
+                          {"method": "fail",
+                           "args": {"value": value}})
         try:
-            yield rpc.call_twisted(self.context,
-                                   'test', {"method": "fail",
-                                            "args": {"value": value}})
+            rpc.call(self.context,
+                     'test',
+                     {"method": "fail",
+                      "args": {"value": value}})
             self.fail("should have thrown rpc.RemoteError")
         except rpc.RemoteError as exc:
             self.assertEqual(int(exc.value), value)
 
+    def test_nested_calls(self):
+        """Test that we can do an rpc.call inside another call"""
+        class Nested(object):
+            @staticmethod
+            def echo(context, queue, value):
+                """Calls echo in the passed queue"""
+                logging.debug("Nested received %s, %s", queue, value)
+                ret = rpc.call(context,
+                               queue,
+                               {"method": "echo",
+                                "args": {"value": value}})
+                logging.debug("Nested return %s", ret)
+                return value
+
+        nested = Nested()
+        conn = rpc.Connection.instance(True)
+        consumer = rpc.AdapterConsumer(connection=conn,
+                                       topic='nested',
+                                       proxy=nested)
+        consumer.attach_to_eventlet()
+        value = 42
+        result = rpc.call(self.context,
+                          'nested', {"method": "echo",
+                                     "args": {"queue": "test",
+                                              "value": value}})
+        self.assertEqual(value, result)
+
 
 class TestReceiver(object):
     """Simple Proxy class so the consumer has methods to call
@@ -89,13 +116,13 @@ class TestReceiver(object):
     def echo(context, value):
         """Simply returns whatever value is sent in"""
         logging.debug("Received %s", value)
-        return defer.succeed(value)
+        return value
 
     @staticmethod
     def context(context, value):
         """Returns dictionary version of context"""
         logging.debug("Received %s", context)
-        return defer.succeed(context.to_dict())
+        return context.to_dict()
 
     @staticmethod
     def fail(context, value):
diff --git a/nova/tests/scheduler_unittest.py b/nova/tests/scheduler_unittest.py
index cb5fe6b9c..df5e7afa5 100644
--- a/nova/tests/scheduler_unittest.py
+++ b/nova/tests/scheduler_unittest.py
@@ -44,7 +44,7 @@ class TestDriver(driver.Scheduler):
         return 'named_host'
 
 
-class SchedulerTestCase(test.TrialTestCase):
+class SchedulerTestCase(test.TestCase):
     """Test case for scheduler"""
     def setUp(self):
         super(SchedulerTestCase, self).setUp()
@@ -73,11 +73,12 @@ class SchedulerTestCase(test.TrialTestCase):
         scheduler.named_method(ctxt, 'topic', num=7)
 
 
-class SimpleDriverTestCase(test.TrialTestCase):
+class SimpleDriverTestCase(test.TestCase):
     """Test case for simple driver"""
     def setUp(self):
         super(SimpleDriverTestCase, self).setUp()
         self.flags(connection_type='fake',
+                   stub_network=True,
                    max_cores=4,
                    max_gigabytes=4,
                    network_manager='nova.network.manager.FlatManager',
@@ -122,12 +123,12 @@ class SimpleDriverTestCase(test.TrialTestCase):
                                    'nova-compute',
                                    'compute',
                                    FLAGS.compute_manager)
-        compute1.startService()
+        compute1.start()
         compute2 = service.Service('host2',
                                    'nova-compute',
                                    'compute',
                                    FLAGS.compute_manager)
-        compute2.startService()
+        compute2.start()
         hosts = self.scheduler.driver.hosts_up(self.context, 'compute')
         self.assertEqual(len(hosts), 2)
         compute1.kill()
@@ -139,12 +140,12 @@ class SimpleDriverTestCase(test.TrialTestCase):
                                    'nova-compute',
                                    'compute',
                                    FLAGS.compute_manager)
-        compute1.startService()
+        compute1.start()
         compute2 = service.Service('host2',
                                    'nova-compute',
                                    'compute',
                                    FLAGS.compute_manager)
-        compute2.startService()
+        compute2.start()
         instance_id1 = self._create_instance()
         compute1.run_instance(self.context, instance_id1)
         instance_id2 = self._create_instance()
@@ -162,12 +163,12 @@ class SimpleDriverTestCase(test.TrialTestCase):
                                    'nova-compute',
                                    'compute',
                                    FLAGS.compute_manager)
-        compute1.startService()
+        compute1.start()
         compute2 = service.Service('host2',
                                    'nova-compute',
                                    'compute',
                                    FLAGS.compute_manager)
-        compute2.startService()
+        compute2.start()
         instance_ids1 = []
         instance_ids2 = []
         for index in xrange(FLAGS.max_cores):
@@ -195,12 +196,12 @@ class SimpleDriverTestCase(test.TrialTestCase):
                                    'nova-volume',
                                    'volume',
                                    FLAGS.volume_manager)
-        volume1.startService()
+        volume1.start()
         volume2 = service.Service('host2',
                                    'nova-volume',
                                    'volume',
                                    FLAGS.volume_manager)
-        volume2.startService()
+        volume2.start()
         volume_id1 = self._create_volume()
         volume1.create_volume(self.context, volume_id1)
         volume_id2 = self._create_volume()
@@ -218,12 +219,12 @@ class SimpleDriverTestCase(test.TrialTestCase):
                                    'nova-volume',
                                    'volume',
                                    FLAGS.volume_manager)
-        volume1.startService()
+        volume1.start()
         volume2 = service.Service('host2',
                                    'nova-volume',
                                    'volume',
                                    FLAGS.volume_manager)
-        volume2.startService()
+        volume2.start()
         volume_ids1 = []
         volume_ids2 = []
         for index in xrange(FLAGS.max_gigabytes):
diff --git a/nova/tests/service_unittest.py b/nova/tests/service_unittest.py
index a268bc4fe..47c092f8e 100644
--- a/nova/tests/service_unittest.py
+++ b/nova/tests/service_unittest.py
@@ -22,9 +22,6 @@ Unit Tests for remote procedure calls using queue
 
 import mox
 
-from twisted.application.app import startApplication
-from twisted.internet import defer
-
 from nova import exception
 from nova import flags
 from nova import rpc
@@ -48,7 +45,7 @@ class ExtendedService(service.Service):
         return 'service'
 
 
-class ServiceManagerTestCase(test.TrialTestCase):
+class ServiceManagerTestCase(test.TestCase):
     """Test cases for Services"""
 
     def test_attribute_error_for_no_manager(self):
@@ -63,7 +60,7 @@ class ServiceManagerTestCase(test.TrialTestCase):
                                'test',
                                'test',
                                'nova.tests.service_unittest.FakeManager')
-        serv.startService()
+        serv.start()
         self.assertEqual(serv.test_method(), 'manager')
 
     def test_override_manager_method(self):
@@ -71,11 +68,11 @@ class ServiceManagerTestCase(test.TrialTestCase):
                                'test',
                                'test',
                                'nova.tests.service_unittest.FakeManager')
-        serv.startService()
+        serv.start()
         self.assertEqual(serv.test_method(), 'service')
 
 
-class ServiceTestCase(test.TrialTestCase):
+class ServiceTestCase(test.TestCase):
     """Test cases for Services"""
 
     def setUp(self):
@@ -94,8 +91,6 @@ class ServiceTestCase(test.TrialTestCase):
         self.mox.StubOutWithMock(rpc,
                                  'AdapterConsumer',
                                  use_mock_anything=True)
-        self.mox.StubOutWithMock(
-                service.task, 'LoopingCall', use_mock_anything=True)
         rpc.AdapterConsumer(connection=mox.IgnoreArg(),
                             topic=topic,
                             proxy=mox.IsA(service.Service)).AndReturn(
@@ -106,19 +101,8 @@ class ServiceTestCase(test.TrialTestCase):
                             proxy=mox.IsA(service.Service)).AndReturn(
                                     rpc.AdapterConsumer)
 
-        rpc.AdapterConsumer.attach_to_twisted()
-        rpc.AdapterConsumer.attach_to_twisted()
-
-        # Stub out looping call a bit needlessly since we don't have an easy
-        # way to cancel it (yet) when the tests finishes
-        service.task.LoopingCall(mox.IgnoreArg()).AndReturn(
-                        service.task.LoopingCall)
-        service.task.LoopingCall.start(interval=mox.IgnoreArg(),
-                                       now=mox.IgnoreArg())
-        service.task.LoopingCall(mox.IgnoreArg()).AndReturn(
-                        service.task.LoopingCall)
-        service.task.LoopingCall.start(interval=mox.IgnoreArg(),
-                                       now=mox.IgnoreArg())
+        rpc.AdapterConsumer.attach_to_eventlet()
+        rpc.AdapterConsumer.attach_to_eventlet()
 
         service_create = {'host': host,
                           'binary': binary,
@@ -136,14 +120,14 @@ class ServiceTestCase(test.TrialTestCase):
                                   service_create).AndReturn(service_ref)
         self.mox.ReplayAll()
 
-        startApplication(app, False)
+        app.start()
+        app.stop()
         self.assert_(app)
 
     # We're testing sort of weird behavior in how report_state decides
     # whether it is disconnected, it looks for a variable on itself called
     # 'model_disconnected' and report_state doesn't really do much so this
     # these are mostly just for coverage
-    @defer.inlineCallbacks
     def test_report_state_no_service(self):
         host = 'foo'
         binary = 'bar'
@@ -173,10 +157,9 @@ class ServiceTestCase(test.TrialTestCase):
                                binary,
                                topic,
                                'nova.tests.service_unittest.FakeManager')
-        serv.startService()
-        yield serv.report_state()
+        serv.start()
+        serv.report_state()
 
-    @defer.inlineCallbacks
     def test_report_state_newly_disconnected(self):
         host = 'foo'
         binary = 'bar'
@@ -204,11 +187,10 @@ class ServiceTestCase(test.TrialTestCase):
                                binary,
                                topic,
                                'nova.tests.service_unittest.FakeManager')
-        serv.startService()
-        yield serv.report_state()
+        serv.start()
+        serv.report_state()
         self.assert_(serv.model_disconnected)
 
-    @defer.inlineCallbacks
     def test_report_state_newly_connected(self):
         host = 'foo'
         binary = 'bar'
@@ -238,8 +220,8 @@ class ServiceTestCase(test.TrialTestCase):
                                binary,
                                topic,
                                'nova.tests.service_unittest.FakeManager')
-        serv.startService()
+        serv.start()
         serv.model_disconnected = True
-        yield serv.report_state()
+        serv.report_state()
 
         self.assert_(not serv.model_disconnected)
diff --git a/nova/tests/virt_unittest.py b/nova/tests/virt_unittest.py
index d49383fb7..9ad009510 100644
--- a/nova/tests/virt_unittest.py
+++ b/nova/tests/virt_unittest.py
@@ -30,9 +30,10 @@ FLAGS = flags.FLAGS
 flags.DECLARE('instances_path', 'nova.compute.manager')
 
 
-class LibvirtConnTestCase(test.TrialTestCase):
+class LibvirtConnTestCase(test.TestCase):
     def setUp(self):
         super(LibvirtConnTestCase, self).setUp()
+        self.flags(fake_call=True)
         self.manager = manager.AuthManager()
         self.user = self.manager.create_user('fake', 'fake', 'fake',
                                              admin=True)
@@ -40,33 +41,66 @@ class LibvirtConnTestCase(test.TrialTestCase):
         self.network = utils.import_object(FLAGS.network_manager)
         FLAGS.instances_path = ''
 
-    def test_get_uri_and_template(self):
-        ip = '10.11.12.13'
-
-        instance = {'internal_id': 1,
-                    'memory_kb': '1024000',
-                    'basepath': '/some/path',
-                    'bridge_name': 'br100',
-                    'mac_address': '02:12:34:46:56:67',
-                    'vcpus': 2,
-                    'project_id': 'fake',
-                    'bridge': 'br101',
-                    'instance_type': 'm1.small'}
-
+    test_ip = '10.11.12.13'
+    test_instance = {'memory_kb':     '1024000',
+                     'basepath':      '/some/path',
+                     'bridge_name':   'br100',
+                     'mac_address':   '02:12:34:46:56:67',
+                     'vcpus':         2,
+                     'project_id':    'fake',
+                     'bridge':        'br101',
+                     'instance_type': 'm1.small'}
+
+    def test_xml_and_uri_no_ramdisk_no_kernel(self):
+        instance_data = dict(self.test_instance)
+        self.do_test_xml_and_uri(instance_data,
+                                 expect_kernel=False, expect_ramdisk=False)
+
+    def test_xml_and_uri_no_ramdisk(self):
+        instance_data = dict(self.test_instance)
+        instance_data['kernel_id'] = 'aki-deadbeef'
+        self.do_test_xml_and_uri(instance_data,
+                                 expect_kernel=True, expect_ramdisk=False)
+
+    def test_xml_and_uri_no_kernel(self):
+        instance_data = dict(self.test_instance)
+        instance_data['ramdisk_id'] = 'ari-deadbeef'
+        self.do_test_xml_and_uri(instance_data,
+                                 expect_kernel=False, expect_ramdisk=False)
+
+    def test_xml_and_uri(self):
+        instance_data = dict(self.test_instance)
+        instance_data['ramdisk_id'] = 'ari-deadbeef'
+        instance_data['kernel_id'] = 'aki-deadbeef'
+        self.do_test_xml_and_uri(instance_data,
+                                 expect_kernel=True, expect_ramdisk=True)
+
+    def test_xml_and_uri_rescue(self):
+        instance_data = dict(self.test_instance)
+        instance_data['ramdisk_id'] = 'ari-deadbeef'
+        instance_data['kernel_id'] = 'aki-deadbeef'
+        self.do_test_xml_and_uri(instance_data,
+                                 expect_kernel=True, expect_ramdisk=True,
+                                 rescue=True)
+
+    def do_test_xml_and_uri(self, instance,
+                            expect_ramdisk, expect_kernel,
+                            rescue=False):
         user_context = context.RequestContext(project=self.project,
                                               user=self.user)
         instance_ref = db.instance_create(user_context, instance)
-        network_ref = self.network.get_network(user_context)
-        self.network.set_network_host(context.get_admin_context(),
-                                      network_ref['id'])
+        host = self.network.get_network_host(user_context.elevated())
+        network_ref = db.project_get_network(context.get_admin_context(),
+                                             self.project.id)
 
-        fixed_ip = {'address': ip,
+        fixed_ip = {'address':    self.test_ip,
                     'network_id': network_ref['id']}
 
         ctxt = context.get_admin_context()
         fixed_ip_ref = db.fixed_ip_create(ctxt, fixed_ip)
-        db.fixed_ip_update(ctxt, ip, {'allocated': True,
-                                      'instance_id': instance_ref['id']})
+        db.fixed_ip_update(ctxt, self.test_ip,
+                                 {'allocated':   True,
+                                  'instance_id': instance_ref['id']})
 
         type_uri_map = {'qemu': ('qemu:///system',
                              [(lambda t: t.find('.').get('type'), 'qemu'),
@@ -78,23 +112,73 @@ class LibvirtConnTestCase(test.TrialTestCase):
                               (lambda t: t.find('./devices/emulator'), None)]),
                         'uml': ('uml:///system',
                              [(lambda t: t.find('.').get('type'), 'uml'),
-                              (lambda t: t.find('./os/type').text, 'uml')])}
+                              (lambda t: t.find('./os/type').text, 'uml')]),
+                        'xen': ('xen:///',
+                             [(lambda t: t.find('.').get('type'), 'xen'),
+                              (lambda t: t.find('./os/type').text, 'linux')]),
+                              }
+
+        for hypervisor_type in ['qemu', 'kvm', 'xen']:
+            check_list = type_uri_map[hypervisor_type][1]
+
+            if rescue:
+                check = (lambda t: t.find('./os/kernel').text.split('/')[1],
+                         'rescue-kernel')
+                check_list.append(check)
+                check = (lambda t: t.find('./os/initrd').text.split('/')[1],
+                         'rescue-ramdisk')
+                check_list.append(check)
+            else:
+                if expect_kernel:
+                    check = (lambda t: t.find('./os/kernel').text.split(
+                        '/')[1], 'kernel')
+                else:
+                    check = (lambda t: t.find('./os/kernel'), None)
+                check_list.append(check)
+
+                if expect_ramdisk:
+                    check = (lambda t: t.find('./os/initrd').text.split(
+                        '/')[1], 'ramdisk')
+                else:
+                    check = (lambda t: t.find('./os/initrd'), None)
+                check_list.append(check)
 
         common_checks = [
             (lambda t: t.find('.').tag, 'domain'),
-            (lambda t: t.find('./devices/interface/filterref/parameter').\
-                         get('name'), 'IP'),
-            (lambda t: t.find('./devices/interface/filterref/parameter').\
-                         get('value'), '10.11.12.13')]
+            (lambda t: t.find(
+                './devices/interface/filterref/parameter').get('name'), 'IP'),
+            (lambda t: t.find(
+                './devices/interface/filterref/parameter').get(
+                    'value'), '10.11.12.13'),
+            (lambda t: t.findall(
+                './devices/interface/filterref/parameter')[1].get(
+                    'name'), 'DHCPSERVER'),
+            (lambda t: t.findall(
+                './devices/interface/filterref/parameter')[1].get(
+                    'value'), '10.0.0.1'),
+            (lambda t: t.find('./devices/serial/source').get(
+                'path').split('/')[1], 'console.log'),
+            (lambda t: t.find('./memory').text, '2097152')]
+
+        if rescue:
+            common_checks += [
+                (lambda t: t.findall('./devices/disk/source')[0].get(
+                    'file').split('/')[1], 'rescue-disk'),
+                (lambda t: t.findall('./devices/disk/source')[1].get(
+                    'file').split('/')[1], 'disk')]
+        else:
+            common_checks += [(lambda t: t.findall(
+                './devices/disk/source')[0].get('file').split('/')[1],
+                               'disk')]
 
         for (libvirt_type, (expected_uri, checks)) in type_uri_map.iteritems():
             FLAGS.libvirt_type = libvirt_type
             conn = libvirt_conn.LibvirtConnection(True)
 
-            uri, _template, _rescue = conn.get_uri_and_templates()
+            uri = conn.get_uri()
             self.assertEquals(uri, expected_uri)
 
-            xml = conn.to_xml(instance_ref)
+            xml = conn.to_xml(instance_ref, rescue)
             tree = xml_to_tree(xml)
             for i, (check, expected_result) in enumerate(checks):
                 self.assertEqual(check(tree),
@@ -106,6 +190,9 @@ class LibvirtConnTestCase(test.TrialTestCase):
                                  expected_result,
                                  '%s failed common check %d' % (xml, i))
 
+        # This test is supposed to make sure we don't override a specifically
+        # set uri
+        #
         # Deliberately not just assigning this string to FLAGS.libvirt_uri and
         # checking against that later on. This way we make sure the
         # implementation doesn't fiddle around with the FLAGS.
@@ -114,7 +201,7 @@ class LibvirtConnTestCase(test.TrialTestCase):
         for (libvirt_type, (expected_uri, checks)) in type_uri_map.iteritems():
             FLAGS.libvirt_type = libvirt_type
             conn = libvirt_conn.LibvirtConnection(True)
-            uri, _template, _rescue = conn.get_uri_and_templates()
+            uri = conn.get_uri()
             self.assertEquals(uri, testuri)
 
     def tearDown(self):
@@ -123,7 +210,7 @@ class LibvirtConnTestCase(test.TrialTestCase):
         self.manager.delete_user(self.user)
 
 
-class NWFilterTestCase(test.TrialTestCase):
+class NWFilterTestCase(test.TestCase):
 
     def setUp(self):
         super(NWFilterTestCase, self).setUp()
@@ -235,7 +322,7 @@ class NWFilterTestCase(test.TrialTestCase):
                                           'project_id': 'fake'})
         inst_id = instance_ref['id']
 
-        def _ensure_all_called(_):
+        def _ensure_all_called():
             instance_filter = 'nova-instance-%s' % instance_ref['name']
             secgroup_filter = 'nova-secgroup-%s' % self.security_group['id']
             for required in [secgroup_filter, 'allow-dhcp-server',
@@ -252,8 +339,7 @@ class NWFilterTestCase(test.TrialTestCase):
                                        self.security_group.id)
         instance = db.instance_get(self.context, inst_id)
 
-        d = self.fw.setup_nwfilters_for_instance(instance)
-        d.addCallback(_ensure_all_called)
-        d.addCallback(lambda _: self.teardown_security_group())
-
-        return d
+        self.fw.setup_base_nwfilters()
+        self.fw.setup_nwfilters_for_instance(instance)
+        _ensure_all_called()
+        self.teardown_security_group()
diff --git a/nova/tests/volume_unittest.py b/nova/tests/volume_unittest.py
index 12321a96f..b13455fb0 100644
--- a/nova/tests/volume_unittest.py
+++ b/nova/tests/volume_unittest.py
@@ -21,8 +21,6 @@ Tests for Volume Code.
 """
 import logging
 
-from twisted.internet import defer
-
 from nova import context
 from nova import exception
 from nova import db
@@ -33,7 +31,7 @@ from nova import utils
 FLAGS = flags.FLAGS
 
 
-class VolumeTestCase(test.TrialTestCase):
+class VolumeTestCase(test.TestCase):
     """Test Case for volumes."""
 
     def setUp(self):
@@ -56,51 +54,48 @@ class VolumeTestCase(test.TrialTestCase):
         vol['attach_status'] = "detached"
         return db.volume_create(context.get_admin_context(), vol)['id']
 
-    @defer.inlineCallbacks
     def test_create_delete_volume(self):
         """Test volume can be created and deleted."""
         volume_id = self._create_volume()
-        yield self.volume.create_volume(self.context, volume_id)
+        self.volume.create_volume(self.context, volume_id)
         self.assertEqual(volume_id, db.volume_get(context.get_admin_context(),
                          volume_id).id)
 
-        yield self.volume.delete_volume(self.context, volume_id)
+        self.volume.delete_volume(self.context, volume_id)
         self.assertRaises(exception.NotFound,
                           db.volume_get,
                           self.context,
                           volume_id)
 
-    @defer.inlineCallbacks
     def test_too_big_volume(self):
         """Ensure failure if a too large of a volume is requested."""
         # FIXME(vish): validation needs to move into the data layer in
         #              volume_create
-        defer.returnValue(True)
+        return True
         try:
             volume_id = self._create_volume('1001')
-            yield self.volume.create_volume(self.context, volume_id)
+            self.volume.create_volume(self.context, volume_id)
             self.fail("Should have thrown TypeError")
         except TypeError:
             pass
 
-    @defer.inlineCallbacks
     def test_too_many_volumes(self):
         """Ensure that NoMoreTargets is raised when we run out of volumes."""
         vols = []
         total_slots = FLAGS.iscsi_num_targets
         for _index in xrange(total_slots):
             volume_id = self._create_volume()
-            yield self.volume.create_volume(self.context, volume_id)
+            self.volume.create_volume(self.context, volume_id)
             vols.append(volume_id)
         volume_id = self._create_volume()
-        self.assertFailure(self.volume.create_volume(self.context,
-                                                     volume_id),
-                           db.NoMoreTargets)
+        self.assertRaises(db.NoMoreTargets,
+                          self.volume.create_volume,
+                          self.context,
+                          volume_id)
         db.volume_destroy(context.get_admin_context(), volume_id)
         for volume_id in vols:
-            yield self.volume.delete_volume(self.context, volume_id)
+            self.volume.delete_volume(self.context, volume_id)
 
-    @defer.inlineCallbacks
     def test_run_attach_detach_volume(self):
         """Make sure volume can be attached and detached from instance."""
         inst = {}
@@ -115,15 +110,15 @@ class VolumeTestCase(test.TrialTestCase):
         instance_id = db.instance_create(self.context, inst)['id']
         mountpoint = "/dev/sdf"
         volume_id = self._create_volume()
-        yield self.volume.create_volume(self.context, volume_id)
+        self.volume.create_volume(self.context, volume_id)
         if FLAGS.fake_tests:
             db.volume_attached(self.context, volume_id, instance_id,
                                mountpoint)
         else:
-            yield self.compute.attach_volume(self.context,
-                                             instance_id,
-                                             volume_id,
-                                             mountpoint)
+            self.compute.attach_volume(self.context,
+                                       instance_id,
+                                       volume_id,
+                                       mountpoint)
         vol = db.volume_get(context.get_admin_context(), volume_id)
         self.assertEqual(vol['status'], "in-use")
         self.assertEqual(vol['attach_status'], "attached")
@@ -131,25 +126,26 @@ class VolumeTestCase(test.TrialTestCase):
         instance_ref = db.volume_get_instance(self.context, volume_id)
         self.assertEqual(instance_ref['id'], instance_id)
 
-        self.assertFailure(self.volume.delete_volume(self.context, volume_id),
-                           exception.Error)
+        self.assertRaises(exception.Error,
+                          self.volume.delete_volume,
+                          self.context,
+                          volume_id)
         if FLAGS.fake_tests:
             db.volume_detached(self.context, volume_id)
         else:
-            yield self.compute.detach_volume(self.context,
-                                             instance_id,
-                                             volume_id)
+            self.compute.detach_volume(self.context,
+                                       instance_id,
+                                       volume_id)
         vol = db.volume_get(self.context, volume_id)
         self.assertEqual(vol['status'], "available")
 
-        yield self.volume.delete_volume(self.context, volume_id)
+        self.volume.delete_volume(self.context, volume_id)
         self.assertRaises(exception.Error,
                           db.volume_get,
                           self.context,
                           volume_id)
         db.instance_destroy(self.context, instance_id)
 
-    @defer.inlineCallbacks
     def test_concurrent_volumes_get_different_targets(self):
         """Ensure multiple concurrent volumes get different targets."""
         volume_ids = []
@@ -164,15 +160,11 @@ class VolumeTestCase(test.TrialTestCase):
             self.assert_(iscsi_target not in targets)
             targets.append(iscsi_target)
             logging.debug("Target %s allocated", iscsi_target)
-        deferreds = []
         total_slots = FLAGS.iscsi_num_targets
         for _index in xrange(total_slots):
             volume_id = self._create_volume()
             d = self.volume.create_volume(self.context, volume_id)
-            d.addCallback(_check)
-            d.addErrback(self.fail)
-            deferreds.append(d)
-        yield defer.DeferredList(deferreds)
+            _check(d)
         for volume_id in volume_ids:
             self.volume.delete_volume(self.context, volume_id)
 
diff --git a/nova/twistd.py b/nova/twistd.py
index cb5648ce6..29be9c4e1 100644
--- a/nova/twistd.py
+++ b/nova/twistd.py
@@ -43,7 +43,7 @@ else:
 
 
 FLAGS = flags.FLAGS
-flags.DEFINE_string('logdir',  None, 'directory to keep log files in '
+flags.DEFINE_string('logdir', None, 'directory to keep log files in '
                                      '(will be prepended to $logfile)')
 
 
@@ -208,7 +208,7 @@ def stop(pidfile):
         pid = None
 
     if not pid:
-        message = "pidfile %s does not exist. Daemon not running?\n"
+        message = _("pidfile %s does not exist. Daemon not running?\n")
         sys.stderr.write(message % pidfile)
         # Not an error in a restart
         return
@@ -229,7 +229,7 @@ def stop(pidfile):
 
 
 def serve(filename):
-    logging.debug("Serving %s" % filename)
+    logging.debug(_("Serving %s") % filename)
     name = os.path.basename(filename)
     OptionsClass = WrapTwistedOptions(TwistdServerOptions)
     options = OptionsClass()
@@ -281,7 +281,7 @@ def serve(filename):
     else:
         logging.getLogger().setLevel(logging.WARNING)
 
-    logging.debug("Full set of FLAGS:")
+    logging.debug(_("Full set of FLAGS:"))
     for flag in FLAGS:
         logging.debug("%s : %s" % (flag, FLAGS.get(flag, None)))
 
diff --git a/nova/utils.py b/nova/utils.py
index 142584df8..b9045a50c 100644
--- a/nova/utils.py
+++ b/nova/utils.py
@@ -21,24 +21,24 @@ System-level utilities and helper functions.
 """
 
 import datetime
-import functools
 import inspect
 import logging
 import os
 import random
 import subprocess
 import socket
+import struct
 import sys
+import time
 from xml.sax import saxutils
 
-from twisted.internet.threads import deferToThread
+from eventlet import event
+from eventlet import greenthread
 
 from nova import exception
-from nova import flags
 from nova.exception import ProcessExecutionError
 
 
-FLAGS = flags.FLAGS
 TIME_FORMAT = "%Y-%m-%dT%H:%M:%SZ"
 
 
@@ -49,7 +49,7 @@ def import_class(import_str):
         __import__(mod_str)
         return getattr(sys.modules[mod_str], class_str)
     except (ImportError, ValueError, AttributeError):
-        raise exception.NotFound('Class %s cannot be found' % class_str)
+        raise exception.NotFound(_('Class %s cannot be found') % class_str)
 
 
 def import_object(import_str):
@@ -62,8 +62,53 @@ def import_object(import_str):
         return cls()
 
 
+def vpn_ping(address, port, timeout=0.05, session_id=None):
+    """Sends a vpn negotiation packet and returns the server session.
+
+    Returns False on a failure. Basic packet structure is below.
+
+    Client packet (14 bytes)::
+     0 1      8 9  13
+    +-+--------+-----+
+    |x| cli_id |?????|
+    +-+--------+-----+
+    x = packet identifier 0x38
+    cli_id = 64 bit identifier
+    ? = unknown, probably flags/padding
+
+    Server packet (26 bytes)::
+     0 1      8 9  13 14    21 2225
+    +-+--------+-----+--------+----+
+    |x| srv_id |?????| cli_id |????|
+    +-+--------+-----+--------+----+
+    x = packet identifier 0x40
+    cli_id = 64 bit identifier
+    ? = unknown, probably flags/padding
+    bit 9 was 1 and the rest were 0 in testing
+    """
+    if session_id is None:
+        session_id = random.randint(0, 0xffffffffffffffff)
+    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+    data = struct.pack("!BQxxxxxx", 0x38, session_id)
+    sock.sendto(data, (address, port))
+    sock.settimeout(timeout)
+    try:
+        received = sock.recv(2048)
+    except socket.timeout:
+        return False
+    finally:
+        sock.close()
+    fmt = "!BQxxxxxQxxxx"
+    if len(received) != struct.calcsize(fmt):
+        print struct.calcsize(fmt)
+        return False
+    (identifier, server_sess, client_sess) = struct.unpack(fmt, received)
+    if identifier == 0x40 and client_sess == session_id:
+        return server_sess
+
+
 def fetchfile(url, target):
-    logging.debug("Fetching %s" % url)
+    logging.debug(_("Fetching %s") % url)
 #    c = pycurl.Curl()
 #    fp = open(target, "wb")
 #    c.setopt(c.URL, url)
@@ -75,7 +120,7 @@ def fetchfile(url, target):
 
 
 def execute(cmd, process_input=None, addl_env=None, check_exit_code=True):
-    logging.debug("Running cmd: %s", cmd)
+    logging.debug(_("Running cmd (subprocess): %s"), cmd)
     env = os.environ.copy()
     if addl_env:
         env.update(addl_env)
@@ -88,13 +133,17 @@ def execute(cmd, process_input=None, addl_env=None, check_exit_code=True):
         result = obj.communicate()
     obj.stdin.close()
     if obj.returncode:
-        logging.debug("Result was %s" % (obj.returncode))
+        logging.debug(_("Result was %s") % (obj.returncode))
         if check_exit_code and obj.returncode != 0:
             (stdout, stderr) = result
             raise ProcessExecutionError(exit_code=obj.returncode,
                                         stdout=stdout,
                                         stderr=stderr,
                                         cmd=cmd)
+    # NOTE(termie): this appears to be necessary to let the subprocess call
+    #               clean something up in between calls, without it two
+    #               execute calls in a row hangs the second one
+    greenthread.sleep(0)
     return result
 
 
@@ -122,14 +171,8 @@ def debug(arg):
 
 
 def runthis(prompt, cmd, check_exit_code=True):
-    logging.debug("Running %s" % (cmd))
-    exit_code = subprocess.call(cmd.split(" "))
-    logging.debug(prompt % (exit_code))
-    if check_exit_code and exit_code != 0:
-        raise ProcessExecutionError(exit_code=exit_code,
-                                    stdout=None,
-                                    stderr=None,
-                                    cmd=cmd)
+    logging.debug(_("Running %s") % (cmd))
+    rv, err = execute(cmd, check_exit_code=check_exit_code)
 
 
 def generate_uid(topic, size=8):
@@ -152,8 +195,6 @@ def last_octet(address):
 
 def get_my_ip():
     """Returns the actual ip of the local machine."""
-    if getattr(FLAGS, 'fake_tests', None):
-        return '127.0.0.1'
     try:
         csock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
         csock.connect(('8.8.8.8', 80))
@@ -161,17 +202,55 @@ def get_my_ip():
         csock.close()
         return addr
     except socket.gaierror as ex:
-        logging.warn("Couldn't get IP, using 127.0.0.1 %s", ex)
+        logging.warn(_("Couldn't get IP, using 127.0.0.1 %s"), ex)
         return "127.0.0.1"
 
 
+def utcnow():
+    """Overridable version of datetime.datetime.utcnow."""
+    if utcnow.override_time:
+        return utcnow.override_time
+    return datetime.datetime.utcnow()
+
+
+utcnow.override_time = None
+
+
+def utcnow_ts():
+    """Timestamp version of our utcnow function."""
+    return time.mktime(utcnow().timetuple())
+
+
+def set_time_override(override_time=datetime.datetime.utcnow()):
+    """Override utils.utcnow to return a constant time."""
+    utcnow.override_time = override_time
+
+
+def advance_time_delta(timedelta):
+    """Advance overriden time using a datetime.timedelta."""
+    assert(not utcnow.override_time is None)
+    utcnow.override_time += timedelta
+
+
+def advance_time_seconds(seconds):
+    """Advance overriden time by seconds."""
+    advance_time_delta(datetime.timedelta(0, seconds))
+
+
+def clear_time_override():
+    """Remove the overridden time."""
+    utcnow.override_time = None
+
+
 def isotime(at=None):
+    """Returns iso formatted utcnow."""
     if not at:
-        at = datetime.datetime.utcnow()
+        at = utcnow()
     return at.strftime(TIME_FORMAT)
 
 
 def parse_isotime(timestr):
+    """Turn an iso formatted time back into a datetime"""
     return datetime.datetime.strptime(timestr, TIME_FORMAT)
 
 
@@ -205,7 +284,7 @@ class LazyPluggable(object):
         if not self.__backend:
             backend_name = self.__pivot.value
             if backend_name not in self.__backends:
-                raise exception.Error('Invalid backend: %s' % backend_name)
+                raise exception.Error(_('Invalid backend: %s') % backend_name)
 
             backend = self.__backends[backend_name]
             if type(backend) == type(tuple()):
@@ -224,10 +303,41 @@ class LazyPluggable(object):
         return getattr(backend, key)
 
 
-def deferredToThread(f):
-    def g(*args, **kwargs):
-        return deferToThread(f, *args, **kwargs)
-    return g
+class LoopingCall(object):
+    def __init__(self, f=None, *args, **kw):
+        self.args = args
+        self.kw = kw
+        self.f = f
+        self._running = False
+
+    def start(self, interval, now=True):
+        self._running = True
+        done = event.Event()
+
+        def _inner():
+            if not now:
+                greenthread.sleep(interval)
+            try:
+                while self._running:
+                    self.f(*self.args, **self.kw)
+                    greenthread.sleep(interval)
+            except Exception:
+                logging.exception('in looping call')
+                done.send_exception(*sys.exc_info())
+                return
+
+            done.send(True)
+
+        self.done = done
+
+        greenthread.spawn(_inner)
+        return self.done
+
+    def stop(self):
+        self._running = False
+
+    def wait(self):
+        return self.done.wait()
 
 
 def xhtml_escape(value):
diff --git a/nova/validate.py b/nova/validate.py
deleted file mode 100644
index 7ea27daa6..000000000
--- a/nova/validate.py
+++ /dev/null
@@ -1,94 +0,0 @@
-# vim: tabstop=4 shiftwidth=4 softtabstop=4
-
-# Copyright 2010 United States Government as represented by the
-# Administrator of the National Aeronautics and Space Administration.
-# All Rights Reserved.
-#
-#    Licensed under the Apache License, Version 2.0 (the "License"); you may
-#    not use this file except in compliance with the License. You may obtain
-#    a copy of the License at
-#
-#         http://www.apache.org/licenses/LICENSE-2.0
-#
-#    Unless required by applicable law or agreed to in writing, software
-#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-#    License for the specific language governing permissions and limitations
-#    under the License.
-
-"""Decorators for argument validation, courtesy of
-http://rmi.net/~lutz/rangetest.html"""
-
-
-def rangetest(**argchecks):
-    """Validate ranges for both + defaults"""
-
-    def onDecorator(func):
-        """onCall remembers func and argchecks"""
-        import sys
-        code = func.__code__ if sys.version_info[0] == 3 else func.func_code
-        allargs = code.co_varnames[:code.co_argcount]
-        funcname = func.__name__
-
-        def onCall(*pargs, **kargs):
-            # all pargs match first N args by position
-            # the rest must be in kargs or omitted defaults
-            positionals = list(allargs)
-            positionals = positionals[:len(pargs)]
-
-            for (argname, (low, high)) in argchecks.items():
-                # for all args to be checked
-                if argname in kargs:
-                    # was passed by name
-                    if float(kargs[argname]) < low or \
-                       float(kargs[argname]) > high:
-                        errmsg = '{0} argument "{1}" not in {2}..{3}'
-                        errmsg = errmsg.format(funcname, argname, low, high)
-                        raise TypeError(errmsg)
-
-                elif argname in positionals:
-                    # was passed by position
-                    position = positionals.index(argname)
-                    if float(pargs[position]) < low or \
-                       float(pargs[position]) > high:
-                        errmsg = '{0} argument "{1}" with value of {4} ' \
-                                 'not in {2}..{3}'
-                        errmsg = errmsg.format(funcname, argname, low, high,
-                                               pargs[position])
-                        raise TypeError(errmsg)
-                else:
-                    pass
-
-            return func(*pargs, **kargs)    # okay: run original call
-        return onCall
-    return onDecorator
-
-
-def typetest(**argchecks):
-    def onDecorator(func):
-        import sys
-        code = func.__code__ if sys.version_info[0] == 3 else func.func_code
-        allargs = code.co_varnames[:code.co_argcount]
-        funcname = func.__name__
-
-        def onCall(*pargs, **kargs):
-            positionals = list(allargs)[:len(pargs)]
-            for (argname, typeof) in argchecks.items():
-                if argname in kargs:
-                    if not isinstance(kargs[argname], typeof):
-                        errmsg = '{0} argument "{1}" not of type {2}'
-                        errmsg = errmsg.format(funcname, argname, typeof)
-                        raise TypeError(errmsg)
-                elif argname in positionals:
-                    position = positionals.index(argname)
-                    if not isinstance(pargs[position], typeof):
-                        errmsg = '{0} argument "{1}" with value of {2} ' \
-                                 'not of type {3}'
-                        errmsg = errmsg.format(funcname, argname,
-                                               pargs[position], typeof)
-                        raise TypeError(errmsg)
-                else:
-                    pass
-            return func(*pargs, **kargs)
-        return onCall
-    return onDecorator
diff --git a/nova/virt/connection.py b/nova/virt/connection.py
index c40bb4bb4..61e99944e 100644
--- a/nova/virt/connection.py
+++ b/nova/virt/connection.py
@@ -66,6 +66,6 @@ def get_connection(read_only=False):
         raise Exception('Unknown connection type "%s"' % t)
 
     if conn is None:
-        logging.error('Failed to open connection to the hypervisor')
+        logging.error(_('Failed to open connection to the hypervisor'))
         sys.exit(1)
     return conn
diff --git a/nova/virt/fake.py b/nova/virt/fake.py
index f855523d3..238acf798 100644
--- a/nova/virt/fake.py
+++ b/nova/virt/fake.py
@@ -25,8 +25,6 @@ semantics of real hypervisor connections.
 
 """
 
-from twisted.internet import defer
-
 from nova import exception
 from nova.compute import power_state
 
@@ -78,6 +76,12 @@ class FakeConnection(object):
             cls._instance = cls()
         return cls._instance
 
+    def init_host(self):
+        """
+        Initialize anything that is necessary for the driver to function
+        """
+        return
+
     def list_instances(self):
         """
         Return the names of all the instances known to the virtualization
@@ -107,7 +111,6 @@ class FakeConnection(object):
         fake_instance = FakeInstance()
         self.instances[instance.name] = fake_instance
         fake_instance._state = power_state.RUNNING
-        return defer.succeed(None)
 
     def reboot(self, instance):
         """
@@ -119,19 +122,31 @@ class FakeConnection(object):
         The work will be done asynchronously.  This function returns a
         Deferred that allows the caller to detect when it is complete.
         """
-        return defer.succeed(None)
+        pass
 
     def rescue(self, instance):
         """
         Rescue the specified instance.
         """
-        return defer.succeed(None)
+        pass
 
     def unrescue(self, instance):
         """
         Unrescue the specified instance.
         """
-        return defer.succeed(None)
+        pass
+
+    def pause(self, instance, callback):
+        """
+        Pause the specified instance.
+        """
+        pass
+
+    def unpause(self, instance, callback):
+        """
+        Unpause the specified instance.
+        """
+        pass
 
     def destroy(self, instance):
         """
@@ -144,7 +159,6 @@ class FakeConnection(object):
         Deferred that allows the caller to detect when it is complete.
         """
         del self.instances[instance.name]
-        return defer.succeed(None)
 
     def attach_volume(self, instance_name, device_path, mountpoint):
         """Attach the disk at device_path to the instance at mountpoint"""
@@ -167,7 +181,8 @@ class FakeConnection(object):
         knowledge of the instance
         """
         if instance_name not in self.instances:
-            raise exception.NotFound("Instance %s Not Found" % instance_name)
+            raise exception.NotFound(_("Instance %s Not Found")
+                                     % instance_name)
         i = self.instances[instance_name]
         return {'state': i._state,
                 'max_mem': 0,
@@ -247,5 +262,6 @@ class FakeConnection(object):
 
 
 class FakeInstance(object):
+
     def __init__(self):
         self._state = power_state.NOSTATE
diff --git a/nova/virt/images.py b/nova/virt/images.py
index 981aa5cf3..1c9b2e093 100644
--- a/nova/virt/images.py
+++ b/nova/virt/images.py
@@ -26,7 +26,7 @@ import time
 import urlparse
 
 from nova import flags
-from nova import process
+from nova import utils
 from nova.auth import manager
 from nova.auth import signer
 from nova.objectstore import image
@@ -50,7 +50,7 @@ def _fetch_s3_image(image, path, user, project):
 
     # This should probably move somewhere else, like e.g. a download_as
     # method on User objects and at the same time get rewritten to use
-    # twisted web client.
+    # a web client.
     headers = {}
     headers['Date'] = time.strftime("%a, %d %b %Y %H:%M:%S GMT", time.gmtime())
 
@@ -63,15 +63,16 @@ def _fetch_s3_image(image, path, user, project):
 
     cmd = ['/usr/bin/curl', '--fail', '--silent', url]
     for (k, v) in headers.iteritems():
-        cmd += ['-H', '%s: %s' % (k, v)]
+        cmd += ['-H', '"%s: %s"' % (k, v)]
 
     cmd += ['-o', path]
-    return process.SharedPool().execute(executable=cmd[0], args=cmd[1:])
+    cmd_out = ' '.join(cmd)
+    return utils.execute(cmd_out)
 
 
 def _fetch_local_image(image, path, user, project):
     source = _image_path('%s/image' % image)
-    return process.simple_execute('cp %s %s' % (source, path))
+    return utils.execute('cp %s %s' % (source, path))
 
 
 def _image_path(path):
diff --git a/nova/virt/libvirt.qemu.xml.template b/nova/virt/libvirt.qemu.xml.template
deleted file mode 100644
index 2538b1ade..000000000
--- a/nova/virt/libvirt.qemu.xml.template
+++ /dev/null
@@ -1,33 +0,0 @@
-<domain type='%(type)s'>
-    <name>%(name)s</name>
-    <os>
-        <type>hvm</type>
-        <kernel>%(basepath)s/kernel</kernel>
-        <initrd>%(basepath)s/ramdisk</initrd>
-        <cmdline>root=/dev/vda1 console=ttyS0</cmdline>
-    </os>
-    <features>
-        <acpi/>
-    </features>
-    <memory>%(memory_kb)s</memory>
-    <vcpu>%(vcpus)s</vcpu>
-    <devices>
-        <disk type='file'>
-            <source file='%(basepath)s/disk'/>
-            <target dev='vda' bus='virtio'/>
-        </disk>
-        <interface type='bridge'>
-            <source bridge='%(bridge_name)s'/>
-            <mac address='%(mac_address)s'/>
-            <!--   <model type='virtio'/>  CANT RUN virtio network right now -->
-            <filterref filter="nova-instance-%(name)s">
-                <parameter name="IP" value="%(ip_address)s" />
-                <parameter name="DHCPSERVER" value="%(dhcp_server)s" />
-            </filterref>
-        </interface>
-        <serial type="file">
-            <source path='%(basepath)s/console.log'/>
-            <target port='1'/>
-        </serial>
-    </devices>
-</domain>
diff --git a/nova/virt/libvirt.rescue.qemu.xml.template b/nova/virt/libvirt.rescue.qemu.xml.template.THIS
index c0ffbdcee..a3b88106c 100644
--- a/nova/virt/libvirt.rescue.qemu.xml.template
+++ b/nova/virt/libvirt.rescue.qemu.xml.template.THIS
@@ -27,6 +27,7 @@
             <filterref filter="nova-instance-%(name)s">
                 <parameter name="IP" value="%(ip_address)s" />
                 <parameter name="DHCPSERVER" value="%(dhcp_server)s" />
+                %(extra_params)s
             </filterref>
         </interface>
         <serial type="file">
diff --git a/nova/virt/libvirt.rescue.uml.xml.template b/nova/virt/libvirt.rescue.uml.xml.template
deleted file mode 100644
index 836f47532..000000000
--- a/nova/virt/libvirt.rescue.uml.xml.template
+++ /dev/null
@@ -1,26 +0,0 @@
-<domain type='%(type)s'>
-    <name>%(name)s</name>
-    <memory>%(memory_kb)s</memory>
-    <os>
-        <type>%(type)s</type>
-        <kernel>/usr/bin/linux</kernel>
-        <root>/dev/ubda1</root>
-    </os>
-    <devices>
-        <disk type='file'>
-            <source file='%(basepath)s/rescue-disk'/>
-            <target dev='ubd0' bus='uml'/>
-        </disk>
-        <disk type='file'>
-            <source file='%(basepath)s/disk'/>
-            <target dev='ubd1' bus='uml'/>
-        </disk>
-        <interface type='bridge'>
-            <source bridge='%(bridge_name)s'/>
-            <mac address='%(mac_address)s'/>
-        </interface>
-        <console type="file">
-            <source path='%(basepath)s/console.log'/>
-        </console>
-    </devices>
-</domain>
diff --git a/nova/virt/libvirt.uml.xml.template b/nova/virt/libvirt.rescue.uml.xml.template.THIS
index bb8b47911..a254692d4 100644
--- a/nova/virt/libvirt.uml.xml.template
+++ b/nova/virt/libvirt.rescue.uml.xml.template.THIS
@@ -8,15 +8,20 @@
     </os>
     <devices>
         <disk type='file'>
-            <source file='%(basepath)s/disk'/>
+            <source file='%(basepath)s/rescue-disk'/>
             <target dev='ubd0' bus='uml'/>
         </disk>
+        <disk type='file'>
+            <source file='%(basepath)s/disk'/>
+            <target dev='ubd1' bus='uml'/>
+        </disk>
         <interface type='bridge'>
             <source bridge='%(bridge_name)s'/>
             <mac address='%(mac_address)s'/>
             <filterref filter="nova-instance-%(name)s">
                 <parameter name="IP" value="%(ip_address)s" />
                 <parameter name="DHCPSERVER" value="%(dhcp_server)s" />
+                %(extra_params)s
             </filterref>
         </interface>
         <console type="file">
diff --git a/nova/virt/libvirt.rescue.xen.xml.template b/nova/virt/libvirt.rescue.xen.xml.template
deleted file mode 100644
index 3b8d27237..000000000
--- a/nova/virt/libvirt.rescue.xen.xml.template
+++ /dev/null
@@ -1,34 +0,0 @@
-<domain type='%(type)s'>
-    <name>%(name)s</name>
-    <os>
-        <type>linux</type>
-        <kernel>%(basepath)s/kernel</kernel>
-        <initrd>%(basepath)s/ramdisk</initrd>
-        <root>/dev/xvda1</root>
-        <cmdline>ro</cmdline>
-    </os>
-    <features>
-        <acpi/>
-    </features>
-    <memory>%(memory_kb)s</memory>
-    <vcpu>%(vcpus)s</vcpu>
-    <devices>
-        <disk type='file'>
-            <source file='%(basepath)s/rescue-disk'/>
-            <target dev='sda' />
-        </disk>
-        <disk type='file'>
-            <source file='%(basepath)s/disk'/>
-            <target dev='sdb' />
-        </disk>
-        <interface type='bridge'>
-            <source bridge='%(bridge_name)s'/>
-            <mac address='%(mac_address)s'/>
-        </interface>
-        <console type="file">
-            <source path='%(basepath)s/console.log'/>
-            <target port='1'/>
-        </console>
-    </devices>
-</domain>
-
diff --git a/nova/virt/libvirt.xen.xml.template b/nova/virt/libvirt.xen.xml.template
deleted file mode 100644
index 9677902c6..000000000
--- a/nova/virt/libvirt.xen.xml.template
+++ /dev/null
@@ -1,30 +0,0 @@
-<domain type='%(type)s'>
-    <name>%(name)s</name>
-    <os>
-        <type>linux</type>
-        <kernel>%(basepath)s/kernel</kernel>
-        <initrd>%(basepath)s/ramdisk</initrd>
-        <root>/dev/xvda1</root>
-        <cmdline>ro</cmdline>
-    </os>
-    <features>
-        <acpi/>
-    </features>
-    <memory>%(memory_kb)s</memory>
-    <vcpu>%(vcpus)s</vcpu>
-    <devices>
-        <disk type='file'>
-            <source file='%(basepath)s/disk'/>
-            <target dev='sda' />
-        </disk>
-        <interface type='bridge'>
-            <source bridge='%(bridge_name)s'/>
-            <mac address='%(mac_address)s'/>
-        </interface>
-        <console type="file">
-            <source path='%(basepath)s/console.log'/>
-            <target port='1'/>
-        </console>
-    </devices>
-</domain>
-
diff --git a/nova/virt/libvirt.xml.template b/nova/virt/libvirt.xml.template
new file mode 100644
index 000000000..3fb2243da
--- /dev/null
+++ b/nova/virt/libvirt.xml.template
@@ -0,0 +1,79 @@
+<domain type='${type}'>
+    <name>${name}</name>
+    <memory>${memory_kb}</memory>
+    <os>
+#if $type == 'uml'
+    #set $disk_prefix = 'ubd'
+    #set $disk_bus = 'uml'
+        <type>uml</type>
+        <kernel>/usr/bin/linux</kernel>
+        <root>/dev/ubda1</root>
+#else
+    #if $type == 'xen'
+        #set $disk_prefix = 'sd'
+        #set $disk_bus = 'scsi'
+            <type>linux</type>
+            <root>/dev/xvda1</root>
+    #else
+        #set $disk_prefix = 'vd'
+        #set $disk_bus = 'virtio'
+            <type>hvm</type>
+	#end if
+    #if $getVar('rescue', False)
+        <kernel>${basepath}/rescue-kernel</kernel>
+        <initrd>${basepath}/rescue-ramdisk</initrd>
+    #else
+        #if $getVar('kernel', None)
+            <kernel>${kernel}</kernel>
+            #if $type == 'xen'
+                <cmdline>ro</cmdline>
+            #else
+                <cmdline>root=/dev/vda1 console=ttyS0</cmdline>
+            #end if
+            #if $getVar('ramdisk', None)
+                <initrd>${ramdisk}</initrd>
+            #end if
+        #else
+            <boot dev="hd" />
+        #end if
+    #end if
+#end if
+    </os>
+    <features>
+        <acpi/>
+    </features>
+    <vcpu>${vcpus}</vcpu>
+    <devices>
+#if $getVar('rescue', False)
+        <disk type='file'>
+            <source file='${basepath}/rescue-disk'/>
+            <target dev='${disk_prefix}a' bus='${disk_bus}'/>
+        </disk>
+        <disk type='file'>
+            <source file='${basepath}/disk'/>
+            <target dev='${disk_prefix}b' bus='${disk_bus}'/>
+        </disk>
+#else
+        <disk type='file'>
+            <source file='${basepath}/disk'/>
+            <target dev='${disk_prefix}a' bus='${disk_bus}'/>
+        </disk>
+#end if
+        <interface type='bridge'>
+            <source bridge='${bridge_name}'/>
+            <mac address='${mac_address}'/>
+            <!--   <model type='virtio'/>  CANT RUN virtio network right now -->
+            <filterref filter="nova-instance-${name}">
+                <parameter name="IP" value="${ip_address}" />
+                <parameter name="DHCPSERVER" value="${dhcp_server}" />
+#if $getVar('extra_params', False)
+                ${extra_params}
+#end if
+            </filterref>
+        </interface>
+        <serial type="file">
+            <source path='${basepath}/console.log'/>
+            <target port='1'/>
+        </serial>
+    </devices>
+</domain>
diff --git a/nova/virt/libvirt_conn.py b/nova/virt/libvirt_conn.py
index 18085089f..8d3a6a261 100644
--- a/nova/virt/libvirt_conn.py
+++ b/nova/virt/libvirt_conn.py
@@ -27,12 +27,7 @@ Supports KVM, QEMU, UML, and XEN.
 :libvirt_type:  Libvirt domain type.  Can be kvm, qemu, uml, xen
                 (default: kvm).
 :libvirt_uri:  Override for the default libvirt URI (depends on libvirt_type).
-:libvirt_xml_template:  Libvirt XML Template (QEmu/KVM).
-:libvirt_xen_xml_template:  Libvirt XML Template (Xen).
-:libvirt_uml_xml_template:  Libvirt XML Template (User Mode Linux).
-:libvirt_rescue_xml_template:  XML template for rescue mode (KVM & QEMU).
-:libvirt_rescue_xen_xml_template:  XML templage for rescue mode (XEN).
-:libvirt_rescue_uml_xml_template:  XML template for rescue mode (UML).
+:libvirt_xml_template:  Libvirt XML Template.
 :rescue_image_id:  Rescue ami image (default: ami-rescue).
 :rescue_kernel_id:  Rescue aki image (default: aki-rescue).
 :rescue_ramdisk_id:  Rescue ari image (default: ari-rescue).
@@ -45,16 +40,16 @@ import logging
 import os
 import shutil
 
+from eventlet import greenthread
+from eventlet import event
+from eventlet import tpool
+
 import IPy
-from twisted.internet import defer
-from twisted.internet import task
-from twisted.internet import threads
 
 from nova import context
 from nova import db
 from nova import exception
 from nova import flags
-from nova import process
 from nova import utils
 #from nova.api import context
 from nova.auth import manager
@@ -63,36 +58,20 @@ from nova.compute import instance_types
 from nova.compute import power_state
 from nova.virt import images
 
+from Cheetah.Template import Template
+
 libvirt = None
 libxml2 = None
 
 
 FLAGS = flags.FLAGS
-flags.DEFINE_string('libvirt_rescue_xml_template',
-                    utils.abspath('virt/libvirt.rescue.qemu.xml.template'),
-                    'Libvirt RESCUE XML Template for QEmu/KVM')
-flags.DEFINE_string('libvirt_rescue_xen_xml_template',
-                    utils.abspath('virt/libvirt.rescue.xen.xml.template'),
-                    'Libvirt RESCUE XML Template for xen')
-flags.DEFINE_string('libvirt_rescue_uml_xml_template',
-                    utils.abspath('virt/libvirt.rescue.uml.xml.template'),
-                    'Libvirt RESCUE XML Template for user-mode-linux')
 # TODO(vish): These flags should probably go into a shared location
 flags.DEFINE_string('rescue_image_id', 'ami-rescue', 'Rescue ami image')
 flags.DEFINE_string('rescue_kernel_id', 'aki-rescue', 'Rescue aki image')
 flags.DEFINE_string('rescue_ramdisk_id', 'ari-rescue', 'Rescue ari image')
 flags.DEFINE_string('libvirt_xml_template',
-                    utils.abspath('virt/libvirt.qemu.xml.template'),
-                    'Libvirt XML Template for QEmu/KVM')
-flags.DEFINE_string('libvirt_xen_xml_template',
-                    utils.abspath('virt/libvirt.xen.xml.template'),
-                    'Libvirt XML Template for Xen')
-flags.DEFINE_string('libvirt_uml_xml_template',
-                    utils.abspath('virt/libvirt.uml.xml.template'),
-                    'Libvirt XML Template for user-mode-linux')
-flags.DEFINE_string('injected_network_template',
-                    utils.abspath('virt/interfaces.template'),
-                    'Template file for injected network')
+                    utils.abspath('virt/libvirt.xml.template'),
+                    'Libvirt XML Template')
 flags.DEFINE_string('libvirt_type',
                     'kvm',
                     'Libvirt domain type (valid options are: '
@@ -118,21 +97,27 @@ def get_connection(read_only):
     return LibvirtConnection(read_only)
 
 
+def _get_net_and_mask(cidr):
+    net = IPy.IP(cidr)
+    return str(net.net()), str(net.netmask())
+
+
 class LibvirtConnection(object):
+
     def __init__(self, read_only):
-        (self.libvirt_uri,
-         template_file,
-         rescue_file) = self.get_uri_and_templates()
+        self.libvirt_uri = self.get_uri()
 
-        self.libvirt_xml = open(template_file).read()
-        self.rescue_xml = open(rescue_file).read()
+        self.libvirt_xml = open(FLAGS.libvirt_xml_template).read()
         self._wrapped_conn = None
         self.read_only = read_only
 
+    def init_host(self):
+        NWFilterFirewall(self._conn).setup_base_nwfilters()
+
     @property
     def _conn(self):
         if not self._wrapped_conn or not self._test_connection():
-            logging.debug('Connecting to libvirt: %s' % self.libvirt_uri)
+            logging.debug(_('Connecting to libvirt: %s') % self.libvirt_uri)
             self._wrapped_conn = self._connect(self.libvirt_uri,
                                                self.read_only)
         return self._wrapped_conn
@@ -144,24 +129,18 @@ class LibvirtConnection(object):
         except libvirt.libvirtError as e:
             if e.get_error_code() == libvirt.VIR_ERR_SYSTEM_ERROR and \
                e.get_error_domain() == libvirt.VIR_FROM_REMOTE:
-                logging.debug('Connection to libvirt broke')
+                logging.debug(_('Connection to libvirt broke'))
                 return False
             raise
 
-    def get_uri_and_templates(self):
+    def get_uri(self):
         if FLAGS.libvirt_type == 'uml':
             uri = FLAGS.libvirt_uri or 'uml:///system'
-            template_file = FLAGS.libvirt_uml_xml_template
-            rescue_file = FLAGS.libvirt_rescue_uml_xml_template
         elif FLAGS.libvirt_type == 'xen':
             uri = FLAGS.libvirt_uri or 'xen:///'
-            template_file = FLAGS.libvirt_xen_xml_template
-            rescue_file = FLAGS.libvirt_rescue_xen_xml_template
         else:
             uri = FLAGS.libvirt_uri or 'qemu:///system'
-            template_file = FLAGS.libvirt_xml_template
-            rescue_file = FLAGS.libvirt_rescue_xml_template
-        return uri, template_file, rescue_file
+        return uri
 
     def _connect(self, uri, read_only):
         auth = [[libvirt.VIR_CRED_AUTHNAME, libvirt.VIR_CRED_NOECHOPROMPT],
@@ -184,14 +163,12 @@ class LibvirtConnection(object):
         except Exception as _err:
             pass
             # If the instance is already terminated, we're still happy
-        d = defer.Deferred()
-        if cleanup:
-            d.addCallback(lambda _: self._cleanup(instance))
-        # FIXME: What does this comment mean?
-        # TODO(termie): short-circuit me for tests
-        # WE'LL save this for when we do shutdown,
+
+        done = event.Event()
+
+        # We'll save this for when we do shutdown,
         # instead of destroy - but destroy returns immediately
-        timer = task.LoopingCall(f=None)
+        timer = utils.LoopingCall(f=None)
 
         def _wait_for_shutdown():
             try:
@@ -200,26 +177,34 @@ class LibvirtConnection(object):
                                       instance['id'], state)
                 if state == power_state.SHUTDOWN:
                     timer.stop()
-                    d.callback(None)
             except Exception:
                 db.instance_set_state(context.get_admin_context(),
                                       instance['id'],
                                       power_state.SHUTDOWN)
                 timer.stop()
-                d.callback(None)
 
         timer.f = _wait_for_shutdown
-        timer.start(interval=0.5, now=True)
-        return d
+        timer_done = timer.start(interval=0.5, now=True)
+
+        # NOTE(termie): this is strictly superfluous (we could put the
+        #               cleanup code in the timer), but this emulates the
+        #               previous model so I am keeping it around until
+        #               everything has been vetted a bit
+        def _wait_for_timer():
+            timer_done.wait()
+            self._cleanup(instance)
+            done.send()
+
+        greenthread.spawn(_wait_for_timer)
+        return done
 
     def _cleanup(self, instance):
         target = os.path.join(FLAGS.instances_path, instance['name'])
-        logging.info('instance %s: deleting instance files %s',
+        logging.info(_('instance %s: deleting instance files %s'),
             instance['name'], target)
         if os.path.exists(target):
             shutil.rmtree(target)
 
-    @defer.inlineCallbacks
     @exception.wrap_exception
     def attach_volume(self, instance_name, device_path, mountpoint):
         virt_dom = self._conn.lookupByName(instance_name)
@@ -230,7 +215,6 @@ class LibvirtConnection(object):
                      <target dev='%s' bus='virtio'/>
                  </disk>""" % (device_path, mount_device)
         virt_dom.attachDevice(xml)
-        yield
 
     def _get_disk_xml(self, xml, device):
         """Returns the xml for the disk mounted at device"""
@@ -252,26 +236,21 @@ class LibvirtConnection(object):
             if doc != None:
                 doc.freeDoc()
 
-    @defer.inlineCallbacks
     @exception.wrap_exception
     def detach_volume(self, instance_name, mountpoint):
         virt_dom = self._conn.lookupByName(instance_name)
         mount_device = mountpoint.rpartition("/")[2]
         xml = self._get_disk_xml(virt_dom.XMLDesc(0), mount_device)
         if not xml:
-            raise exception.NotFound("No disk at %s" % mount_device)
+            raise exception.NotFound(_("No disk at %s") % mount_device)
         virt_dom.detachDevice(xml)
-        yield
 
-    @defer.inlineCallbacks
     @exception.wrap_exception
     def reboot(self, instance):
-        yield self.destroy(instance, False)
+        self.destroy(instance, False)
         xml = self.to_xml(instance)
-        yield self._conn.createXML(xml, 0)
-
-        d = defer.Deferred()
-        timer = task.LoopingCall(f=None)
+        self._conn.createXML(xml, 0)
+        timer = utils.LoopingCall(f=None)
 
         def _wait_for_reboot():
             try:
@@ -279,64 +258,62 @@ class LibvirtConnection(object):
                 db.instance_set_state(context.get_admin_context(),
                                       instance['id'], state)
                 if state == power_state.RUNNING:
-                    logging.debug('instance %s: rebooted', instance['name'])
+                    logging.debug(_('instance %s: rebooted'), instance['name'])
                     timer.stop()
-                    d.callback(None)
             except Exception, exn:
-                logging.error('_wait_for_reboot failed: %s', exn)
+                logging.error(_('_wait_for_reboot failed: %s'), exn)
                 db.instance_set_state(context.get_admin_context(),
                                       instance['id'],
                                       power_state.SHUTDOWN)
                 timer.stop()
-                d.callback(None)
 
         timer.f = _wait_for_reboot
-        timer.start(interval=0.5, now=True)
-        yield d
+        return timer.start(interval=0.5, now=True)
+
+    @exception.wrap_exception
+    def pause(self, instance, callback):
+        raise exception.APIError("pause not supported for libvirt.")
+
+    @exception.wrap_exception
+    def unpause(self, instance, callback):
+        raise exception.APIError("unpause not supported for libvirt.")
 
-    @defer.inlineCallbacks
     @exception.wrap_exception
     def rescue(self, instance):
-        yield self.destroy(instance, False)
+        self.destroy(instance, False)
 
         xml = self.to_xml(instance, rescue=True)
         rescue_images = {'image_id': FLAGS.rescue_image_id,
                          'kernel_id': FLAGS.rescue_kernel_id,
                          'ramdisk_id': FLAGS.rescue_ramdisk_id}
-        yield self._create_image(instance, xml, 'rescue-', rescue_images)
-        yield self._conn.createXML(xml, 0)
+        self._create_image(instance, xml, 'rescue-', rescue_images)
+        self._conn.createXML(xml, 0)
 
-        d = defer.Deferred()
-        timer = task.LoopingCall(f=None)
+        timer = utils.LoopingCall(f=None)
 
         def _wait_for_rescue():
             try:
                 state = self.get_info(instance['name'])['state']
                 db.instance_set_state(None, instance['id'], state)
                 if state == power_state.RUNNING:
-                    logging.debug('instance %s: rescued', instance['name'])
+                    logging.debug(_('instance %s: rescued'), instance['name'])
                     timer.stop()
-                    d.callback(None)
             except Exception, exn:
-                logging.error('_wait_for_rescue failed: %s', exn)
+                logging.error(_('_wait_for_rescue failed: %s'), exn)
                 db.instance_set_state(None,
                                       instance['id'],
                                       power_state.SHUTDOWN)
                 timer.stop()
-                d.callback(None)
 
         timer.f = _wait_for_rescue
-        timer.start(interval=0.5, now=True)
-        yield d
+        return timer.start(interval=0.5, now=True)
 
-    @defer.inlineCallbacks
     @exception.wrap_exception
     def unrescue(self, instance):
         # NOTE(vish): Because reboot destroys and recreates an instance using
         #             the normal xml file, we can just call reboot here
-        yield self.reboot(instance)
+        self.reboot(instance)
 
-    @defer.inlineCallbacks
     @exception.wrap_exception
     def spawn(self, instance):
         xml = self.to_xml(instance)
@@ -344,14 +321,12 @@ class LibvirtConnection(object):
                               instance['id'],
                               power_state.NOSTATE,
                               'launching')
-        yield NWFilterFirewall(self._conn).\
-              setup_nwfilters_for_instance(instance)
-        yield self._create_image(instance, xml)
-        yield self._conn.createXML(xml, 0)
-        logging.debug("instance %s: is running", instance['name'])
+        NWFilterFirewall(self._conn).setup_nwfilters_for_instance(instance)
+        self._create_image(instance, xml)
+        self._conn.createXML(xml, 0)
+        logging.debug(_("instance %s: is running"), instance['name'])
 
-        local_d = defer.Deferred()
-        timer = task.LoopingCall(f=None)
+        timer = utils.LoopingCall(f=None)
 
         def _wait_for_boot():
             try:
@@ -359,36 +334,33 @@ class LibvirtConnection(object):
                 db.instance_set_state(context.get_admin_context(),
                                       instance['id'], state)
                 if state == power_state.RUNNING:
-                    logging.debug('instance %s: booted', instance['name'])
+                    logging.debug(_('instance %s: booted'), instance['name'])
                     timer.stop()
-                    local_d.callback(None)
             except:
-                logging.exception('instance %s: failed to boot',
+                logging.exception(_('instance %s: failed to boot'),
                                   instance['name'])
                 db.instance_set_state(context.get_admin_context(),
                                       instance['id'],
                                       power_state.SHUTDOWN)
                 timer.stop()
-                local_d.callback(None)
+
         timer.f = _wait_for_boot
-        timer.start(interval=0.5, now=True)
-        yield local_d
+        return timer.start(interval=0.5, now=True)
 
     def _flush_xen_console(self, virsh_output):
         logging.info('virsh said: %r' % (virsh_output,))
         virsh_output = virsh_output[0].strip()
 
         if virsh_output.startswith('/dev/'):
-            logging.info('cool, it\'s a device')
-            d = process.simple_execute("sudo dd if=%s iflag=nonblock" %
-                                       virsh_output, check_exit_code=False)
-            d.addCallback(lambda r: r[0])
-            return d
+            logging.info(_('cool, it\'s a device'))
+            out, err = utils.execute("sudo dd if=%s iflag=nonblock" %
+                                     virsh_output, check_exit_code=False)
+            return out
         else:
             return ''
 
     def _append_to_file(self, data, fpath):
-        logging.info('data: %r, fpath: %r' % (data, fpath))
+        logging.info(_('data: %r, fpath: %r') % (data, fpath))
         fp = open(fpath, 'a+')
         fp.write(data)
         return fpath
@@ -403,21 +375,20 @@ class LibvirtConnection(object):
     def get_console_output(self, instance):
         console_log = os.path.join(FLAGS.instances_path, instance['name'],
                                    'console.log')
-        d = process.simple_execute('sudo chown %d %s' % (os.getuid(),
-                                   console_log))
+
+        utils.execute('sudo chown %d %s' % (os.getuid(), console_log))
+
         if FLAGS.libvirt_type == 'xen':
-            # Xen is spethial
-            d.addCallback(lambda _:
-                process.simple_execute("virsh ttyconsole %s" %
-                                       instance['name']))
-            d.addCallback(self._flush_xen_console)
-            d.addCallback(self._append_to_file, console_log)
+            # Xen is special
+            virsh_output = utils.execute("virsh ttyconsole %s" %
+                                         instance['name'])
+            data = self._flush_xen_console(virsh_output)
+            fpath = self._append_to_file(data, console_log)
         else:
-            d.addCallback(lambda _: defer.succeed(console_log))
-        d.addCallback(self._dump_file)
-        return d
+            fpath = console_log
+
+        return self._dump_file(fpath)
 
-    @defer.inlineCallbacks
     def _create_image(self, inst, libvirt_xml, prefix='', disk_images=None):
         # syntactic nicety
         basepath = lambda fname = '', prefix = prefix: os.path.join(
@@ -426,12 +397,12 @@ class LibvirtConnection(object):
                                                  prefix + fname)
 
         # ensure directories exist and are writable
-        yield process.simple_execute('mkdir -p %s' % basepath(prefix=''))
-        yield process.simple_execute('chmod 0777 %s' % basepath(prefix=''))
+        utils.execute('mkdir -p %s' % basepath(prefix=''))
+        utils.execute('chmod 0777 %s' % basepath(prefix=''))
 
         # TODO(termie): these are blocking calls, it would be great
         #               if they weren't.
-        logging.info('instance %s: Creating image', inst['name'])
+        logging.info(_('instance %s: Creating image'), inst['name'])
         f = open(basepath('libvirt.xml'), 'w')
         f.write(libvirt_xml)
         f.close()
@@ -448,19 +419,29 @@ class LibvirtConnection(object):
                            'kernel_id': inst['kernel_id'],
                            'ramdisk_id': inst['ramdisk_id']}
         if not os.path.exists(basepath('disk')):
-            yield images.fetch(inst.image_id, basepath('disk-raw'), user,
-                               project)
-        if not os.path.exists(basepath('kernel')):
-            yield images.fetch(inst.kernel_id, basepath('kernel'), user,
-                               project)
-        if not os.path.exists(basepath('ramdisk')):
-            yield images.fetch(inst.ramdisk_id, basepath('ramdisk'), user,
-                               project)
-
-        execute = lambda cmd, process_input = None, check_exit_code = True: \
-                  process.simple_execute(cmd=cmd,
-                                         process_input=process_input,
-                                         check_exit_code=check_exit_code)
+            images.fetch(inst.image_id, basepath('disk-raw'), user,
+                         project)
+
+        if inst['kernel_id']:
+            if not os.path.exists(basepath('kernel')):
+                images.fetch(inst['kernel_id'], basepath('kernel'),
+                             user, project)
+            if inst['ramdisk_id']:
+                if not os.path.exists(basepath('ramdisk')):
+                    images.fetch(inst['ramdisk_id'], basepath('ramdisk'),
+                                 user, project)
+
+        def execute(cmd, process_input=None, check_exit_code=True):
+            return utils.execute(cmd=cmd,
+                                 process_input=process_input,
+                                 check_exit_code=check_exit_code)
+
+        # For now, we assume that if we're not using a kernel, we're using a
+        # partitioned disk image where the target partition is the first
+        # partition
+        target_partition = None
+        if not inst['kernel_id']:
+            target_partition = "1"
 
         key = str(inst['key_data'])
         net = None
@@ -477,16 +458,24 @@ class LibvirtConnection(object):
                                   'dns': network_ref['dns']}
         if key or net:
             if key:
-                logging.info('instance %s: injecting key into image %s',
+                logging.info(_('instance %s: injecting key into image %s'),
                     inst['name'], inst.image_id)
             if net:
-                logging.info('instance %s: injecting net into image %s',
-                    inst['name'], inst.image_id)
-            yield disk.inject_data(basepath('disk-raw'), key, net,
-                                   execute=execute)
-
-        if os.path.exists(basepath('disk')):
-            yield process.simple_execute('rm -f %s' % basepath('disk'))
+                logging.info(_('instance %s: injecting net into image %s'),
+                             inst['name'], inst.image_id)
+            try:
+                disk.inject_data(basepath('disk-raw'), key, net,
+                                 partition=target_partition,
+                                 execute=execute)
+            except Exception as e:
+                # This could be a windows image, or a vmdk format disk
+                logging.warn(_('instance %s: ignoring error injecting data'
+                               ' into image %s (%s)'),
+                             inst['name'], inst.image_id, e)
+
+        if inst['kernel_id']:
+            if os.path.exists(basepath('disk')):
+                utils.execute('rm -f %s' % basepath('disk'))
 
         local_bytes = (instance_types.INSTANCE_TYPES[inst.instance_type]
                                                     ['local_gb']
@@ -495,18 +484,23 @@ class LibvirtConnection(object):
         resize = True
         if inst['instance_type'] == 'm1.tiny' or prefix == 'rescue-':
             resize = False
-        yield disk.partition(basepath('disk-raw'), basepath('disk'),
-                             local_bytes, resize, execute=execute)
+
+        if inst['kernel_id']:
+            disk.partition(basepath('disk-raw'), basepath('disk'),
+                           local_bytes, resize, execute=execute)
+        else:
+            os.rename(basepath('disk-raw'), basepath('disk'))
+            disk.extend(basepath('disk'), local_bytes, execute=execute)
 
         if FLAGS.libvirt_type == 'uml':
-            yield process.simple_execute('sudo chown root %s' %
-                                         basepath('disk'))
+            utils.execute('sudo chown root %s' % basepath('disk'))
 
     def to_xml(self, instance, rescue=False):
         # TODO(termie): cache?
-        logging.debug('instance %s: starting toXML method', instance['name'])
-        network = db.project_get_network(context.get_admin_context(),
-                                         instance['project_id'])
+        logging.debug(_('instance %s: starting toXML method'),
+                        instance['name'])
+        network = db.network_get_by_instance(context.get_admin_context(),
+                                             instance['id'])
         # FIXME(vish): stick this in db
         instance_type = instance['instance_type']
         instance_type = instance_types.INSTANCE_TYPES[instance_type]
@@ -514,6 +508,15 @@ class LibvirtConnection(object):
                                                    instance['id'])
         # Assume that the gateway also acts as the dhcp server.
         dhcp_server = network['gateway']
+
+        if FLAGS.allow_project_net_traffic:
+            net, mask = _get_net_and_mask(network['cidr'])
+            extra_params = ("<parameter name=\"PROJNET\" value=\"%s\" />\n"
+                            "<parameter name=\"PROJMASK\" value=\"%s\" />\n"
+                           ) % (net, mask)
+        else:
+            extra_params = "\n"
+
         xml_info = {'type': FLAGS.libvirt_type,
                     'name': instance['name'],
                     'basepath': os.path.join(FLAGS.instances_path,
@@ -523,20 +526,30 @@ class LibvirtConnection(object):
                     'bridge_name': network['bridge'],
                     'mac_address': instance['mac_address'],
                     'ip_address': ip_address,
-                    'dhcp_server': dhcp_server}
-        if rescue:
-            libvirt_xml = self.rescue_xml % xml_info
-        else:
-            libvirt_xml = self.libvirt_xml % xml_info
-        logging.debug('instance %s: finished toXML method', instance['name'])
+                    'dhcp_server': dhcp_server,
+                    'extra_params': extra_params,
+                    'rescue': rescue}
+        if not rescue:
+            if instance['kernel_id']:
+                xml_info['kernel'] = xml_info['basepath'] + "/kernel"
 
-        return libvirt_xml
+            if instance['ramdisk_id']:
+                xml_info['ramdisk'] = xml_info['basepath'] + "/ramdisk"
+
+            xml_info['disk'] = xml_info['basepath'] + "/disk"
+
+        xml = str(Template(self.libvirt_xml, searchList=[xml_info]))
+        logging.debug(_('instance %s: finished toXML method'),
+                        instance['name'])
+
+        return xml
 
     def get_info(self, instance_name):
         try:
             virt_dom = self._conn.lookupByName(instance_name)
         except:
-            raise exception.NotFound("Instance %s not found" % instance_name)
+            raise exception.NotFound(_("Instance %s not found")
+                                     % instance_name)
         (state, max_mem, mem, num_cpu, cpu_time) = virt_dom.info()
         return {'state': state,
                 'max_mem': max_mem,
@@ -722,6 +735,14 @@ class NWFilterFirewall(object):
                               </rule>
                             </filter>'''
 
+    nova_vpn_filter = '''<filter name='nova-vpn' chain='root'>
+                           <uuid>2086015e-cf03-11df-8c5d-080027c27973</uuid>
+                           <filterref filter='allow-dhcp-server'/>
+                           <filterref filter='nova-allow-dhcp-server'/>
+                           <filterref filter='nova-base-ipv4'/>
+                           <filterref filter='nova-base-ipv6'/>
+                         </filter>'''
+
     def nova_base_ipv4_filter(self):
         retval = "<filter name='nova-base-ipv4' chain='ipv4'>"
         for protocol in ['tcp', 'udp', 'icmp']:
@@ -746,27 +767,31 @@ class NWFilterFirewall(object):
         retval += '</filter>'
         return retval
 
-    def nova_project_filter(self, project, net, mask):
-        retval = "<filter name='nova-project-%s' chain='ipv4'>" % project
+    def nova_project_filter(self):
+        retval = "<filter name='nova-project' chain='ipv4'>"
         for protocol in ['tcp', 'udp', 'icmp']:
             retval += """<rule action='accept' direction='in' priority='200'>
-                           <%s srcipaddr='%s' srcipmask='%s' />
-                         </rule>""" % (protocol, net, mask)
+                           <%s srcipaddr='$PROJNET' srcipmask='$PROJMASK' />
+                         </rule>""" % protocol
         retval += '</filter>'
         return retval
 
     def _define_filter(self, xml):
         if callable(xml):
             xml = xml()
-        d = threads.deferToThread(self._conn.nwfilterDefineXML, xml)
-        return d
 
-    @staticmethod
-    def _get_net_and_mask(cidr):
-        net = IPy.IP(cidr)
-        return str(net.net()), str(net.netmask())
+        # execute in a native thread and block current greenthread until done
+        tpool.execute(self._conn.nwfilterDefineXML, xml)
+
+    def setup_base_nwfilters(self):
+        self._define_filter(self.nova_base_ipv4_filter)
+        self._define_filter(self.nova_base_ipv6_filter)
+        self._define_filter(self.nova_dhcp_filter)
+        self._define_filter(self.nova_base_filter)
+        self._define_filter(self.nova_vpn_filter)
+        if FLAGS.allow_project_net_traffic:
+            self._define_filter(self.nova_project_filter)
 
-    @defer.inlineCallbacks
     def setup_nwfilters_for_instance(self, instance):
         """
         Creates an NWFilter for the given instance. In the process,
@@ -774,35 +799,25 @@ class NWFilterFirewall(object):
         the base filter are all in place.
         """
 
-        yield self._define_filter(self.nova_base_ipv4_filter)
-        yield self._define_filter(self.nova_base_ipv6_filter)
-        yield self._define_filter(self.nova_dhcp_filter)
-        yield self._define_filter(self.nova_base_filter)
+        nwfilter_xml = ("<filter name='nova-instance-%s' chain='root'>\n"
+                       ) % instance['name']
 
-        nwfilter_xml = "<filter name='nova-instance-%s' chain='root'>\n" \
-                       "  <filterref filter='nova-base' />\n" % \
-                       instance['name']
+        if instance['image_id'] == FLAGS.vpn_image_id:
+            nwfilter_xml += "  <filterref filter='nova-vpn' />\n"
+        else:
+            nwfilter_xml += "  <filterref filter='nova-base' />\n"
 
         if FLAGS.allow_project_net_traffic:
-            network_ref = db.project_get_network(context.get_admin_context(),
-                                                 instance['project_id'])
-            net, mask = self._get_net_and_mask(network_ref['cidr'])
-            project_filter = self.nova_project_filter(instance['project_id'],
-                                                      net, mask)
-            yield self._define_filter(project_filter)
-
-            nwfilter_xml += "  <filterref filter='nova-project-%s' />\n" % \
-                            instance['project_id']
+            nwfilter_xml += "  <filterref filter='nova-project' />\n"
 
         for security_group in instance.security_groups:
-            yield self.ensure_security_group_filter(security_group['id'])
+            self.ensure_security_group_filter(security_group['id'])
 
-            nwfilter_xml += "  <filterref filter='nova-secgroup-%d' />\n" % \
-                            security_group['id']
+            nwfilter_xml += ("  <filterref filter='nova-secgroup-%d' />\n"
+                            ) % security_group['id']
         nwfilter_xml += "</filter>"
 
-        yield self._define_filter(nwfilter_xml)
-        return
+        self._define_filter(nwfilter_xml)
 
     def ensure_security_group_filter(self, security_group_id):
         return self._define_filter(
@@ -815,7 +830,7 @@ class NWFilterFirewall(object):
         for rule in security_group.rules:
             rule_xml += "<rule action='accept' direction='in' priority='300'>"
             if rule.cidr:
-                net, mask = self._get_net_and_mask(rule.cidr)
+                net, mask = _get_net_and_mask(rule.cidr)
                 rule_xml += "<%s srcipaddr='%s' srcipmask='%s' " % \
                             (rule.protocol, net, mask)
                 if rule.protocol in ['tcp', 'udp']:
diff --git a/nova/virt/xenapi/network_utils.py b/nova/virt/xenapi/network_utils.py
index 8cb4cce3a..ce2c68ce0 100644
--- a/nova/virt/xenapi/network_utils.py
+++ b/nova/virt/xenapi/network_utils.py
@@ -20,25 +20,22 @@ records and their attributes like bridges, PIFs, QoS, as well as
 their lookup functions.
 """
 
-from twisted.internet import defer
-
 
 class NetworkHelper():
     """
     The class that wraps the helper methods together.
     """
+
     def __init__(self):
         return
 
     @classmethod
-    @defer.inlineCallbacks
     def find_network_with_bridge(cls, session, bridge):
-        """ Return the network on which the bridge is attached, if found """
+        """ Return the network on which the bridge is attached, if found."""
         expr = 'field "bridge" = "%s"' % bridge
-        networks = yield session.call_xenapi('network.get_all_records_where',
-                                           expr)
+        networks = session.call_xenapi('network.get_all_records_where', expr)
         if len(networks) == 1:
-            defer.returnValue(networks.keys()[0])
+            return networks.keys()[0]
         elif len(networks) > 1:
             raise Exception('Found non-unique network for bridge %s' % bridge)
         else:
diff --git a/nova/virt/xenapi/vm_utils.py b/nova/virt/xenapi/vm_utils.py
index 99d484ca2..badaaedc1 100644
--- a/nova/virt/xenapi/vm_utils.py
+++ b/nova/virt/xenapi/vm_utils.py
@@ -20,15 +20,19 @@ their attributes like VDIs, VIFs, as well as their lookup functions.
 """
 
 import logging
+import urllib
+from xml.dom import minidom
 
-from twisted.internet import defer
-
+from nova import flags
 from nova import utils
 from nova.auth.manager import AuthManager
 from nova.compute import instance_types
 from nova.compute import power_state
 from nova.virt import images
 
+
+FLAGS = flags.FLAGS
+
 XENAPI_POWER_STATE = {
     'Halted': power_state.SHUTDOWN,
     'Running': power_state.RUNNING,
@@ -43,13 +47,22 @@ class VMHelper():
     """
     The class that wraps the helper methods together.
     """
+
     def __init__(self):
+        return
+
+    @classmethod
+    def late_import(cls):
+        """
+        Load the XenAPI module in for helper class, if required.
+        This is to avoid to install the XenAPI library when other
+        hypervisors are used
+        """
         global XenAPI
         if XenAPI is None:
             XenAPI = __import__('XenAPI')
 
     @classmethod
-    @defer.inlineCallbacks
     def create_vm(cls, session, instance, kernel, ramdisk):
         """Create a VM record.  Returns a Deferred that gives the new
         VM reference."""
@@ -87,12 +100,11 @@ class VMHelper():
             'other_config': {},
             }
         logging.debug('Created VM %s...', instance.name)
-        vm_ref = yield session.call_xenapi('VM.create', rec)
+        vm_ref = session.call_xenapi('VM.create', rec)
         logging.debug('Created VM %s as %s.', instance.name, vm_ref)
-        defer.returnValue(vm_ref)
+        return vm_ref
 
     @classmethod
-    @defer.inlineCallbacks
     def create_vbd(cls, session, vm_ref, vdi_ref, userdevice, bootable):
         """Create a VBD record.  Returns a Deferred that gives the new
         VBD reference."""
@@ -111,13 +123,12 @@ class VMHelper():
         vbd_rec['qos_algorithm_params'] = {}
         vbd_rec['qos_supported_algorithms'] = []
         logging.debug('Creating VBD for VM %s, VDI %s ... ', vm_ref, vdi_ref)
-        vbd_ref = yield session.call_xenapi('VBD.create', vbd_rec)
+        vbd_ref = session.call_xenapi('VBD.create', vbd_rec)
         logging.debug('Created VBD %s for VM %s, VDI %s.', vbd_ref, vm_ref,
                       vdi_ref)
-        defer.returnValue(vbd_ref)
+        return vbd_ref
 
     @classmethod
-    @defer.inlineCallbacks
     def create_vif(cls, session, vm_ref, network_ref, mac_address):
         """Create a VIF record.  Returns a Deferred that gives the new
         VIF reference."""
@@ -133,13 +144,12 @@ class VMHelper():
         vif_rec['qos_algorithm_params'] = {}
         logging.debug('Creating VIF for VM %s, network %s ... ', vm_ref,
                       network_ref)
-        vif_ref = yield session.call_xenapi('VIF.create', vif_rec)
+        vif_ref = session.call_xenapi('VIF.create', vif_rec)
         logging.debug('Created VIF %s for VM %s, network %s.', vif_ref,
                       vm_ref, network_ref)
-        defer.returnValue(vif_ref)
+        return vif_ref
 
     @classmethod
-    @defer.inlineCallbacks
     def fetch_image(cls, session, image, user, project, use_sr):
         """use_sr: True to put the image as a VDI in an SR, False to place
         it on dom0's filesystem.  The former is for VM disks, the latter for
@@ -156,12 +166,11 @@ class VMHelper():
         args['password'] = user.secret
         if use_sr:
             args['add_partition'] = 'true'
-        task = yield session.async_call_plugin('objectstore', fn, args)
-        uuid = yield session.wait_for_task(task)
-        defer.returnValue(uuid)
+        task = session.async_call_plugin('objectstore', fn, args)
+        uuid = session.wait_for_task(task)
+        return uuid
 
     @classmethod
-    @utils.deferredToThread
     def lookup(cls, session, i):
         """ Look the instance i up, and returns it if available """
         return VMHelper.lookup_blocking(session, i)
@@ -179,7 +188,6 @@ class VMHelper():
             return vms[0]
 
     @classmethod
-    @utils.deferredToThread
     def lookup_vm_vdis(cls, session, vm):
         """ Look for the VDIs that are attached to the VM """
         return VMHelper.lookup_vm_vdis_blocking(session, vm)
@@ -214,3 +222,36 @@ class VMHelper():
                 'mem': long(record['memory_dynamic_max']) >> 10,
                 'num_cpu': record['VCPUs_max'],
                 'cpu_time': 0}
+
+    @classmethod
+    def compile_diagnostics(cls, session, record):
+        """Compile VM diagnostics data"""
+        try:
+            host = session.get_xenapi_host()
+            host_ip = session.get_xenapi().host.get_record(host)["address"]
+            diags = {}
+            xml = get_rrd(host_ip, record["uuid"])
+            if xml:
+                rrd = minidom.parseString(xml)
+                for i, node in enumerate(rrd.firstChild.childNodes):
+                    # We don't want all of the extra garbage
+                    if i >= 3 and i <= 11:
+                        ref = node.childNodes
+                        # Name and Value
+                        diags[ref[0].firstChild.data] = ref[6].firstChild.data
+            return diags
+        except XenAPI.Failure as e:
+            return {"Unable to retrieve diagnostics": e}
+
+
+def get_rrd(host, uuid):
+    """Return the VM RRD XML as a string"""
+    try:
+        xml = urllib.urlopen("http://%s:%s@%s/vm_rrd?uuid=%s" % (
+            FLAGS.xenapi_connection_username,
+            FLAGS.xenapi_connection_password,
+            host,
+            uuid))
+        return xml.read()
+    except IOError:
+        return None
diff --git a/nova/virt/xenapi/vmops.py b/nova/virt/xenapi/vmops.py
index d36cdaea5..4d897af35 100644
--- a/nova/virt/xenapi/vmops.py
+++ b/nova/virt/xenapi/vmops.py
@@ -20,10 +20,9 @@ Management class for VM-related functions (spawn, reboot, etc).
 
 import logging
 
-from twisted.internet import defer
-
 from nova import db
 from nova import context
+
 from nova.auth.manager import AuthManager
 from nova.virt.xenapi.network_utils import NetworkHelper
 from nova.virt.xenapi.vm_utils import VMHelper
@@ -35,100 +34,137 @@ class VMOps(object):
     """
     Management class for VM-related tasks
     """
+
     def __init__(self, session):
         global XenAPI
         if XenAPI is None:
             XenAPI = __import__('XenAPI')
         self._session = session
+        # Load XenAPI module in the helper class
+        VMHelper.late_import()
 
     def list_instances(self):
-        """ List VM instances """
-        return [self._session.get_xenapi().VM.get_name_label(vm) \
-                for vm in self._session.get_xenapi().VM.get_all()]
+        """List VM instances"""
+        vms = []
+        for vm in self._session.get_xenapi().VM.get_all():
+            rec = self._session.get_xenapi().VM.get_record(vm)
+            if not rec["is_a_template"] and not rec["is_control_domain"]:
+                vms.append(rec["name_label"])
+        return vms
 
-    @defer.inlineCallbacks
     def spawn(self, instance):
-        """ Create VM instance """
-        vm = yield VMHelper.lookup(self._session, instance.name)
+        """Create VM instance"""
+        vm = VMHelper.lookup(self._session, instance.name)
         if vm is not None:
             raise Exception('Attempted to create non-unique name %s' %
                             instance.name)
 
-        bridge = db.project_get_network(context.get_admin_context(),
-                                      instance.project_id).bridge
+        bridge = db.network_get_by_instance(context.get_admin_context(),
+                                            instance['id'])['bridge']
         network_ref = \
-            yield NetworkHelper.find_network_with_bridge(self._session, bridge)
+            NetworkHelper.find_network_with_bridge(self._session, bridge)
 
         user = AuthManager().get_user(instance.user_id)
         project = AuthManager().get_project(instance.project_id)
-        vdi_uuid = yield VMHelper.fetch_image(self._session,
-            instance.image_id, user, project, True)
-        kernel = yield VMHelper.fetch_image(self._session,
-            instance.kernel_id, user, project, False)
-        ramdisk = yield VMHelper.fetch_image(self._session,
-            instance.ramdisk_id, user, project, False)
-        vdi_ref = yield self._session.call_xenapi('VDI.get_by_uuid', vdi_uuid)
-        vm_ref = yield VMHelper.create_vm(self._session,
-                                          instance, kernel, ramdisk)
-        yield VMHelper.create_vbd(self._session, vm_ref, vdi_ref, 0, True)
+        vdi_uuid = VMHelper.fetch_image(
+                self._session, instance.image_id, user, project, True)
+        kernel = VMHelper.fetch_image(
+                self._session, instance.kernel_id, user, project, False)
+        ramdisk = VMHelper.fetch_image(
+                self._session, instance.ramdisk_id, user, project, False)
+        vdi_ref = self._session.call_xenapi('VDI.get_by_uuid', vdi_uuid)
+        vm_ref = VMHelper.create_vm(
+                self._session, instance, kernel, ramdisk)
+        VMHelper.create_vbd(self._session, vm_ref, vdi_ref, 0, True)
         if network_ref:
-            yield VMHelper.create_vif(self._session, vm_ref,
-                                      network_ref, instance.mac_address)
+            VMHelper.create_vif(self._session, vm_ref,
+                                network_ref, instance.mac_address)
         logging.debug('Starting VM %s...', vm_ref)
-        yield self._session.call_xenapi('VM.start', vm_ref, False, False)
+        self._session.call_xenapi('VM.start', vm_ref, False, False)
         logging.info('Spawning VM %s created %s.', instance.name,
                      vm_ref)
 
-    @defer.inlineCallbacks
     def reboot(self, instance):
-        """ Reboot VM instance """
+        """Reboot VM instance"""
         instance_name = instance.name
-        vm = yield VMHelper.lookup(self._session, instance_name)
+        vm = VMHelper.lookup(self._session, instance_name)
         if vm is None:
             raise Exception('instance not present %s' % instance_name)
-        task = yield self._session.call_xenapi('Async.VM.clean_reboot', vm)
-        yield self._session.wait_for_task(task)
+        task = self._session.call_xenapi('Async.VM.clean_reboot', vm)
+        self._session.wait_for_task(instance.id, task)
 
-    @defer.inlineCallbacks
     def destroy(self, instance):
-        """ Destroy VM instance """
-        vm = yield VMHelper.lookup(self._session, instance.name)
+        """Destroy VM instance"""
+        vm = VMHelper.lookup(self._session, instance.name)
         if vm is None:
             # Don't complain, just return.  This lets us clean up instances
             # that have already disappeared from the underlying platform.
-            defer.returnValue(None)
+            return
         # Get the VDIs related to the VM
-        vdis = yield VMHelper.lookup_vm_vdis(self._session, vm)
+        vdis = VMHelper.lookup_vm_vdis(self._session, vm)
         try:
-            task = yield self._session.call_xenapi('Async.VM.hard_shutdown',
+            task = self._session.call_xenapi('Async.VM.hard_shutdown',
                                                    vm)
-            yield self._session.wait_for_task(task)
+            self._session.wait_for_task(instance.id, task)
         except XenAPI.Failure, exc:
             logging.warn(exc)
         # Disk clean-up
         if vdis:
             for vdi in vdis:
                 try:
-                    task = yield self._session.call_xenapi('Async.VDI.destroy',
-                                                           vdi)
-                    yield self._session.wait_for_task(task)
+                    task = self._session.call_xenapi('Async.VDI.destroy', vdi)
+                    self._session.wait_for_task(instance.id, task)
                 except XenAPI.Failure, exc:
                     logging.warn(exc)
         try:
-            task = yield self._session.call_xenapi('Async.VM.destroy', vm)
-            yield self._session.wait_for_task(task)
+            task = self._session.call_xenapi('Async.VM.destroy', vm)
+            self._session.wait_for_task(instance.id, task)
         except XenAPI.Failure, exc:
             logging.warn(exc)
 
+    def _wait_with_callback(self, instance_id, task, callback):
+        ret = None
+        try:
+            ret = self._session.wait_for_task(instance_id, task)
+        except XenAPI.Failure, exc:
+            logging.warn(exc)
+        callback(ret)
+
+    def pause(self, instance, callback):
+        """Pause VM instance"""
+        instance_name = instance.name
+        vm = VMHelper.lookup(self._session, instance_name)
+        if vm is None:
+            raise Exception('instance not present %s' % instance_name)
+        task = self._session.call_xenapi('Async.VM.pause', vm)
+        self._wait_with_callback(instance.id, task, callback)
+
+    def unpause(self, instance, callback):
+        """Unpause VM instance"""
+        instance_name = instance.name
+        vm = VMHelper.lookup(self._session, instance_name)
+        if vm is None:
+            raise Exception('instance not present %s' % instance_name)
+        task = self._session.call_xenapi('Async.VM.unpause', vm)
+        self._wait_with_callback(instance.id, task, callback)
+
     def get_info(self, instance_id):
-        """ Return data about VM instance """
+        """Return data about VM instance"""
         vm = VMHelper.lookup_blocking(self._session, instance_id)
         if vm is None:
             raise Exception('instance not present %s' % instance_id)
         rec = self._session.get_xenapi().VM.get_record(vm)
         return VMHelper.compile_info(rec)
 
+    def get_diagnostics(self, instance_id):
+        """Return data about VM diagnostics"""
+        vm = VMHelper.lookup(self._session, instance_id)
+        if vm is None:
+            raise Exception("instance not present %s" % instance_id)
+        rec = self._session.get_xenapi().VM.get_record(vm)
+        return VMHelper.compile_diagnostics(self._session, rec)
+
     def get_console_output(self, instance):
-        """ Return snapshot of console """
+        """Return snapshot of console"""
         # TODO: implement this to fix pylint!
         return 'FAKE CONSOLE OUTPUT of instance'
diff --git a/nova/virt/xenapi/volumeops.py b/nova/virt/xenapi/volumeops.py
index a4c7a3861..1943ccab0 100644
--- a/nova/virt/xenapi/volumeops.py
+++ b/nova/virt/xenapi/volumeops.py
@@ -20,6 +20,7 @@ Management class for Storage-related functions (attach, detach, etc).
 
 
 class VolumeOps(object):
+
     def __init__(self, session):
         self._session = session
 
diff --git a/nova/virt/xenapi_conn.py b/nova/virt/xenapi_conn.py
index 26b30bf92..146e2f153 100644
--- a/nova/virt/xenapi_conn.py
+++ b/nova/virt/xenapi_conn.py
@@ -48,11 +48,14 @@ reactor thread if the VM.get_by_name_label or VM.get_record calls block.
 """
 
 import logging
+import sys
 import xmlrpclib
 
-from twisted.internet import defer
-from twisted.internet import reactor
+from eventlet import event
+from eventlet import tpool
 
+from nova import context
+from nova import db
 from nova import utils
 from nova import flags
 from nova.virt.xenapi.vmops import VMOps
@@ -92,124 +95,147 @@ def get_connection(_):
     username = FLAGS.xenapi_connection_username
     password = FLAGS.xenapi_connection_password
     if not url or password is None:
-        raise Exception('Must specify xenapi_connection_url, '
-                        'xenapi_connection_username (optionally), and '
-                        'xenapi_connection_password to use '
-                        'connection_type=xenapi')
+        raise Exception(_('Must specify xenapi_connection_url, '
+                          'xenapi_connection_username (optionally), and '
+                          'xenapi_connection_password to use '
+                          'connection_type=xenapi'))
     return XenAPIConnection(url, username, password)
 
 
 class XenAPIConnection(object):
-    """ A connection to XenServer or Xen Cloud Platform """
+    """A connection to XenServer or Xen Cloud Platform"""
+
     def __init__(self, url, user, pw):
         session = XenAPISession(url, user, pw)
         self._vmops = VMOps(session)
         self._volumeops = VolumeOps(session)
 
     def list_instances(self):
-        """ List VM instances """
+        """List VM instances"""
         return self._vmops.list_instances()
 
     def spawn(self, instance):
-        """ Create VM instance """
+        """Create VM instance"""
         self._vmops.spawn(instance)
 
     def reboot(self, instance):
-        """ Reboot VM instance """
+        """Reboot VM instance"""
         self._vmops.reboot(instance)
 
     def destroy(self, instance):
-        """ Destroy VM instance """
+        """Destroy VM instance"""
         self._vmops.destroy(instance)
 
+    def pause(self, instance, callback):
+        """Pause VM instance"""
+        self._vmops.pause(instance, callback)
+
+    def unpause(self, instance, callback):
+        """Unpause paused VM instance"""
+        self._vmops.unpause(instance, callback)
+
     def get_info(self, instance_id):
-        """ Return data about VM instance """
+        """Return data about VM instance"""
         return self._vmops.get_info(instance_id)
 
+    def get_diagnostics(self, instance_id):
+        """Return data about VM diagnostics"""
+        return self._vmops.get_diagnostics(instance_id)
+
     def get_console_output(self, instance):
-        """ Return snapshot of console """
+        """Return snapshot of console"""
         return self._vmops.get_console_output(instance)
 
     def attach_volume(self, instance_name, device_path, mountpoint):
-        """ Attach volume storage to VM instance """
+        """Attach volume storage to VM instance"""
         return self._volumeops.attach_volume(instance_name,
                                                device_path,
                                                mountpoint)
 
     def detach_volume(self, instance_name, mountpoint):
-        """ Detach volume storage to VM instance """
+        """Detach volume storage to VM instance"""
         return self._volumeops.detach_volume(instance_name, mountpoint)
 
 
 class XenAPISession(object):
-    """ The session to invoke XenAPI SDK calls """
+    """The session to invoke XenAPI SDK calls"""
+
     def __init__(self, url, user, pw):
         self._session = XenAPI.Session(url)
         self._session.login_with_password(user, pw)
 
     def get_xenapi(self):
-        """ Return the xenapi object """
+        """Return the xenapi object"""
         return self._session.xenapi
 
     def get_xenapi_host(self):
-        """ Return the xenapi host """
+        """Return the xenapi host"""
         return self._session.xenapi.session.get_this_host(self._session.handle)
 
-    @utils.deferredToThread
     def call_xenapi(self, method, *args):
-        """Call the specified XenAPI method on a background thread.  Returns
-        a Deferred for the result."""
+        """Call the specified XenAPI method on a background thread."""
         f = self._session.xenapi
         for m in method.split('.'):
             f = f.__getattr__(m)
-        return f(*args)
+        return tpool.execute(f, *args)
 
-    @utils.deferredToThread
     def async_call_plugin(self, plugin, fn, args):
-        """Call Async.host.call_plugin on a background thread.  Returns a
-        Deferred with the task reference."""
-        return _unwrap_plugin_exceptions(
-            self._session.xenapi.Async.host.call_plugin,
-            self.get_xenapi_host(), plugin, fn, args)
+        """Call Async.host.call_plugin on a background thread."""
+        return tpool.execute(_unwrap_plugin_exceptions,
+                             self._session.xenapi.Async.host.call_plugin,
+                             self.get_xenapi_host(), plugin, fn, args)
 
-    def wait_for_task(self, task):
+    def wait_for_task(self, instance_id, task):
         """Return a Deferred that will give the result of the given task.
         The task is polled until it completes."""
-        d = defer.Deferred()
-        reactor.callLater(0, self._poll_task, task, d)
-        return d
 
-    @utils.deferredToThread
-    def _poll_task(self, task, deferred):
+        done = event.Event()
+        loop = utils.LoopingCall(self._poll_task, instance_id, task, done)
+        loop.start(FLAGS.xenapi_task_poll_interval, now=True)
+        rv = done.wait()
+        loop.stop()
+        return rv
+
+    def _poll_task(self, instance_id, task, done):
         """Poll the given XenAPI task, and fire the given Deferred if we
         get a result."""
         try:
-            #logging.debug('Polling task %s...', task)
+            name = self._session.xenapi.task.get_name_label(task)
             status = self._session.xenapi.task.get_status(task)
-            if status == 'pending':
-                reactor.callLater(FLAGS.xenapi_task_poll_interval,
-                                  self._poll_task, task, deferred)
-            elif status == 'success':
+            action = dict(
+                instance_id=int(instance_id),
+                action=name,
+                error=None)
+            if status == "pending":
+                return
+            elif status == "success":
                 result = self._session.xenapi.task.get_result(task)
-                logging.info('Task %s status: success.  %s', task, result)
-                deferred.callback(_parse_xmlrpc_value(result))
+                logging.info(_("Task [%s] %s status: success    %s") % (
+                    name,
+                    task,
+                    result))
+                done.send(_parse_xmlrpc_value(result))
             else:
                 error_info = self._session.xenapi.task.get_error_info(task)
-                logging.warn('Task %s status: %s.  %s', task, status,
-                             error_info)
-                deferred.errback(XenAPI.Failure(error_info))
-            #logging.debug('Polling task %s done.', task)
+                action["error"] = str(error_info)
+                logging.warn(_("Task [%s] %s status: %s    %s") % (
+                    name,
+                    task,
+                    status,
+                    error_info))
+                done.send_exception(XenAPI.Failure(error_info))
+            db.instance_action_create(context.get_admin_context(), action)
         except XenAPI.Failure, exc:
             logging.warn(exc)
-            deferred.errback(exc)
+            done.send_exception(*sys.exc_info())
 
 
 def _unwrap_plugin_exceptions(func, *args, **kwargs):
-    """ Parse exception details """
+    """Parse exception details"""
     try:
         return func(*args, **kwargs)
     except XenAPI.Failure, exc:
-        logging.debug("Got exception: %s", exc)
+        logging.debug(_("Got exception: %s"), exc)
         if (len(exc.details) == 4 and
             exc.details[0] == 'XENAPI_PLUGIN_EXCEPTION' and
             exc.details[2] == 'Failure'):
@@ -222,7 +248,7 @@ def _unwrap_plugin_exceptions(func, *args, **kwargs):
         else:
             raise
     except xmlrpclib.ProtocolError, exc:
-        logging.debug("Got exception: %s", exc)
+        logging.debug(_("Got exception: %s"), exc)
         raise
 
 
diff --git a/nova/volume/driver.py b/nova/volume/driver.py
index 156aad2a0..8353b9712 100644
--- a/nova/volume/driver.py
+++ b/nova/volume/driver.py
@@ -22,12 +22,10 @@ Drivers for volumes.
 
 import logging
 import os
-
-from twisted.internet import defer
+import time
 
 from nova import exception
 from nova import flags
-from nova import process
 from nova import utils
 
 
@@ -55,14 +53,13 @@ flags.DEFINE_string('iscsi_ip_prefix', '127.0',
 
 class VolumeDriver(object):
     """Executes commands relating to Volumes."""
-    def __init__(self, execute=process.simple_execute,
+    def __init__(self, execute=utils.execute,
                  sync_exec=utils.execute, *args, **kwargs):
         # NOTE(vish): db is set by Manager
         self.db = None
         self._execute = execute
         self._sync_exec = sync_exec
 
-    @defer.inlineCallbacks
     def _try_execute(self, command):
         # NOTE(vish): Volume commands can partially fail due to timing, but
         #             running them a second time on failure will usually
@@ -70,69 +67,61 @@ class VolumeDriver(object):
         tries = 0
         while True:
             try:
-                yield self._execute(command)
-                defer.returnValue(True)
+                self._execute(command)
+                return True
             except exception.ProcessExecutionError:
                 tries = tries + 1
                 if tries >= FLAGS.num_shell_tries:
                     raise
-                logging.exception("Recovering from a failed execute."
-                                  "Try number %s", tries)
-                yield self._execute("sleep %s" % tries ** 2)
+                logging.exception(_("Recovering from a failed execute."
+                                    "Try number %s"), tries)
+                time.sleep(tries ** 2)
 
     def check_for_setup_error(self):
         """Returns an error if prerequisites aren't met"""
         if not os.path.isdir("/dev/%s" % FLAGS.volume_group):
-            raise exception.Error("volume group %s doesn't exist"
+            raise exception.Error(_("volume group %s doesn't exist")
                                   % FLAGS.volume_group)
 
-    @defer.inlineCallbacks
     def create_volume(self, volume):
         """Creates a logical volume."""
         if int(volume['size']) == 0:
             sizestr = '100M'
         else:
             sizestr = '%sG' % volume['size']
-        yield self._try_execute("sudo lvcreate -L %s -n %s %s" %
-                            (sizestr,
-                             volume['name'],
-                             FLAGS.volume_group))
+        self._try_execute("sudo lvcreate -L %s -n %s %s" %
+                          (sizestr,
+                           volume['name'],
+                           FLAGS.volume_group))
 
-    @defer.inlineCallbacks
     def delete_volume(self, volume):
         """Deletes a logical volume."""
-        yield self._try_execute("sudo lvremove -f %s/%s" %
-                                (FLAGS.volume_group,
-                                 volume['name']))
+        self._try_execute("sudo lvremove -f %s/%s" %
+                          (FLAGS.volume_group,
+                           volume['name']))
 
-    @defer.inlineCallbacks
     def local_path(self, volume):
-        yield  # NOTE(vish): stops deprecation warning
+        # NOTE(vish): stops deprecation warning
         escaped_group = FLAGS.volume_group.replace('-', '--')
         escaped_name = volume['name'].replace('-', '--')
-        defer.returnValue("/dev/mapper/%s-%s" % (escaped_group,
-                                                 escaped_name))
+        return "/dev/mapper/%s-%s" % (escaped_group, escaped_name)
 
     def ensure_export(self, context, volume):
         """Synchronously recreates an export for a logical volume."""
         raise NotImplementedError()
 
-    @defer.inlineCallbacks
     def create_export(self, context, volume):
         """Exports the volume."""
         raise NotImplementedError()
 
-    @defer.inlineCallbacks
     def remove_export(self, context, volume):
         """Removes an export for a logical volume."""
         raise NotImplementedError()
 
-    @defer.inlineCallbacks
     def discover_volume(self, volume):
         """Discover volume on a remote host."""
         raise NotImplementedError()
 
-    @defer.inlineCallbacks
     def undiscover_volume(self, volume):
         """Undiscover volume on a remote host."""
         raise NotImplementedError()
@@ -155,14 +144,13 @@ class AOEDriver(VolumeDriver):
                 dev = {'shelf_id': shelf_id, 'blade_id': blade_id}
                 self.db.export_device_create_safe(context, dev)
 
-    @defer.inlineCallbacks
     def create_export(self, context, volume):
         """Creates an export for a logical volume."""
         self._ensure_blades(context)
         (shelf_id,
          blade_id) = self.db.volume_allocate_shelf_and_blade(context,
                                                              volume['id'])
-        yield self._try_execute(
+        self._try_execute(
                 "sudo vblade-persist setup %s %s %s /dev/%s/%s" %
                 (shelf_id,
                  blade_id,
@@ -176,33 +164,30 @@ class AOEDriver(VolumeDriver):
         #             still works for the other volumes, so we
         #             just wait a bit for the current volume to
         #             be ready and ignore any errors.
-        yield self._execute("sleep 2")
-        yield self._execute("sudo vblade-persist auto all",
-                            check_exit_code=False)
-        yield self._execute("sudo vblade-persist start all",
-                            check_exit_code=False)
+        time.sleep(2)
+        self._execute("sudo vblade-persist auto all",
+                      check_exit_code=False)
+        self._execute("sudo vblade-persist start all",
+                      check_exit_code=False)
 
-    @defer.inlineCallbacks
     def remove_export(self, context, volume):
         """Removes an export for a logical volume."""
         (shelf_id,
          blade_id) = self.db.volume_get_shelf_and_blade(context,
                                                         volume['id'])
-        yield self._try_execute("sudo vblade-persist stop %s %s" %
-                                (shelf_id, blade_id))
-        yield self._try_execute("sudo vblade-persist destroy %s %s" %
-                                (shelf_id, blade_id))
+        self._try_execute("sudo vblade-persist stop %s %s" %
+                          (shelf_id, blade_id))
+        self._try_execute("sudo vblade-persist destroy %s %s" %
+                          (shelf_id, blade_id))
 
-    @defer.inlineCallbacks
     def discover_volume(self, _volume):
         """Discover volume on a remote host."""
-        yield self._execute("sudo aoe-discover")
-        yield self._execute("sudo aoe-stat", check_exit_code=False)
+        self._execute("sudo aoe-discover")
+        self._execute("sudo aoe-stat", check_exit_code=False)
 
-    @defer.inlineCallbacks
     def undiscover_volume(self, _volume):
         """Undiscover volume on a remote host."""
-        yield
+        pass
 
 
 class FakeAOEDriver(AOEDriver):
@@ -220,7 +205,7 @@ class FakeAOEDriver(AOEDriver):
     @staticmethod
     def fake_execute(cmd, *_args, **_kwargs):
         """Execute that simply logs the command."""
-        logging.debug("FAKE AOE: %s", cmd)
+        logging.debug(_("FAKE AOE: %s"), cmd)
         return (None, None)
 
 
@@ -252,7 +237,6 @@ class ISCSIDriver(VolumeDriver):
             target = {'host': host, 'target_num': target_num}
             self.db.iscsi_target_create_safe(context, target)
 
-    @defer.inlineCallbacks
     def create_export(self, context, volume):
         """Creates an export for a logical volume."""
         self._ensure_iscsi_targets(context, volume['host'])
@@ -261,61 +245,55 @@ class ISCSIDriver(VolumeDriver):
                                                       volume['host'])
         iscsi_name = "%s%s" % (FLAGS.iscsi_target_prefix, volume['name'])
         volume_path = "/dev/%s/%s" % (FLAGS.volume_group, volume['name'])
-        yield self._execute("sudo ietadm --op new "
-                            "--tid=%s --params Name=%s" %
-                            (iscsi_target, iscsi_name))
-        yield self._execute("sudo ietadm --op new --tid=%s "
-                            "--lun=0 --params Path=%s,Type=fileio" %
-                            (iscsi_target, volume_path))
-
-    @defer.inlineCallbacks
+        self._execute("sudo ietadm --op new "
+                      "--tid=%s --params Name=%s" %
+                      (iscsi_target, iscsi_name))
+        self._execute("sudo ietadm --op new --tid=%s "
+                      "--lun=0 --params Path=%s,Type=fileio" %
+                      (iscsi_target, volume_path))
+
     def remove_export(self, context, volume):
         """Removes an export for a logical volume."""
         iscsi_target = self.db.volume_get_iscsi_target_num(context,
                                                            volume['id'])
-        yield self._execute("sudo ietadm --op delete --tid=%s "
-                            "--lun=0" % iscsi_target)
-        yield self._execute("sudo ietadm --op delete --tid=%s" %
-                            iscsi_target)
+        self._execute("sudo ietadm --op delete --tid=%s "
+                      "--lun=0" % iscsi_target)
+        self._execute("sudo ietadm --op delete --tid=%s" %
+                      iscsi_target)
 
-    @defer.inlineCallbacks
     def _get_name_and_portal(self, volume_name, host):
         """Gets iscsi name and portal from volume name and host."""
-        (out, _err) = yield self._execute("sudo iscsiadm -m discovery -t "
-                                         "sendtargets -p %s" % host)
+        (out, _err) = self._execute("sudo iscsiadm -m discovery -t "
+                                    "sendtargets -p %s" % host)
         for target in out.splitlines():
             if FLAGS.iscsi_ip_prefix in target and volume_name in target:
                 (location, _sep, iscsi_name) = target.partition(" ")
                 break
         iscsi_portal = location.split(",")[0]
-        defer.returnValue((iscsi_name, iscsi_portal))
+        return (iscsi_name, iscsi_portal)
 
-    @defer.inlineCallbacks
     def discover_volume(self, volume):
         """Discover volume on a remote host."""
-        (iscsi_name,
-         iscsi_portal) = yield self._get_name_and_portal(volume['name'],
-                                                         volume['host'])
-        yield self._execute("sudo iscsiadm -m node -T %s -p %s --login" %
-                            (iscsi_name, iscsi_portal))
-        yield self._execute("sudo iscsiadm -m node -T %s -p %s --op update "
-                            "-n node.startup -v automatic" %
-                            (iscsi_name, iscsi_portal))
-        defer.returnValue("/dev/iscsi/%s" % volume['name'])
-
-    @defer.inlineCallbacks
+        iscsi_name, iscsi_portal = self._get_name_and_portal(volume['name'],
+                                                             volume['host'])
+        self._execute("sudo iscsiadm -m node -T %s -p %s --login" %
+                      (iscsi_name, iscsi_portal))
+        self._execute("sudo iscsiadm -m node -T %s -p %s --op update "
+                      "-n node.startup -v automatic" %
+                      (iscsi_name, iscsi_portal))
+        return "/dev/iscsi/%s" % volume['name']
+
     def undiscover_volume(self, volume):
         """Undiscover volume on a remote host."""
-        (iscsi_name,
-         iscsi_portal) = yield self._get_name_and_portal(volume['name'],
-                                                         volume['host'])
-        yield self._execute("sudo iscsiadm -m node -T %s -p %s --op update "
-                            "-n node.startup -v manual" %
-                            (iscsi_name, iscsi_portal))
-        yield self._execute("sudo iscsiadm -m node -T %s -p %s --logout " %
-                            (iscsi_name, iscsi_portal))
-        yield self._execute("sudo iscsiadm -m node --op delete "
-                            "--targetname %s" % iscsi_name)
+        iscsi_name, iscsi_portal = self._get_name_and_portal(volume['name'],
+                                                             volume['host'])
+        self._execute("sudo iscsiadm -m node -T %s -p %s --op update "
+                      "-n node.startup -v manual" %
+                      (iscsi_name, iscsi_portal))
+        self._execute("sudo iscsiadm -m node -T %s -p %s --logout " %
+                      (iscsi_name, iscsi_portal))
+        self._execute("sudo iscsiadm -m node --op delete "
+                      "--targetname %s" % iscsi_name)
 
 
 class FakeISCSIDriver(ISCSIDriver):
@@ -332,5 +310,5 @@ class FakeISCSIDriver(ISCSIDriver):
     @staticmethod
     def fake_execute(cmd, *_args, **_kwargs):
         """Execute that simply logs the command."""
-        logging.debug("FAKE ISCSI: %s", cmd)
+        logging.debug(_("FAKE ISCSI: %s"), cmd)
         return (None, None)
diff --git a/nova/volume/manager.py b/nova/volume/manager.py
index 589e7d7d9..966334c50 100644
--- a/nova/volume/manager.py
+++ b/nova/volume/manager.py
@@ -45,7 +45,6 @@ intact.
 import logging
 import datetime
 
-from twisted.internet import defer
 
 from nova import context
 from nova import exception
@@ -82,16 +81,15 @@ class VolumeManager(manager.Manager):
         self.driver.check_for_setup_error()
         ctxt = context.get_admin_context()
         volumes = self.db.volume_get_all_by_host(ctxt, self.host)
-        logging.debug("Re-exporting %s volumes", len(volumes))
+        logging.debug(_("Re-exporting %s volumes"), len(volumes))
         for volume in volumes:
             self.driver.ensure_export(ctxt, volume)
 
-    @defer.inlineCallbacks
     def create_volume(self, context, volume_id):
         """Creates and exports the volume."""
         context = context.elevated()
         volume_ref = self.db.volume_get(context, volume_id)
-        logging.info("volume %s: creating", volume_ref['name'])
+        logging.info(_("volume %s: creating"), volume_ref['name'])
 
         self.db.volume_update(context,
                               volume_id,
@@ -100,38 +98,36 @@ class VolumeManager(manager.Manager):
         #             before passing it to the driver.
         volume_ref['host'] = self.host
 
-        logging.debug("volume %s: creating lv of size %sG",
+        logging.debug(_("volume %s: creating lv of size %sG"),
                       volume_ref['name'], volume_ref['size'])
-        yield self.driver.create_volume(volume_ref)
+        self.driver.create_volume(volume_ref)
 
-        logging.debug("volume %s: creating export", volume_ref['name'])
-        yield self.driver.create_export(context, volume_ref)
+        logging.debug(_("volume %s: creating export"), volume_ref['name'])
+        self.driver.create_export(context, volume_ref)
 
         now = datetime.datetime.utcnow()
         self.db.volume_update(context,
                               volume_ref['id'], {'status': 'available',
                                                  'launched_at': now})
-        logging.debug("volume %s: created successfully", volume_ref['name'])
-        defer.returnValue(volume_id)
+        logging.debug(_("volume %s: created successfully"), volume_ref['name'])
+        return volume_id
 
-    @defer.inlineCallbacks
     def delete_volume(self, context, volume_id):
         """Deletes and unexports volume."""
         context = context.elevated()
         volume_ref = self.db.volume_get(context, volume_id)
         if volume_ref['attach_status'] == "attached":
-            raise exception.Error("Volume is still attached")
+            raise exception.Error(_("Volume is still attached"))
         if volume_ref['host'] != self.host:
-            raise exception.Error("Volume is not local to this node")
-        logging.debug("volume %s: removing export", volume_ref['name'])
-        yield self.driver.remove_export(context, volume_ref)
-        logging.debug("volume %s: deleting", volume_ref['name'])
-        yield self.driver.delete_volume(volume_ref)
+            raise exception.Error(_("Volume is not local to this node"))
+        logging.debug(_("volume %s: removing export"), volume_ref['name'])
+        self.driver.remove_export(context, volume_ref)
+        logging.debug(_("volume %s: deleting"), volume_ref['name'])
+        self.driver.delete_volume(volume_ref)
         self.db.volume_destroy(context, volume_id)
-        logging.debug("volume %s: deleted successfully", volume_ref['name'])
-        defer.returnValue(True)
+        logging.debug(_("volume %s: deleted successfully"), volume_ref['name'])
+        return True
 
-    @defer.inlineCallbacks
     def setup_compute_volume(self, context, volume_id):
         """Setup remote volume on compute host.
 
@@ -139,17 +135,16 @@ class VolumeManager(manager.Manager):
         context = context.elevated()
         volume_ref = self.db.volume_get(context, volume_id)
         if volume_ref['host'] == self.host and FLAGS.use_local_volumes:
-            path = yield self.driver.local_path(volume_ref)
+            path = self.driver.local_path(volume_ref)
         else:
-            path = yield self.driver.discover_volume(volume_ref)
-        defer.returnValue(path)
+            path = self.driver.discover_volume(volume_ref)
+        return path
 
-    @defer.inlineCallbacks
     def remove_compute_volume(self, context, volume_id):
         """Remove remote volume on compute host."""
         context = context.elevated()
         volume_ref = self.db.volume_get(context, volume_id)
         if volume_ref['host'] == self.host and FLAGS.use_local_volumes:
-            defer.returnValue(True)
+            return True
         else:
-            yield self.driver.undiscover_volume(volume_ref)
+            self.driver.undiscover_volume(volume_ref)
diff --git a/run_tests.py b/run_tests.py
index 3d427d8af..312ed7ef3 100644
--- a/run_tests.py
+++ b/run_tests.py
@@ -39,10 +39,16 @@ Due to our use of multiprocessing it we frequently get some ignorable
 
 """
 
+import eventlet
+eventlet.monkey_patch()
+
 import __main__
+import gettext
 import os
 import sys
 
+gettext.install('nova', unicode=1)
+
 from twisted.scripts import trial as trial_script
 
 from nova import flags
@@ -54,17 +60,15 @@ from nova.tests.auth_unittest import *
 from nova.tests.cloud_unittest import *
 from nova.tests.compute_unittest import *
 from nova.tests.flags_unittest import *
+from nova.tests.middleware_unittest import *
 from nova.tests.misc_unittest import *
 from nova.tests.network_unittest import *
-from nova.tests.objectstore_unittest import *
-from nova.tests.process_unittest import *
+#from nova.tests.objectstore_unittest import *
 from nova.tests.quota_unittest import *
 from nova.tests.rpc_unittest import *
 from nova.tests.scheduler_unittest import *
 from nova.tests.service_unittest import *
 from nova.tests.twistd_unittest import *
-from nova.tests.validator_unittest import *
-from nova.tests.virt_unittest import *
 from nova.tests.virt_unittest import *
 from nova.tests.volume_unittest import *
 
diff --git a/smoketests/admin_smoketests.py b/smoketests/admin_smoketests.py
new file mode 100644
index 000000000..50bb3fa2e
--- /dev/null
+++ b/smoketests/admin_smoketests.py
@@ -0,0 +1,92 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2010 United States Government as represented by the
+# Administrator of the National Aeronautics and Space Administration.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+import os
+import random
+import sys
+import time
+import unittest
+import zipfile
+
+from nova import adminclient
+from smoketests import flags
+from smoketests import base
+
+
+SUITE_NAMES = '[user]'
+
+FLAGS = flags.FLAGS
+flags.DEFINE_string('suite', None, 'Specific test suite to run ' + SUITE_NAMES)
+
+# TODO(devamcar): Use random tempfile
+ZIP_FILENAME = '/tmp/nova-me-x509.zip'
+
+TEST_PREFIX = 'test%s' % int(random.random()*1000000)
+TEST_USERNAME = '%suser' % TEST_PREFIX
+TEST_PROJECTNAME = '%sproject' % TEST_PREFIX
+
+
+class AdminSmokeTestCase(base.SmokeTestCase):
+    def setUp(self):
+        self.admin = adminclient.NovaAdminClient(
+            access_key=os.getenv('EC2_ACCESS_KEY'),
+            secret_key=os.getenv('EC2_SECRET_KEY'),
+            clc_url=os.getenv('EC2_URL'),
+            region=FLAGS.region)
+
+
+class UserTests(AdminSmokeTestCase):
+    """ Test admin credentials and user creation. """
+
+    def test_001_admin_can_connect(self):
+        conn = self.admin.connection_for('admin', 'admin')
+        self.assert_(conn)
+
+    def test_002_admin_can_create_user(self):
+        user = self.admin.create_user(TEST_USERNAME)
+        self.assertEqual(user.username, TEST_USERNAME)
+
+    def test_003_admin_can_create_project(self):
+        project = self.admin.create_project(TEST_PROJECTNAME,
+                                            TEST_USERNAME)
+        self.assertEqual(project.projectname, TEST_PROJECTNAME)
+
+    def test_004_user_can_download_credentials(self):
+        buf = self.admin.get_zip(TEST_USERNAME, TEST_PROJECTNAME)
+        output = open(ZIP_FILENAME, 'w')
+        output.write(buf)
+        output.close()
+
+        zip = zipfile.ZipFile(ZIP_FILENAME, 'a', zipfile.ZIP_DEFLATED)
+        bad = zip.testzip()
+        zip.close()
+
+        self.failIf(bad)
+
+    def test_999_tearDown(self):
+        self.admin.delete_project(TEST_PROJECTNAME)
+        self.admin.delete_user(TEST_USERNAME)
+        try:
+            os.remove(ZIP_FILENAME)
+        except:
+            pass
+
+if __name__ == "__main__":
+    suites = {'user': unittest.makeSuite(UserTests)}
+    sys.exit(base.run_tests(suites))
+
diff --git a/smoketests/novatestcase.py b/smoketests/base.py
index 513e0ca91..5a14d3e09 100644
--- a/smoketests/novatestcase.py
+++ b/smoketests/base.py
@@ -16,36 +16,26 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
+import boto
 import commands
+import httplib
 import os
+import paramiko
 import random
 import sys
 import unittest
+from boto.ec2.regioninfo import RegionInfo
 
-
-import paramiko
-
-from nova import adminclient
 from smoketests import flags
 
 FLAGS = flags.FLAGS
 
 
-class NovaTestCase(unittest.TestCase):
-    def setUp(self):
-        self.nova_admin = adminclient.NovaAdminClient(
-            access_key=FLAGS.admin_access_key,
-            secret_key=FLAGS.admin_secret_key,
-            clc_ip=FLAGS.clc_ip)
-
-    def tearDown(self):
-        pass
-
+class SmokeTestCase(unittest.TestCase):
     def connect_ssh(self, ip, key_name):
         # TODO(devcamcar): set a more reasonable connection timeout time
         key = paramiko.RSAKey.from_private_key_file('/tmp/%s.pem' % key_name)
         client = paramiko.SSHClient()
-        client.load_system_host_keys()
         client.set_missing_host_key_policy(paramiko.WarningPolicy())
         client.connect(ip, username='root', pkey=key)
         stdin, stdout, stderr = client.exec_command('uptime')
@@ -53,26 +43,50 @@ class NovaTestCase(unittest.TestCase):
         return client
 
     def can_ping(self, ip):
-        return commands.getstatusoutput('ping -c 1 %s' % ip)[0] == 0
-
-    @property
-    def admin(self):
-        return self.nova_admin.connection_for('admin')
-
-    def connection_for(self, username):
-        return self.nova_admin.connection_for(username)
-
-    def create_user(self, username):
-        return self.nova_admin.create_user(username)
-
-    def get_user(self, username):
-        return self.nova_admin.get_user(username)
-
-    def delete_user(self, username):
-        return self.nova_admin.delete_user(username)
-
-    def get_signed_zip(self, username):
-        return self.nova_admin.get_zip(username)
+        """ Attempt to ping the specified IP, and give up after 1 second. """
+
+        # NOTE(devcamcar): ping timeout flag is different in OSX.
+        if sys.platform == 'darwin':
+            timeout_flag = 't'
+        else:
+            timeout_flag = 'w'
+
+        status, output = commands.getstatusoutput('ping -c1 -%s1 %s' %
+                                                  (timeout_flag, ip))
+        return status == 0
+
+    def connection_for_env(self, **kwargs):
+        """
+        Returns a boto ec2 connection for the current environment.
+        """
+        access_key = os.getenv('EC2_ACCESS_KEY')
+        secret_key = os.getenv('EC2_SECRET_KEY')
+        clc_url = os.getenv('EC2_URL')
+
+        if not access_key or not secret_key or not clc_url:
+            raise Exception('Missing EC2 environment variables. Please source '
+                            'the appropriate novarc file before running this '
+                            'test.')
+
+        parts = self.split_clc_url(clc_url)
+        return boto.connect_ec2(aws_access_key_id=access_key,
+                                aws_secret_access_key=secret_key,
+                                is_secure=parts['is_secure'],
+                                region=RegionInfo(None,
+                                                  'nova',
+                                                  parts['ip']),
+                                port=parts['port'],
+                                path='/services/Cloud',
+                                **kwargs)
+
+    def split_clc_url(self, clc_url):
+        """
+        Splits a cloud controller endpoint url.
+        """
+        parts = httplib.urlsplit(clc_url)
+        is_secure = parts.scheme == 'https'
+        ip, port = parts.netloc.split(':')
+        return {'ip': ip, 'port': int(port), 'is_secure': is_secure}
 
     def create_key_pair(self, conn, key_name):
         try:
@@ -116,15 +130,25 @@ class NovaTestCase(unittest.TestCase):
             raise Exception(output)
         return True
 
-    def register_image(self, bucket_name, manifest):
-        conn = nova_admin.connection_for('admin')
-        return conn.register_image("%s/%s.manifest.xml" % (bucket_name, manifest))
+def run_tests(suites):
+    argv = FLAGS(sys.argv)
+
+    if not os.getenv('EC2_ACCESS_KEY'):
+        print >> sys.stderr, 'Missing EC2 environment variables. Please ' \
+                             'source the appropriate novarc file before ' \
+                             'running this test.'
+        return 1
+
+    if FLAGS.suite:
+        try:
+            suite = suites[FLAGS.suite]
+        except KeyError:
+            print >> sys.stderr, 'Available test suites:', \
+                                 ', '.join(suites.keys())
+            return 1
 
-    def setUp_test_image(self, image, kernel=False):
-        self.bundle_image(image, kernel=kernel)
-        bucket = "auto_test_%s" % int(random.random() * 1000000)
-        self.upload_image(bucket, image)
-        return self.register_image(bucket, image)
+        unittest.TextTestRunner(verbosity=2).run(suite)
+    else:
+        for suite in suites.itervalues():
+            unittest.TextTestRunner(verbosity=2).run(suite)
 
-    def tearDown_test_image(self, conn, image_id):
-        conn.deregister_image(image_id)
diff --git a/smoketests/flags.py b/smoketests/flags.py
index 3617fb797..ae4d09508 100644
--- a/smoketests/flags.py
+++ b/smoketests/flags.py
@@ -1,7 +1,7 @@
 # vim: tabstop=4 shiftwidth=4 softtabstop=4
 
 # Copyright 2010 United States Government as represented by the
-# Administrator of the National Aeronautics and Space Administration. 
+# Administrator of the National Aeronautics and Space Administration.
 # All Rights Reserved.
 #
 #    Licensed under the Apache License, Version 2.0 (the "License"); you may
@@ -33,13 +33,6 @@ DEFINE_bool = DEFINE_bool
 # __GLOBAL FLAGS ONLY__
 # Define any app-specific flags in their own files, docs at:
 # http://code.google.com/p/python-gflags/source/browse/trunk/gflags.py#39
-DEFINE_string('admin_access_key', 'admin', 'Access key for admin user')
-DEFINE_string('admin_secret_key', 'admin', 'Secret key for admin user')
-DEFINE_string('clc_ip', '127.0.0.1', 'IP of cloud controller API')
-DEFINE_string('bundle_kernel', 'openwrt-x86-vmlinuz',
-              'Local kernel file to use for bundling tests')
-DEFINE_string('bundle_image', 'openwrt-x86-ext2.image',
-              'Local image file to use for bundling tests')
-#DEFINE_string('vpn_image_id', 'ami-CLOUDPIPE',
-#                    'AMI for cloudpipe vpn server')
+DEFINE_string('region', 'nova', 'Region to use')
+DEFINE_string('test_image', 'ami-tiny', 'Image to use for launch tests')
 
diff --git a/smoketests/smoketest.py b/smoketests/smoketest.py
deleted file mode 100644
index ad95114d4..000000000
--- a/smoketests/smoketest.py
+++ /dev/null
@@ -1,566 +0,0 @@
-# vim: tabstop=4 shiftwidth=4 softtabstop=4
-
-# Copyright 2010 United States Government as represented by the
-# Administrator of the National Aeronautics and Space Administration.
-# All Rights Reserved.
-#
-#    Licensed under the Apache License, Version 2.0 (the "License"); you may
-#    not use this file except in compliance with the License. You may obtain
-#    a copy of the License at
-#
-#         http://www.apache.org/licenses/LICENSE-2.0
-#
-#    Unless required by applicable law or agreed to in writing, software
-#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-#    License for the specific language governing permissions and limitations
-#    under the License.
-
-import commands
-import os
-import random
-import re
-import sys
-import time
-import unittest
-import zipfile
-
-
-import paramiko
-
-from smoketests import flags
-from smoketests import novatestcase
-
-SUITE_NAMES = '[user, image, security, public_network, volume]'
-
-FLAGS = flags.FLAGS
-flags.DEFINE_string('suite', None, 'Specific test suite to run ' + SUITE_NAMES)
-
-# TODO(devamcar): Use random tempfile
-ZIP_FILENAME = '/tmp/nova-me-x509.zip'
-
-data = {}
-
-test_prefix = 'test%s' % int(random.random()*1000000)
-test_username = '%suser' % test_prefix
-test_bucket = '%s_bucket' % test_prefix
-test_key = '%s_key' % test_prefix
-
-# Test admin credentials and user creation
-class UserTests(novatestcase.NovaTestCase):
-    def test_001_admin_can_connect(self):
-        conn = self.connection_for('admin')
-        self.assert_(conn)
-
-    def test_002_admin_can_create_user(self):
-        userinfo = self.create_user(test_username)
-        self.assertEqual(userinfo.username, test_username)
-
-    def test_003_user_can_download_credentials(self):
-        buf = self.get_signed_zip(test_username)
-        output = open(ZIP_FILENAME, 'w')
-        output.write(buf)
-        output.close()
-
-        zip = zipfile.ZipFile(ZIP_FILENAME, 'a', zipfile.ZIP_DEFLATED)
-        bad = zip.testzip()
-        zip.close()
-
-        self.failIf(bad)
-
-    def test_999_tearDown(self):
-        self.delete_user(test_username)
-        user = self.get_user(test_username)
-        self.assert_(user is None)
-        try:
-            os.remove(ZIP_FILENAME)
-        except:
-            pass
-
-# Test image bundling, registration, and launching
-class ImageTests(novatestcase.NovaTestCase):
-    def test_000_setUp(self):
-        self.create_user(test_username)
-
-    def test_001_admin_can_bundle_image(self):
-        self.assertTrue(self.bundle_image(FLAGS.bundle_image))
-
-    def test_002_admin_can_upload_image(self):
-        self.assertTrue(self.upload_image(test_bucket, FLAGS.bundle_image))
-
-    def test_003_admin_can_register_image(self):
-        image_id = self.register_image(test_bucket, FLAGS.bundle_image)
-        self.assert_(image_id is not None)
-        data['image_id'] = image_id
-
-    def test_004_admin_can_bundle_kernel(self):
-        self.assertTrue(self.bundle_image(FLAGS.bundle_kernel, kernel=True))
-
-    def test_005_admin_can_upload_kernel(self):
-        self.assertTrue(self.upload_image(test_bucket, FLAGS.bundle_kernel))
-
-    def test_006_admin_can_register_kernel(self):
-        # FIXME(devcamcar): registration should verify that bucket/manifest
-        # exists before returning successfully.
-        kernel_id = self.register_image(test_bucket, FLAGS.bundle_kernel)
-        self.assert_(kernel_id is not None)
-        data['kernel_id'] = kernel_id
-
-    def test_007_admin_images_are_available_within_10_seconds(self):
-        for i in xrange(10):
-            image = self.admin.get_image(data['image_id'])
-            if image and image.state == 'available':
-                break
-            time.sleep(1)
-        else:
-            print image.state
-            self.assert_(False) # wasn't available within 10 seconds
-        self.assert_(image.type == 'machine')
-
-        for i in xrange(10):
-            kernel = self.admin.get_image(data['kernel_id'])
-            if kernel and kernel.state == 'available':
-                break
-            time.sleep(1)
-        else:
-            self.assert_(False) # wasn't available within 10 seconds
-        self.assert_(kernel.type == 'kernel')
-
-    def test_008_admin_can_describe_image_attribute(self):
-        attrs = self.admin.get_image_attribute(data['image_id'],
-                                               'launchPermission')
-        self.assert_(attrs.name, 'launch_permission')
-        
-    def test_009_me_cannot_see_non_public_images(self):
-        conn = self.connection_for(test_username)
-        images = conn.get_all_images(image_ids=[data['image_id']])
-        self.assertEqual(len(images), 0)
-
-    def test_010_admin_can_modify_image_launch_permission(self):
-        conn = self.connection_for(test_username)
-
-        self.admin.modify_image_attribute(image_id=data['image_id'],
-                                          operation='add',
-                                          attribute='launchPermission',
-                                          groups='all')
-
-        image = conn.get_image(data['image_id'])
-        self.assertEqual(image.id, data['image_id'])
-
-    def test_011_me_can_list_public_images(self):
-        conn = self.connection_for(test_username)
-        images = conn.get_all_images(image_ids=[data['image_id']])
-        self.assertEqual(len(images), 1)
-        pass
-        
-    def test_012_me_can_see_launch_permission(self):
-        attrs = self.admin.get_image_attribute(data['image_id'],
-                                               'launchPermission')
-        self.assert_(attrs.name, 'launch_permission')
-        self.assert_(attrs.groups[0], 'all')
-        
-    # FIXME: add tests that user can launch image
-
-#     def test_013_user_can_launch_admin_public_image(self):
-#         # TODO: Use openwrt kernel instead of default kernel
-#         conn = self.connection_for(test_username)
-#         reservation = conn.run_instances(data['image_id'])
-#         self.assertEqual(len(reservation.instances), 1)
-#         data['my_instance_id'] = reservation.instances[0].id
-
-#     def test_014_instances_launch_within_30_seconds(self):
-#         pass
-
-#     def test_015_user_can_terminate(self):
-#         conn = self.connection_for(test_username)
-#         terminated = conn.terminate_instances(
-#            instance_ids=[data['my_instance_id']])
-#         self.assertEqual(len(terminated), 1)
-
-    def test_016_admin_can_deregister_kernel(self):
-        self.assertTrue(self.admin.deregister_image(data['kernel_id']))
-
-    def test_017_admin_can_deregister_image(self):
-        self.assertTrue(self.admin.deregister_image(data['image_id']))
-
-    def test_018_admin_can_delete_bundle(self):
-        self.assertTrue(self.delete_bundle_bucket(test_bucket))
-
-    def test_999_tearDown(self):
-        data = {}
-        self.delete_user(test_username)
-
-
-# Test key pairs and security groups
-class SecurityTests(novatestcase.NovaTestCase):
-    def test_000_setUp(self):
-        self.create_user(test_username + '_me')
-        self.create_user(test_username + '_you')
-        data['image_id'] = 'ami-tiny'
-
-    def test_001_me_can_create_keypair(self):
-        conn = self.connection_for(test_username + '_me')
-        key = self.create_key_pair(conn, test_key)
-        self.assertEqual(key.name, test_key)
-
-    def test_002_you_can_create_keypair(self):
-        conn = self.connection_for(test_username + '_you')
-        key = self.create_key_pair(conn, test_key+ 'yourkey')
-        self.assertEqual(key.name, test_key+'yourkey')
-
-    def test_003_me_can_create_instance_with_keypair(self):
-        conn = self.connection_for(test_username + '_me')
-        reservation = conn.run_instances(data['image_id'], key_name=test_key)
-        self.assertEqual(len(reservation.instances), 1)
-        data['my_instance_id'] = reservation.instances[0].id
-
-    def test_004_me_can_obtain_private_ip_within_60_seconds(self):
-        conn = self.connection_for(test_username + '_me')
-        reservations = conn.get_all_instances([data['my_instance_id']])
-        instance = reservations[0].instances[0]
-        # allow 60 seconds to exit pending with IP
-        for x in xrange(60):
-            instance.update()
-            if instance.state != u'pending':
-                 break
-            time.sleep(1)
-        else:
-            self.assert_(False)
-        # self.assertEqual(instance.state, u'running')
-        ip = reservations[0].instances[0].private_dns_name
-        self.failIf(ip == '0.0.0.0')
-        data['my_private_ip'] = ip
-        print data['my_private_ip'],
-
-    def test_005_can_ping_private_ip(self):
-        for x in xrange(120):
-            # ping waits for 1 second
-            status, output = commands.getstatusoutput(
-                'ping -c1 -w1 %s' % data['my_private_ip'])
-            if status == 0:
-                 break
-        else:
-            self.assert_('could not ping instance')
-    #def test_005_me_cannot_ssh_when_unauthorized(self):
-    #    self.assertRaises(paramiko.SSHException, self.connect_ssh,
-    #                      data['my_private_ip'], 'mykey')
-
-    #def test_006_me_can_authorize_ssh(self):
-    #    conn = self.connection_for(test_username + '_me')
-    #    self.assertTrue(
-    #        conn.authorize_security_group(
-    #            'default',
-    #            ip_protocol='tcp',
-    #            from_port=22,
-    #            to_port=22,
-    #            cidr_ip='0.0.0.0/0'
-    #        )
-    #    )
-
-    def test_007_me_can_ssh_when_authorized(self):
-        conn = self.connect_ssh(data['my_private_ip'], test_key)
-        conn.close()
-
-    #def test_008_me_can_revoke_ssh_authorization(self):
-    #    conn = self.connection_for('me')
-    #    self.assertTrue(
-    #        conn.revoke_security_group(
-    #            'default',
-    #            ip_protocol='tcp',
-    #            from_port=22,
-    #            to_port=22,
-    #            cidr_ip='0.0.0.0/0'
-    #        )
-    #    )
-
-    #def test_009_you_cannot_ping_my_instance(self):
-        # TODO: should ping my_private_ip from with an instance started by you.
-        #self.assertFalse(self.can_ping(data['my_private_ip']))
-
-    def test_010_you_cannot_ssh_to_my_instance(self):
-        try:
-            conn = self.connect_ssh(data['my_private_ip'],
-                                    test_key + 'yourkey')
-            conn.close()
-        except paramiko.SSHException:
-            pass
-        else:
-            self.fail("expected SSHException")
-
-    def test_999_tearDown(self):
-        conn = self.connection_for(test_username + '_me')
-        self.delete_key_pair(conn, test_key)
-        if data.has_key('my_instance_id'):
-            conn.terminate_instances([data['my_instance_id']])
-
-        conn = self.connection_for(test_username + '_you')
-        self.delete_key_pair(conn, test_key + 'yourkey')
-
-        conn = self.connection_for('admin')
-        self.delete_user(test_username + '_me')
-        self.delete_user(test_username + '_you')
-        #self.tearDown_test_image(conn, data['image_id'])
-
-# TODO: verify wrt image boots
-#       build python into wrt image
-#       build boto/m2crypto into wrt image
-#       build euca2ools into wrt image
-#       build a script to download and unpack credentials
-#         - return "ok" to stdout for comparison in self.assertEqual()
-#       build a script to bundle the instance
-#       build a script to upload the bundle
-
-# status, output = commands.getstatusoutput('cmd')
-# if status == 0:
-#    print 'ok'
-# else:
-#    print output
-
-# Testing rebundling
-class RebundlingTests(novatestcase.NovaTestCase):
-    def test_000_setUp(self):
-        self.create_user('me')
-        self.create_user('you')
-        # TODO: create keypair for me
-        #       upload smoketest img
-        #       run instance
-
-    def test_001_me_can_download_credentials_within_instance(self):
-        conn = self.connect_ssh(data['my_private_ip'], 'mykey')
-        stdin, stdout = conn.exec_command(
-            'python ~/smoketests/install-credentials.py')
-        conn.close()
-        self.assertEqual(stdout, 'ok')
-
-    def test_002_me_can_rebundle_within_instance(self):
-        conn = self.connect_ssh(data['my_private_ip'], 'mykey')
-        stdin, stdout = conn.exec_command(
-            'python ~/smoketests/rebundle-instance.py')
-        conn.close()
-        self.assertEqual(stdout, 'ok')
-
-    def test_003_me_can_upload_image_within_instance(self):
-        conn = self.connect_ssh(data['my_private_ip'], 'mykey')
-        stdin, stdout = conn.exec_command(
-            'python ~/smoketests/upload-bundle.py')
-        conn.close()
-        self.assertEqual(stdout, 'ok')
-
-    def test_004_me_can_register_image_within_instance(self):
-        conn = self.connect_ssh(data['my_private_ip'], 'mykey')
-        stdin, stdout = conn.exec_command(
-            'python ~/smoketests/register-image.py')
-        conn.close()
-        if re.matches('ami-{\w+}', stdout):
-            data['my_image_id'] = stdout.strip()
-        else:
-            self.fail('expected ami-nnnnnn, got:\n ' + stdout)
-
-    def test_005_you_cannot_see_my_private_image(self):
-        conn = self.connection_for('you')
-        image = conn.get_image(data['my_image_id'])
-        self.assertEqual(image, None)
-
-    def test_006_me_can_make_image_public(self):
-        conn = self.connection_for(test_username)
-        conn.modify_image_attribute(image_id=data['my_image_id'],
-                                    operation='add',
-                                    attribute='launchPermission',
-                                    groups='all')
-
-    def test_007_you_can_see_my_public_image(self):
-        conn = self.connection_for('you')
-        image = conn.get_image(data['my_image_id'])
-        self.assertEqual(image.id, data['my_image_id'])
-
-    def test_999_tearDown(self):
-        self.delete_user('me')
-        self.delete_user('you')
-
-        #if data.has_key('image_id'):
-            # deregister rebundled image
-
-            # TODO: tear down instance
-            #       delete keypairs
-        data = {}
-
-# Test elastic IPs
-class ElasticIPTests(novatestcase.NovaTestCase):
-    def test_000_setUp(self):
-        data['image_id'] = 'ami-tiny'
-
-        self.create_user('me')
-        conn = self.connection_for('me')
-        self.create_key_pair(conn, 'mykey')
-
-        conn = self.connection_for('admin')
-        #data['image_id'] = self.setUp_test_image(FLAGS.bundle_image)
-
-    def test_001_me_can_launch_image_with_keypair(self):
-        conn = self.connection_for('me')
-        reservation = conn.run_instances(data['image_id'], key_name='mykey')
-        self.assertEqual(len(reservation.instances), 1)
-        data['my_instance_id'] = reservation.instances[0].id
-
-    def test_002_me_can_allocate_elastic_ip(self):
-        conn = self.connection_for('me')
-        data['my_public_ip'] = conn.allocate_address()
-        self.assert_(data['my_public_ip'].public_ip)
-
-    def test_003_me_can_associate_ip_with_instance(self):
-        self.assertTrue(data['my_public_ip'].associate(data['my_instance_id']))
-
-    def test_004_me_can_ssh_with_public_ip(self):
-        conn = self.connect_ssh(data['my_public_ip'].public_ip, 'mykey')
-        conn.close()
-
-    def test_005_me_can_disassociate_ip_from_instance(self):
-        self.assertTrue(data['my_public_ip'].disassociate())
-
-    def test_006_me_can_deallocate_elastic_ip(self):
-        self.assertTrue(data['my_public_ip'].delete())
-
-    def test_999_tearDown(self):
-        conn = self.connection_for('me')
-        self.delete_key_pair(conn, 'mykey')
-
-        conn = self.connection_for('admin')
-        #self.tearDown_test_image(conn, data['image_id'])
-        data = {}
-
-ZONE = 'nova'
-DEVICE = 'vdb'
-# Test iscsi volumes
-class VolumeTests(novatestcase.NovaTestCase):
-    def test_000_setUp(self):
-        self.create_user(test_username)
-        data['image_id'] = 'ami-tiny' # A7370FE3
-
-        conn = self.connection_for(test_username)
-        self.create_key_pair(conn, test_key)
-        reservation = conn.run_instances(data['image_id'],
-                                         instance_type='m1.tiny',
-                                         key_name=test_key)
-        data['instance_id'] = reservation.instances[0].id
-        data['private_ip'] = reservation.instances[0].private_dns_name
-        # wait for instance to show up
-        for x in xrange(120):
-            # ping waits for 1 second
-            status, output = commands.getstatusoutput(
-                'ping -c1 -w1 %s' % data['private_ip'])
-            if status == 0:
-                  break
-        else:
-            self.fail('unable to ping instance')
-
-    def test_001_me_can_create_volume(self):
-        conn = self.connection_for(test_username)
-        volume = conn.create_volume(1, ZONE)
-        self.assertEqual(volume.size, 1)
-        data['volume_id'] = volume.id
-        # give network time to find volume
-        time.sleep(5)
-
-    def test_002_me_can_attach_volume(self):
-        conn = self.connection_for(test_username)
-        conn.attach_volume(
-            volume_id = data['volume_id'],
-            instance_id = data['instance_id'],
-             device = '/dev/%s' % DEVICE
-        )
-        # give instance time to recognize volume
-        time.sleep(5)
-
-    def test_003_me_can_mount_volume(self):
-        conn = self.connect_ssh(data['private_ip'], test_key)
-        # FIXME(devcamcar): the tiny image doesn't create the node properly
-        # this will make /dev/vd* if it doesn't exist
-        stdin, stdout, stderr = conn.exec_command(
-            'grep %s /proc/partitions |' + \
-            '`awk \'{print "mknod /dev/"$4" b "$1" "$2}\'`' % DEVICE)
-        commands = []
-        commands.append('mkdir -p /mnt/vol')
-        commands.append('mkfs.ext2 /dev/%s' % DEVICE)
-        commands.append('mount /dev/%s /mnt/vol' % DEVICE)
-        commands.append('echo success')
-        stdin, stdout, stderr = conn.exec_command(' && '.join(commands))
-        out = stdout.read()
-        conn.close()
-        if not out.strip().endswith('success'):
-            self.fail('Unable to mount: %s %s' % (out, stderr.read()))
-
-    def test_004_me_can_write_to_volume(self):
-        conn = self.connect_ssh(data['private_ip'], test_key)
-        # FIXME(devcamcar): This doesn't fail if the volume hasn't been mounted
-        stdin, stdout, stderr = conn.exec_command(
-            'echo hello > /mnt/vol/test.txt')
-        err = stderr.read()
-        conn.close()
-        if len(err) > 0:
-            self.fail('Unable to write to mount: %s' % (err))
-
-    def test_005_volume_is_correct_size(self):
-        conn = self.connect_ssh(data['private_ip'], test_key)
-        stdin, stdout, stderr = conn.exec_command(
-            "df -h | grep %s | awk {'print $2'}" % DEVICE)
-        out = stdout.read()
-        conn.close()
-        if not out.strip() == '1007.9M':
-            self.fail('Volume is not the right size: %s %s' % (out, stderr.read()))
-
-    def test_006_me_can_umount_volume(self):
-        conn = self.connect_ssh(data['private_ip'], test_key)
-        stdin, stdout, stderr = conn.exec_command('umount /mnt/vol')
-        err = stderr.read()
-        conn.close()
-        if len(err) > 0:
-            self.fail('Unable to unmount: %s' % (err))
-
-    def test_007_me_can_detach_volume(self):
-        conn = self.connection_for(test_username)
-        self.assertTrue(conn.detach_volume(volume_id = data['volume_id']))
-
-    def test_008_me_can_delete_volume(self):
-        conn = self.connection_for(test_username)
-        self.assertTrue(conn.delete_volume(data['volume_id']))
-
-    def test_009_volume_size_must_be_int(self):
-        conn = self.connection_for(test_username)
-        self.assertRaises(Exception, conn.create_volume, 'foo', ZONE)
-
-    def test_999_tearDown(self):
-        global data
-        conn = self.connection_for(test_username)
-        self.delete_key_pair(conn, test_key)
-        if data.has_key('instance_id'):
-            conn.terminate_instances([data['instance_id']])
-        self.delete_user(test_username)
-        data = {}
-
-def build_suites():
-    return {
-        'user': unittest.makeSuite(UserTests),
-        'image': unittest.makeSuite(ImageTests),
-        'security': unittest.makeSuite(SecurityTests),
-        'public_network': unittest.makeSuite(ElasticIPTests),
-        'volume': unittest.makeSuite(VolumeTests),
-    }
-
-def main():
-    argv = FLAGS(sys.argv)
-    suites = build_suites()
-
-    if FLAGS.suite:
-        try:
-            suite = suites[FLAGS.suite]
-        except KeyError:
-            print >> sys.stderr, 'Available test suites:', SUITE_NAMES
-            return 1
-
-        unittest.TextTestRunner(verbosity=2).run(suite)
-    else:
-        for suite in suites.itervalues():
-            unittest.TextTestRunner(verbosity=2).run(suite)
-
-if __name__ == "__main__":
-    sys.exit(main())
diff --git a/smoketests/user_smoketests.py b/smoketests/user_smoketests.py
new file mode 100644
index 000000000..d29e3aea3
--- /dev/null
+++ b/smoketests/user_smoketests.py
@@ -0,0 +1,326 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2010 United States Government as represented by the
+# Administrator of the National Aeronautics and Space Administration.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+import commands
+import os
+import random
+import socket
+import sys
+import time
+import unittest
+
+from smoketests import flags
+from smoketests import base
+
+
+SUITE_NAMES = '[image, instance, volume]'
+
+FLAGS = flags.FLAGS
+flags.DEFINE_string('suite', None, 'Specific test suite to run ' + SUITE_NAMES)
+flags.DEFINE_string('bundle_kernel', 'openwrt-x86-vmlinuz',
+              'Local kernel file to use for bundling tests')
+flags.DEFINE_string('bundle_image', 'openwrt-x86-ext2.image',
+              'Local image file to use for bundling tests')
+
+TEST_PREFIX = 'test%s' % int (random.random()*1000000)
+TEST_BUCKET = '%s_bucket' % TEST_PREFIX
+TEST_KEY = '%s_key' % TEST_PREFIX
+TEST_DATA = {}
+
+
+class UserSmokeTestCase(base.SmokeTestCase):
+    def setUp(self):
+        global TEST_DATA
+        self.conn = self.connection_for_env()
+        self.data = TEST_DATA
+
+
+class ImageTests(UserSmokeTestCase):
+    def test_001_can_bundle_image(self):
+        self.assertTrue(self.bundle_image(FLAGS.bundle_image))
+
+    def test_002_can_upload_image(self):
+        self.assertTrue(self.upload_image(TEST_BUCKET, FLAGS.bundle_image))
+
+    def test_003_can_register_image(self):
+        image_id = self.conn.register_image('%s/%s.manifest.xml' %
+                                            (TEST_BUCKET, FLAGS.bundle_image))
+        self.assert_(image_id is not None)
+        self.data['image_id'] = image_id
+
+    def test_004_can_bundle_kernel(self):
+        self.assertTrue(self.bundle_image(FLAGS.bundle_kernel, kernel=True))
+
+    def test_005_can_upload_kernel(self):
+        self.assertTrue(self.upload_image(TEST_BUCKET, FLAGS.bundle_kernel))
+
+    def test_006_can_register_kernel(self):
+        kernel_id = self.conn.register_image('%s/%s.manifest.xml' %
+                                             (TEST_BUCKET, FLAGS.bundle_kernel))
+        self.assert_(kernel_id is not None)
+        self.data['kernel_id'] = kernel_id
+
+    def test_007_images_are_available_within_10_seconds(self):
+        for i in xrange(10):
+            image = self.conn.get_image(self.data['image_id'])
+            if image and image.state == 'available':
+                break
+            time.sleep(1)
+        else:
+            print image.state
+            self.assert_(False) # wasn't available within 10 seconds
+        self.assert_(image.type == 'machine')
+
+        for i in xrange(10):
+            kernel = self.conn.get_image(self.data['kernel_id'])
+            if kernel and kernel.state == 'available':
+                break
+            time.sleep(1)
+        else:
+            self.assert_(False) # wasn't available within 10 seconds
+        self.assert_(kernel.type == 'kernel')
+
+    def test_008_can_describe_image_attribute(self):
+        attrs = self.conn.get_image_attribute(self.data['image_id'],
+                                               'launchPermission')
+        self.assert_(attrs.name, 'launch_permission')
+
+    def test_009_can_modify_image_launch_permission(self):
+        self.conn.modify_image_attribute(image_id=self.data['image_id'],
+                                         operation='add',
+                                         attribute='launchPermission',
+                                         groups='all')
+        image = self.conn.get_image(self.data['image_id'])
+        self.assertEqual(image.id, self.data['image_id'])
+
+    def test_010_can_see_launch_permission(self):
+        attrs = self.conn.get_image_attribute(self.data['image_id'],
+                                              'launchPermission')
+        self.assert_(attrs.name, 'launch_permission')
+        self.assert_(attrs.attrs['groups'][0], 'all')
+
+    def test_011_user_can_deregister_kernel(self):
+        self.assertTrue(self.conn.deregister_image(self.data['kernel_id']))
+
+    def test_012_can_deregister_image(self):
+        self.assertTrue(self.conn.deregister_image(self.data['image_id']))
+
+    def test_013_can_delete_bundle(self):
+        self.assertTrue(self.delete_bundle_bucket(TEST_BUCKET))
+
+
+class InstanceTests(UserSmokeTestCase):
+    def test_001_can_create_keypair(self):
+        key = self.create_key_pair(self.conn, TEST_KEY)
+        self.assertEqual(key.name, TEST_KEY)
+
+    def test_002_can_create_instance_with_keypair(self):
+        reservation = self.conn.run_instances(FLAGS.test_image,
+                                              key_name=TEST_KEY,
+                                              instance_type='m1.tiny')
+        self.assertEqual(len(reservation.instances), 1)
+        self.data['instance_id'] = reservation.instances[0].id
+
+    def test_003_instance_runs_within_60_seconds(self):
+        reservations = self.conn.get_all_instances([data['instance_id']])
+        instance = reservations[0].instances[0]
+        # allow 60 seconds to exit pending with IP
+        for x in xrange(60):
+            instance.update()
+            if instance.state == u'running':
+                 break
+            time.sleep(1)
+        else:
+            self.fail('instance failed to start')
+        ip = reservations[0].instances[0].private_dns_name
+        self.failIf(ip == '0.0.0.0')
+        self.data['private_ip'] = ip
+        print self.data['private_ip']
+
+    def test_004_can_ping_private_ip(self):
+        for x in xrange(120):
+            # ping waits for 1 second
+            status, output = commands.getstatusoutput(
+                'ping -c1 %s' % self.data['private_ip'])
+            if status == 0:
+                break
+        else:
+            self.fail('could not ping instance')
+
+    def test_005_can_ssh_to_private_ip(self):
+        for x in xrange(30):
+            try:
+                conn = self.connect_ssh(self.data['private_ip'], TEST_KEY)
+                conn.close()
+            except Exception:
+                time.sleep(1)
+            else:
+                break
+        else:
+            self.fail('could not ssh to instance')
+
+    def test_006_can_allocate_elastic_ip(self):
+        result = self.conn.allocate_address()
+        self.assertTrue(hasattr(result, 'public_ip'))
+        self.data['public_ip'] = result.public_ip
+
+    def test_007_can_associate_ip_with_instance(self):
+        result = self.conn.associate_address(self.data['instance_id'],
+                                             self.data['public_ip'])
+        self.assertTrue(result)
+
+    def test_008_can_ssh_with_public_ip(self):
+        for x in xrange(30):
+            try:
+                conn = self.connect_ssh(self.data['public_ip'], TEST_KEY)
+                conn.close()
+            except socket.error:
+                time.sleep(1)
+            else:
+                break
+        else:
+            self.fail('could not ssh to instance')
+
+    def test_009_can_disassociate_ip_from_instance(self):
+        result = self.conn.disassociate_address(self.data['public_ip'])
+        self.assertTrue(result)
+
+    def test_010_can_deallocate_elastic_ip(self):
+        result = self.conn.release_address(self.data['public_ip'])
+        self.assertTrue(result)
+
+    def test_999_tearDown(self):
+        self.delete_key_pair(self.conn, TEST_KEY)
+        if self.data.has_key('instance_id'):
+            self.conn.terminate_instances([data['instance_id']])
+
+
+class VolumeTests(UserSmokeTestCase):
+    def setUp(self):
+        super(VolumeTests, self).setUp()
+        self.device = '/dev/vdb'
+
+    def test_000_setUp(self):
+        self.create_key_pair(self.conn, TEST_KEY)
+        reservation = self.conn.run_instances(FLAGS.test_image,
+                                              instance_type='m1.tiny',
+                                              key_name=TEST_KEY)
+        instance = reservation.instances[0]
+        self.data['instance'] = instance
+        for x in xrange(120):
+            if self.can_ping(instance.private_dns_name):
+                break
+        else:
+            self.fail('unable to start instance')
+
+    def test_001_can_create_volume(self):
+        volume = self.conn.create_volume(1, 'nova')
+        self.assertEqual(volume.size, 1)
+        self.data['volume'] = volume
+        # Give network time to find volume.
+        time.sleep(5)
+
+    def test_002_can_attach_volume(self):
+        volume = self.data['volume']
+
+        for x in xrange(10):
+            if volume.status == u'available':
+                break
+            time.sleep(5)
+            volume.update()
+        else:
+            self.fail('cannot attach volume with state %s' % volume.status)
+
+        volume.attach(self.data['instance'].id, self.device)
+
+        # Volumes seems to report "available" too soon.
+        for x in xrange(10):
+            if volume.status == u'in-use':
+                break
+            time.sleep(5)
+            volume.update()
+
+        self.assertEqual(volume.status, u'in-use')
+
+        # Give instance time to recognize volume.
+        time.sleep(5)
+
+    def test_003_can_mount_volume(self):
+        ip = self.data['instance'].private_dns_name
+        conn = self.connect_ssh(ip, TEST_KEY)
+        commands = []
+        commands.append('mkdir -p /mnt/vol')
+        commands.append('mkfs.ext2 %s' % self.device)
+        commands.append('mount %s /mnt/vol' % self.device)
+        commands.append('echo success')
+        stdin, stdout, stderr = conn.exec_command(' && '.join(commands))
+        out = stdout.read()
+        conn.close()
+        if not out.strip().endswith('success'):
+            self.fail('Unable to mount: %s %s' % (out, stderr.read()))
+
+    def test_004_can_write_to_volume(self):
+        ip = self.data['instance'].private_dns_name
+        conn = self.connect_ssh(ip, TEST_KEY)
+        # FIXME(devcamcar): This doesn't fail if the volume hasn't been mounted
+        stdin, stdout, stderr = conn.exec_command(
+            'echo hello > /mnt/vol/test.txt')
+        err = stderr.read()
+        conn.close()
+        if len(err) > 0:
+            self.fail('Unable to write to mount: %s' % (err))
+
+    def test_005_volume_is_correct_size(self):
+        ip = self.data['instance'].private_dns_name
+        conn = self.connect_ssh(ip, TEST_KEY)
+        stdin, stdout, stderr = conn.exec_command(
+            "df -h | grep %s | awk {'print $2'}" % self.device)
+        out = stdout.read()
+        conn.close()
+        if not out.strip() == '1008M':
+            self.fail('Volume is not the right size: %s %s' %
+                      (out, stderr.read()))
+
+    def test_006_me_can_umount_volume(self):
+        ip = self.data['instance'].private_dns_name
+        conn = self.connect_ssh(ip, TEST_KEY)
+        stdin, stdout, stderr = conn.exec_command('umount /mnt/vol')
+        err = stderr.read()
+        conn.close()
+        if len(err) > 0:
+            self.fail('Unable to unmount: %s' % (err))
+
+    def test_007_me_can_detach_volume(self):
+        result = self.conn.detach_volume(volume_id=self.data['volume'].id)
+        self.assertTrue(result)
+        time.sleep(5)
+
+    def test_008_me_can_delete_volume(self):
+        result = self.conn.delete_volume(self.data['volume'].id)
+        self.assertTrue(result)
+
+    def test_999_tearDown(self):
+        self.conn.terminate_instances([self.data['instance'].id])
+        self.conn.delete_key_pair(TEST_KEY)
+
+
+if __name__ == "__main__":
+    suites = {'image': unittest.makeSuite(ImageTests),
+              'instance': unittest.makeSuite(InstanceTests),
+              'volume': unittest.makeSuite(VolumeTests)}
+    sys.exit(base.run_tests(suites))
diff --git a/tools/pip-requires b/tools/pip-requires
index 17a1a4c5c..e9559521b 100644
--- a/tools/pip-requires
+++ b/tools/pip-requires
@@ -2,6 +2,7 @@ SQLAlchemy==0.6.3
 pep8==0.5.0
 pylint==0.19
 IPy==0.70
+Cheetah==2.4.2.1
 M2Crypto==0.20.2
 amqplib==0.6.1
 anyjson==0.2.4
@@ -21,3 +22,4 @@ mox==0.5.0
 greenlet==0.3.1
 nose
 bzr
+Twisted>=10.1.0
\ No newline at end of file