Merge w/ trunk.

36 files changed, 435 insertions, 65 deletions

diff --git a/nova/CA/.gitignore b/nova/CA/.gitignore
new file mode 100644
index 000000000..fae0922bf
--- /dev/null
+++ b/nova/CA/.gitignore
@@ -0,0 +1,11 @@
+index.txt
+index.txt.old
+index.txt.attr
+index.txt.attr.old
+cacert.pem
+serial
+serial.old
+openssl.cnf
+private/*
+newcerts/*
+
diff --git a/nova/CA/geninter.sh b/nova/CA/geninter.sh
new file mode 100755
index 000000000..4b7f5a55c
--- /dev/null
+++ b/nova/CA/geninter.sh
@@ -0,0 +1,39 @@
+#!/bin/bash
+
+# Copyright 2010 United States Government as represented by the
+# Administrator of the National Aeronautics and Space Administration.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+# $1 is the id of the project and $2 is the subject of the cert
+NAME=$1
+SUBJ=$2
+mkdir -p projects/$NAME
+cd projects/$NAME
+cp ../../openssl.cnf.tmpl openssl.cnf
+sed -i -e s/%USERNAME%/$NAME/g openssl.cnf
+mkdir -p certs crl newcerts private
+openssl req -new -x509 -extensions v3_ca -keyout private/cakey.pem -out cacert.pem -days 365 -config ./openssl.cnf -batch -nodes
+echo "10" > serial
+touch index.txt
+# NOTE(vish): Disabling intermediate ca's because we don't actually need them.
+#             It makes more sense to have each project have its own root ca.
+# openssl genrsa -out private/cakey.pem 1024 -config ./openssl.cnf -batch -nodes
+# openssl req -new -sha256 -key private/cakey.pem -out ../../reqs/inter$NAME.csr -batch -subj "$SUBJ"
+openssl ca -gencrl -config ./openssl.cnf -out crl.pem
+if [ "`id -u`" != "`grep nova /etc/passwd | cut -d':' -f3`" ]; then
+    sudo chown -R nova:nogroup .
+fi
+# cd ../../
+# openssl ca -extensions v3_ca -days 365 -out INTER/$NAME/cacert.pem -in reqs/inter$NAME.csr -config openssl.cnf -batch
diff --git a/nova/CA/genrootca.sh b/nova/CA/genrootca.sh
new file mode 100755
index 000000000..091cf17fc
--- /dev/null
+++ b/nova/CA/genrootca.sh
@@ -0,0 +1,30 @@
+#!/bin/bash
+
+# Copyright 2010 United States Government as represented by the
+# Administrator of the National Aeronautics and Space Administration.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+if [ -f "cacert.pem" ];
+then
+    echo "Not installing, it's already done."
+else
+    cp "$(dirname $0)/openssl.cnf.tmpl" openssl.cnf
+    sed -i -e s/%USERNAME%/ROOT/g openssl.cnf
+    mkdir -p certs crl newcerts private
+    openssl req -new -x509 -extensions v3_ca -keyout private/cakey.pem -out cacert.pem -days 365 -config ./openssl.cnf -batch -nodes
+    touch index.txt
+    echo "10" > serial
+    openssl ca -gencrl -config ./openssl.cnf -out crl.pem
+fi
diff --git a/nova/CA/genvpn.sh b/nova/CA/genvpn.sh
new file mode 100755
index 000000000..7e7db185d
--- /dev/null
+++ b/nova/CA/genvpn.sh
@@ -0,0 +1,36 @@
+#!/bin/bash
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2010 United States Government as represented by the
+# Administrator of the National Aeronautics and Space Administration.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+# This gets zipped and run on the cloudpipe-managed OpenVPN server
+NAME=$1
+SUBJ=$2
+
+mkdir -p projects/$NAME
+cd projects/$NAME
+
+# generate a server priv key
+openssl genrsa -out server.key 2048
+
+# generate a server CSR
+openssl req -new -key server.key -out server.csr -batch -subj "$SUBJ"
+
+novauid=`getent passwd nova | awk -F: '{print $3}'`
+if [ ! -z "${novauid}" ] && [ "`id -u`" != "${novauid}" ]; then
+    sudo chown -R nova:nogroup .
+fi
diff --git a/nova/CA/newcerts/.placeholder b/nova/CA/newcerts/.placeholder
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/nova/CA/newcerts/.placeholder
diff --git a/nova/CA/openssl.cnf.tmpl b/nova/CA/openssl.cnf.tmpl
new file mode 100644
index 000000000..dd81f1c2b
--- /dev/null
+++ b/nova/CA/openssl.cnf.tmpl
@@ -0,0 +1,90 @@
+# Copyright 2010 United States Government as represented by the
+# Administrator of the National Aeronautics and Space Administration.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+#
+# OpenSSL configuration file.
+#
+
+# Establish working directory.
+
+dir			= .
+
+[ ca ]
+default_ca		= CA_default
+
+[ CA_default ]
+serial			= $dir/serial
+database		= $dir/index.txt
+new_certs_dir		= $dir/newcerts
+certificate		= $dir/cacert.pem
+private_key		= $dir/private/cakey.pem
+unique_subject		= no
+default_crl_days	= 365
+default_days		= 365
+default_md		= md5
+preserve		= no
+email_in_dn		= no
+nameopt			= default_ca
+certopt			= default_ca
+policy			= policy_match
+
+[ policy_match ]
+countryName		= match
+stateOrProvinceName	= match
+organizationName	= optional
+organizationalUnitName	= optional
+commonName		= supplied
+emailAddress		= optional
+
+
+[ req ]
+default_bits		= 1024			# Size of keys
+default_keyfile		= key.pem		# name of generated keys
+default_md		= md5			# message digest algorithm
+string_mask		= nombstr		# permitted characters
+distinguished_name	= req_distinguished_name
+
+[ req_distinguished_name ]
+# Variable name		  Prompt string
+#----------------------	  ----------------------------------
+0.organizationName	= Organization Name (company)
+organizationalUnitName	= Organizational Unit Name (department, division)
+emailAddress		= Email Address
+emailAddress_max	= 40
+localityName		= Locality Name (city, district)
+stateOrProvinceName	= State or Province Name (full name)
+countryName		= Country Name (2 letter code)
+countryName_min		= 2
+countryName_max		= 2
+commonName		= Common Name (hostname, IP, or your name)
+commonName_max		= 64
+
+# Default values for the above, for consistency and less typing.
+# Variable name			  Value
+#------------------------------	  ------------------------------
+0.organizationName_default	= NOVA %USERNAME%
+localityName_default		= Mountain View
+stateOrProvinceName_default	= California
+countryName_default		= US
+
+[ v3_ca ]
+basicConstraints	= CA:TRUE
+subjectKeyIdentifier	= hash
+authorityKeyIdentifier	= keyid:always,issuer:always
+
+[ v3_req ]
+basicConstraints	= CA:FALSE
+subjectKeyIdentifier	= hash
diff --git a/nova/CA/private/.placeholder b/nova/CA/private/.placeholder
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/nova/CA/private/.placeholder
diff --git a/nova/CA/projects/.gitignore b/nova/CA/projects/.gitignore
new file mode 100644
index 000000000..72e8ffc0d
--- /dev/null
+++ b/nova/CA/projects/.gitignore
@@ -0,0 +1 @@
+*
diff --git a/nova/CA/projects/.placeholder b/nova/CA/projects/.placeholder
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/nova/CA/projects/.placeholder
diff --git a/nova/CA/reqs/.gitignore b/nova/CA/reqs/.gitignore
new file mode 100644
index 000000000..72e8ffc0d
--- /dev/null
+++ b/nova/CA/reqs/.gitignore
@@ -0,0 +1 @@
+*
diff --git a/nova/CA/reqs/.placeholder b/nova/CA/reqs/.placeholder
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/nova/CA/reqs/.placeholder
diff --git a/nova/api/direct.py b/nova/api/direct.py
index e5f33cee4..f487df7c7 100644
--- a/nova/api/direct.py
+++ b/nova/api/direct.py
@@ -206,10 +206,14 @@ class ServiceWrapper(wsgi.Controller):
         # NOTE(vish): make sure we have no unicode keys for py2.6.
         params = dict([(str(k), v) for (k, v) in params.iteritems()])
         result = method(context, **params)
+
         if result is None or type(result) is str or type(result) is unicode:
             return result
+
         try:
-            return self._serialize(result, req.best_match_content_type())
+            content_type = req.best_match_content_type()
+            default_xmlns = self.get_default_xmlns(req)
+            return self._serialize(result, content_type, default_xmlns)
         except:
             raise exception.Error("returned non-serializable type: %s"
                                   % result)
diff --git a/nova/api/ec2/cloud.py b/nova/api/ec2/cloud.py
index 458d35faf..e4bcccb2b 100644
--- a/nova/api/ec2/cloud.py
+++ b/nova/api/ec2/cloud.py
@@ -103,10 +103,18 @@ class CloudController(object):
         # Gen root CA, if we don't have one
         root_ca_path = os.path.join(FLAGS.ca_path, FLAGS.ca_file)
         if not os.path.exists(root_ca_path):
+            genrootca_sh_path = os.path.join(os.path.dirname(__file__),
+                                             os.path.pardir,
+                                             os.path.pardir,
+                                             'CA',
+                                             'genrootca.sh')
+
             start = os.getcwd()
+            if not os.path.exists(FLAGS.ca_path):
+                os.makedirs(FLAGS.ca_path)
             os.chdir(FLAGS.ca_path)
             # TODO(vish): Do this with M2Crypto instead
-            utils.runthis(_("Generating root CA: %s"), "sh", "genrootca.sh")
+            utils.runthis(_("Generating root CA: %s"), "sh", genrootca_sh_path)
             os.chdir(start)
 
     def _get_mpi_data(self, context, project_id):
@@ -780,7 +788,7 @@ class CloudController(object):
     def allocate_address(self, context, **kwargs):
         LOG.audit(_("Allocate address"), context=context)
         public_ip = self.network_api.allocate_floating_ip(context)
-        return {'addressSet': [{'publicIp': public_ip}]}
+        return {'publicIp': public_ip}
 
     def release_address(self, context, public_ip, **kwargs):
         LOG.audit(_("Release address %s"), public_ip, context=context)
@@ -889,10 +897,7 @@ class CloudController(object):
         image_type = image['properties'].get('type')
         ec2_id = self._image_ec2_id(image.get('id'), image_type)
         name = image.get('name')
-        if name:
-            i['imageId'] = "%s (%s)" % (ec2_id, name)
-        else:
-            i['imageId'] = ec2_id
+        i['imageId'] = ec2_id
         kernel_id = image['properties'].get('kernel_id')
         if kernel_id:
             i['kernelId'] = self._image_ec2_id(kernel_id, 'kernel')
@@ -900,11 +905,15 @@ class CloudController(object):
         if ramdisk_id:
             i['ramdiskId'] = self._image_ec2_id(ramdisk_id, 'ramdisk')
         i['imageOwnerId'] = image['properties'].get('owner_id')
-        i['imageLocation'] = image['properties'].get('image_location')
+        if name:
+            i['imageLocation'] = "%s (%s)" % (image['properties'].
+                                              get('image_location'), name)
+        else:
+            i['imageLocation'] = image['properties'].get('image_location')
         i['imageState'] = image['properties'].get('image_state')
-        i['displayName'] = image.get('name')
+        i['displayName'] = name
         i['description'] = image.get('description')
-        i['type'] = image_type
+        i['imageType'] = image_type
         i['isPublic'] = str(image['properties'].get('is_public', '')) == 'True'
         i['architecture'] = image['properties'].get('architecture')
         return i
diff --git a/nova/api/openstack/accounts.py b/nova/api/openstack/accounts.py
index 86066fa20..6e3763e47 100644
--- a/nova/api/openstack/accounts.py
+++ b/nova/api/openstack/accounts.py
@@ -13,15 +13,14 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-import common
 import webob.exc
 
 from nova import exception
 from nova import flags
 from nova import log as logging
-from nova import wsgi
 
 from nova.auth import manager
+from nova.api.openstack import common
 from nova.api.openstack import faults
 
 FLAGS = flags.FLAGS
@@ -35,7 +34,7 @@ def _translate_keys(account):
                 manager=account.project_manager_id)
 
 
-class Controller(wsgi.Controller):
+class Controller(common.OpenstackController):
 
     _serialization_metadata = {
         'application/xml': {
diff --git a/nova/api/openstack/backup_schedules.py b/nova/api/openstack/backup_schedules.py
index f2d2d86e8..4bf744046 100644
--- a/nova/api/openstack/backup_schedules.py
+++ b/nova/api/openstack/backup_schedules.py
@@ -19,7 +19,7 @@ import time
 
 from webob import exc
 
-from nova import wsgi
+from nova.api.openstack import common
 from nova.api.openstack import faults
 import nova.image.service
 
@@ -29,7 +29,7 @@ def _translate_keys(inst):
     return dict(backupSchedule=inst)
 
 
-class Controller(wsgi.Controller):
+class Controller(common.OpenstackController):
     """ The backup schedule API controller for the Openstack API """
 
     _serialization_metadata = {
diff --git a/nova/api/openstack/common.py b/nova/api/openstack/common.py
index 75aeb0a5f..234f921ab 100644
--- a/nova/api/openstack/common.py
+++ b/nova/api/openstack/common.py
@@ -22,6 +22,7 @@ import webob
 from nova import exception
 from nova import flags
 from nova import log as logging
+from nova import wsgi
 
 
 LOG = logging.getLogger('common')
@@ -30,6 +31,10 @@ LOG = logging.getLogger('common')
 FLAGS = flags.FLAGS
 
 
+XML_NS_V10 = 'http://docs.rackspacecloud.com/servers/api/v1.0'
+XML_NS_V11 = 'http://docs.openstack.org/compute/api/v1.1'
+
+
 def limited(items, request, max_limit=FLAGS.osapi_max_limit):
     """
     Return a slice of items according to requested offset and limit.
@@ -128,3 +133,9 @@ def get_id_from_href(href):
     except:
         LOG.debug(_("Error extracting id from href: %s") % href)
         raise webob.exc.HTTPBadRequest(_('could not parse id from href'))
+
+
+class OpenstackController(wsgi.Controller):
+    def get_default_xmlns(self, req):
+        # Use V10 by default
+        return XML_NS_V10
diff --git a/nova/api/openstack/consoles.py b/nova/api/openstack/consoles.py
index 8c291c2eb..1a77f25d7 100644
--- a/nova/api/openstack/consoles.py
+++ b/nova/api/openstack/consoles.py
@@ -19,7 +19,7 @@ from webob import exc
 
 from nova import console
 from nova import exception
-from nova import wsgi
+from nova.api.openstack import common
 from nova.api.openstack import faults
 
 
@@ -43,7 +43,7 @@ def _translate_detail_keys(cons):
     return dict(console=info)
 
 
-class Controller(wsgi.Controller):
+class Controller(common.OpenstackController):
     """The Consoles Controller for the Openstack API"""
 
     _serialization_metadata = {
diff --git a/nova/api/openstack/extensions.py b/nova/api/openstack/extensions.py
index fb1dccb28..7ea7afef6 100644
--- a/nova/api/openstack/extensions.py
+++ b/nova/api/openstack/extensions.py
@@ -28,6 +28,7 @@ from nova import exception
 from nova import flags
 from nova import log as logging
 from nova import wsgi
+from nova.api.openstack import common
 from nova.api.openstack import faults
 
 
@@ -115,7 +116,7 @@ class ExtensionDescriptor(object):
         return response_exts
 
 
-class ActionExtensionController(wsgi.Controller):
+class ActionExtensionController(common.OpenstackController):
 
     def __init__(self, application):
 
@@ -136,7 +137,7 @@ class ActionExtensionController(wsgi.Controller):
         return res
 
 
-class ResponseExtensionController(wsgi.Controller):
+class ResponseExtensionController(common.OpenstackController):
 
     def __init__(self, application):
         self.application = application
@@ -155,7 +156,8 @@ class ResponseExtensionController(wsgi.Controller):
                 body = res.body
                 headers = res.headers
             except AttributeError:
-                body = self._serialize(res, content_type)
+                default_xmlns = None
+                body = self._serialize(res, content_type, default_xmlns)
                 headers = {"Content-Type": content_type}
             res = webob.Response()
             res.body = body
@@ -163,7 +165,7 @@ class ResponseExtensionController(wsgi.Controller):
         return res
 
 
-class ExtensionController(wsgi.Controller):
+class ExtensionController(common.OpenstackController):
 
     def __init__(self, extension_manager):
         self.extension_manager = extension_manager
diff --git a/nova/api/openstack/faults.py b/nova/api/openstack/faults.py
index 940bd8771..bc97639a0 100644
--- a/nova/api/openstack/faults.py
+++ b/nova/api/openstack/faults.py
@@ -20,10 +20,10 @@ import webob.dec
 import webob.exc
 
 from nova import wsgi
+from nova.api.openstack import common
 
 
 class Fault(webob.exc.HTTPException):
-
     """An RS API fault response."""
 
     _fault_names = {
@@ -57,7 +57,8 @@ class Fault(webob.exc.HTTPException):
             fault_data[fault_name]['retryAfter'] = retry
         # 'code' is an attribute on the fault tag itself
         metadata = {'application/xml': {'attributes': {fault_name: 'code'}}}
-        serializer = wsgi.Serializer(metadata)
+        default_xmlns = common.XML_NS_V10
+        serializer = wsgi.Serializer(metadata, default_xmlns)
         content_type = req.best_match_content_type()
         self.wrapped_exc.body = serializer.serialize(fault_data, content_type)
         self.wrapped_exc.content_type = content_type
diff --git a/nova/api/openstack/flavors.py b/nova/api/openstack/flavors.py
index 5b99b5a6f..40787bd17 100644
--- a/nova/api/openstack/flavors.py
+++ b/nova/api/openstack/flavors.py
@@ -19,11 +19,11 @@ import webob
 
 from nova import db
 from nova import exception
-from nova import wsgi
+from nova.api.openstack import common
 from nova.api.openstack import views
 
 
-class Controller(wsgi.Controller):
+class Controller(common.OpenstackController):
     """Flavor controller for the OpenStack API."""
 
     _serialization_metadata = {
@@ -76,3 +76,6 @@ class ControllerV11(Controller):
     def _get_view_builder(self, req):
         base_url = req.application_url
         return views.flavors.ViewBuilderV11(base_url)
+
+    def get_default_xmlns(self, req):
+        return common.XML_NS_V11
diff --git a/nova/api/openstack/image_metadata.py b/nova/api/openstack/image_metadata.py
index c9d6ac532..e673e5f7b 100644
--- a/nova/api/openstack/image_metadata.py
+++ b/nova/api/openstack/image_metadata.py
@@ -20,13 +20,14 @@ from webob import exc
 from nova import flags
 from nova import utils
 from nova import wsgi
+from nova.api.openstack import common
 from nova.api.openstack import faults
 
 
 FLAGS = flags.FLAGS
 
 
-class Controller(wsgi.Controller):
+class Controller(common.OpenstackController):
     """The image metadata API controller for the Openstack API"""
 
     def __init__(self):
diff --git a/nova/api/openstack/images.py b/nova/api/openstack/images.py
index e77100d7b..77baf5947 100644
--- a/nova/api/openstack/images.py
+++ b/nova/api/openstack/images.py
@@ -13,8 +13,6 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-import datetime
-
 import webob.exc
 
 from nova import compute
@@ -22,7 +20,6 @@ from nova import exception
 from nova import flags
 from nova import log
 from nova import utils
-from nova import wsgi
 from nova.api.openstack import common
 from nova.api.openstack import faults
 from nova.api.openstack.views import images as images_view
@@ -32,7 +29,7 @@ LOG = log.getLogger('nova.api.openstack.images')
 FLAGS = flags.FLAGS
 
 
-class Controller(wsgi.Controller):
+class Controller(common.OpenstackController):
     """Base `wsgi.Controller` for retrieving/displaying images."""
 
     _serialization_metadata = {
@@ -153,3 +150,6 @@ class ControllerV11(Controller):
         """Property to get the ViewBuilder class we need to use."""
         base_url = request.application_url
         return images_view.ViewBuilderV11(base_url)
+
+    def get_default_xmlns(self, req):
+        return common.XML_NS_V11
diff --git a/nova/api/openstack/limits.py b/nova/api/openstack/limits.py
index efc7d193d..9877af191 100644
--- a/nova/api/openstack/limits.py
+++ b/nova/api/openstack/limits.py
@@ -31,8 +31,8 @@ from collections import defaultdict
 from webob.dec import wsgify
 
 from nova import wsgi
+from nova.api.openstack import common
 from nova.api.openstack import faults
-from nova.wsgi import Controller
 from nova.wsgi import Middleware
 
 
@@ -43,7 +43,7 @@ PER_HOUR = 60 * 60
 PER_DAY = 60 * 60 * 24
 
 
-class LimitsController(Controller):
+class LimitsController(common.OpenstackController):
     """
     Controller for accessing limits in the OpenStack API.
     """
diff --git a/nova/api/openstack/server_metadata.py b/nova/api/openstack/server_metadata.py
index 45bbac99d..5c1390b9c 100644
--- a/nova/api/openstack/server_metadata.py
+++ b/nova/api/openstack/server_metadata.py
@@ -19,10 +19,11 @@ from webob import exc
 
 from nova import compute
 from nova import wsgi
+from nova.api.openstack import common
 from nova.api.openstack import faults
 
 
-class Controller(wsgi.Controller):
+class Controller(common.OpenstackController):
     """ The server metadata API controller for the Openstack API """
 
     def __init__(self):
diff --git a/nova/api/openstack/servers.py b/nova/api/openstack/servers.py
index a2f11bc2b..f379839db 100644
--- a/nova/api/openstack/servers.py
+++ b/nova/api/openstack/servers.py
@@ -44,7 +44,7 @@ LOG = logging.getLogger('server')
 FLAGS = flags.FLAGS
 
 
-class Controller(wsgi.Controller):
+class Controller(common.OpenstackController):
     """ The Server API controller for the OpenStack API """
 
     _serialization_metadata = {
@@ -650,6 +650,9 @@ class ControllerV11(Controller):
     def _limit_items(self, items, req):
         return common.limited_by_marker(items, req)
 
+    def get_default_xmlns(self, req):
+        return common.XML_NS_V11
+
 
 class ServerCreateRequestXMLDeserializer(object):
     """
diff --git a/nova/api/openstack/shared_ip_groups.py b/nova/api/openstack/shared_ip_groups.py
index ee7991d7f..996db3648 100644
--- a/nova/api/openstack/shared_ip_groups.py
+++ b/nova/api/openstack/shared_ip_groups.py
@@ -17,7 +17,7 @@
 
 from webob import exc
 
-from nova import wsgi
+from nova.api.openstack import common
 from nova.api.openstack import faults
 
 
@@ -32,7 +32,7 @@ def _translate_detail_keys(inst):
     return dict(sharedIpGroups=inst)
 
 
-class Controller(wsgi.Controller):
+class Controller(common.OpenstackController):
     """ The Shared IP Groups Controller for the Openstack API """
 
     _serialization_metadata = {
diff --git a/nova/api/openstack/users.py b/nova/api/openstack/users.py
index d3ab3d553..077ccfc79 100644
--- a/nova/api/openstack/users.py
+++ b/nova/api/openstack/users.py
@@ -18,7 +18,6 @@ from webob import exc
 from nova import exception
 from nova import flags
 from nova import log as logging
-from nova import wsgi
 from nova.api.openstack import common
 from nova.api.openstack import faults
 from nova.auth import manager
@@ -35,7 +34,7 @@ def _translate_keys(user):
                 admin=user.admin)
 
 
-class Controller(wsgi.Controller):
+class Controller(common.OpenstackController):
 
     _serialization_metadata = {
         'application/xml': {
diff --git a/nova/api/openstack/zones.py b/nova/api/openstack/zones.py
index 846cb48a1..227ffecdc 100644
--- a/nova/api/openstack/zones.py
+++ b/nova/api/openstack/zones.py
@@ -13,12 +13,10 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-import common
-
 from nova import db
 from nova import flags
 from nova import log as logging
-from nova import wsgi
+from nova.api.openstack import common
 from nova.scheduler import api
 
 
@@ -43,7 +41,7 @@ def _scrub_zone(zone):
                     'deleted', 'deleted_at', 'updated_at'))
 
 
-class Controller(wsgi.Controller):
+class Controller(common.OpenstackController):
 
     _serialization_metadata = {
         'application/xml': {
diff --git a/nova/crypto.py b/nova/crypto.py
index b112e5b92..9b1897926 100644
--- a/nova/crypto.py
+++ b/nova/crypto.py
@@ -215,9 +215,12 @@ def generate_x509_cert(user_id, project_id, bits=1024):
 
 def _ensure_project_folder(project_id):
     if not os.path.exists(ca_path(project_id)):
+        geninter_sh_path = os.path.join(os.path.dirname(__file__),
+                                        'CA',
+                                        'geninter.sh')
         start = os.getcwd()
         os.chdir(ca_folder())
-        utils.execute('sh', 'geninter.sh', project_id,
+        utils.execute('sh', geninter_sh_path, project_id,
                       _project_cert_subject(project_id))
         os.chdir(start)
 
@@ -227,13 +230,16 @@ def generate_vpn_files(project_id):
     csr_fn = os.path.join(project_folder, "server.csr")
     crt_fn = os.path.join(project_folder, "server.crt")
 
+    genvpn_sh_path = os.path.join(os.path.dirname(__file__),
+                                  'CA',
+                                  'geninter.sh')
     if os.path.exists(crt_fn):
         return
     _ensure_project_folder(project_id)
     start = os.getcwd()
     os.chdir(ca_folder())
     # TODO(vish): the shell scripts could all be done in python
-    utils.execute('sh', 'genvpn.sh',
+    utils.execute('sh', genvpn_sh_path,
                   project_id, _vpn_cert_subject(project_id))
     with open(csr_fn, "r") as csrfile:
         csr_text = csrfile.read()
@@ -263,6 +269,8 @@ def _sign_csr(csr_text, ca_folder):
     LOG.debug(_("Flags path: %s"), ca_folder)
     start = os.getcwd()
     # Change working dir to CA
+    if not os.path.exists(ca_folder):
+        os.makedirs(ca_folder)
     os.chdir(ca_folder)
     utils.execute('openssl', 'ca', '-batch', '-out', outbound, '-config',
                   './openssl.cnf', '-infiles', inbound)
diff --git a/nova/tests/api/openstack/test_faults.py b/nova/tests/api/openstack/test_faults.py
index 9746e8168..4d86ffb26 100644
--- a/nova/tests/api/openstack/test_faults.py
+++ b/nova/tests/api/openstack/test_faults.py
@@ -22,6 +22,7 @@ import webob.dec
 import webob.exc
 
 from nova import test
+from nova.api.openstack import common
 from nova.api.openstack import faults
 
 
@@ -47,10 +48,10 @@ class TestFaults(test.TestCase):
             response = request.get_response(fault)
 
             expected = self._prepare_xml("""
-                <badRequest code="400">
+                <badRequest code="400" xmlns="%s">
                     <message>scram</message>
                 </badRequest>
-            """)
+            """ % common.XML_NS_V10)
             actual = self._prepare_xml(response.body)
 
             self.assertEqual(response.content_type, "application/xml")
@@ -91,11 +92,11 @@ class TestFaults(test.TestCase):
             response = request.get_response(fault)
 
             expected = self._prepare_xml("""
-                <overLimit code="413">
+                <overLimit code="413" xmlns="%s">
                     <message>sorry</message>
                     <retryAfter>4</retryAfter>
                 </overLimit>
-            """)
+            """ % common.XML_NS_V10)
             actual = self._prepare_xml(response.body)
 
             self.assertEqual(expected, actual)
diff --git a/nova/tests/api/openstack/test_images.py b/nova/tests/api/openstack/test_images.py
index 69cc3116d..ae86d0686 100644
--- a/nova/tests/api/openstack/test_images.py
+++ b/nova/tests/api/openstack/test_images.py
@@ -146,7 +146,7 @@ class LocalImageServiceTest(_BaseImageServiceTests):
         for x in [1, 2, 3]:
             tempfile.mkstemp(prefix='ami-', dir=self.tempdir)
         # create some valid image directories names
-        for x in ["1485baed", "1a60f0ee",  "3123a73d"]:
+        for x in ["1485baed", "1a60f0ee", "3123a73d"]:
             os.makedirs(os.path.join(self.tempdir, x))
         found_image_ids = self.service._ids()
         self.assertEqual(True, isinstance(found_image_ids, list))
@@ -335,7 +335,8 @@ class ImageControllerWithGlanceServiceTest(test.TestCase):
                     name="public image"
                     updated="%(expected_now)s"
                     created="%(expected_now)s"
-                    status="ACTIVE" />
+                    status="ACTIVE"
+                    xmlns="http://docs.rackspacecloud.com/servers/api/v1.0" />
         """ % (locals()))
 
         self.assertEqual(expected_image.toxml(), actual_image.toxml())
@@ -353,7 +354,8 @@ class ImageControllerWithGlanceServiceTest(test.TestCase):
                     name="None"
                     updated="%(expected_now)s"
                     created="%(expected_now)s"
-                    status="ACTIVE" />
+                    status="ACTIVE"
+                    xmlns="http://docs.rackspacecloud.com/servers/api/v1.0" />
         """ % (locals()))
 
         self.assertEqual(expected_image.toxml(), actual_image.toxml())
@@ -372,7 +374,8 @@ class ImageControllerWithGlanceServiceTest(test.TestCase):
                 name="public image"
                 updated="%(expected_now)s"
                 created="%(expected_now)s"
-                status="ACTIVE">
+                status="ACTIVE"
+                xmlns="http://docs.openstack.org/compute/api/v1.1">
             <links>
                 <link href="%(expected_href)s" rel="self"/>
                 <link href="%(expected_href)s" rel="bookmark"
@@ -408,7 +411,8 @@ class ImageControllerWithGlanceServiceTest(test.TestCase):
         self.assertEqual(404, response.status_int)
 
         expected = minidom.parseString("""
-            <itemNotFound code="404">
+            <itemNotFound code="404"
+                    xmlns="http://docs.rackspacecloud.com/servers/api/v1.0">
                 <message>
                     Image not found.
                 </message>
@@ -441,8 +445,11 @@ class ImageControllerWithGlanceServiceTest(test.TestCase):
         response = request.get_response(fakes.wsgi_app())
         self.assertEqual(404, response.status_int)
 
+        # NOTE(justinsb): I believe this should still use the v1.0 XSD,
+        # because the element hasn't changed definition
         expected = minidom.parseString("""
-            <itemNotFound code="404">
+            <itemNotFound code="404"
+                    xmlns="http://docs.rackspacecloud.com/servers/api/v1.0">
                 <message>
                     Image not found.
                 </message>
diff --git a/nova/tests/api/openstack/test_limits.py b/nova/tests/api/openstack/test_limits.py
index 05cfacc60..df367005d 100644
--- a/nova/tests/api/openstack/test_limits.py
+++ b/nova/tests/api/openstack/test_limits.py
@@ -136,10 +136,17 @@ class LimitsControllerTest(BaseLimitTestSuite):
         request = self._get_index_request("application/xml")
         response = request.get_response(self.controller)
 
-        expected = "<limits><rate/><absolute/></limits>"
-        body = response.body.replace("\n", "").replace(" ", "")
+        expected = parseString("""
+            <limits
+                xmlns="http://docs.rackspacecloud.com/servers/api/v1.0">
+                <rate/>
+                <absolute/>
+            </limits>
+        """.replace("  ", ""))
 
-        self.assertEqual(expected, body)
+        body = parseString(response.body.replace("  ", ""))
+
+        self.assertEqual(expected.toxml(), body.toxml())
 
     def test_index_xml(self):
         """Test getting limit details in XML."""
@@ -148,7 +155,8 @@ class LimitsControllerTest(BaseLimitTestSuite):
         response = request.get_response(self.controller)
 
         expected = parseString("""
-            <limits>
+            <limits
+                xmlns="http://docs.rackspacecloud.com/servers/api/v1.0">
                 <rate>
                     <limit URI="*" regex=".*" remaining="10" resetTime="0"
                         unit="MINUTE" value="10" verb="GET"/>
diff --git a/nova/tests/integrated/test_xml.py b/nova/tests/integrated/test_xml.py
new file mode 100644
index 000000000..8a9754777
--- /dev/null
+++ b/nova/tests/integrated/test_xml.py
@@ -0,0 +1,56 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2011 Justin Santa Barbara
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from nova import flags
+from nova.log import logging
+from nova.tests.integrated import integrated_helpers
+from nova.api.openstack import common
+
+
+LOG = logging.getLogger('nova.tests.integrated')
+
+
+FLAGS = flags.FLAGS
+FLAGS.verbose = True
+
+
+class XmlTests(integrated_helpers._IntegratedTestBase):
+    """"Some basic XML sanity checks."""
+
+    def test_namespace_limits(self):
+        """/limits should have v1.0 namespace (hasn't changed in 1.1)."""
+        headers = {}
+        headers['Accept'] = 'application/xml'
+
+        response = self.api.api_request('/limits', headers=headers)
+        data = response.read()
+        LOG.debug("data: %s" % data)
+
+        prefix = '<limits xmlns="%s"' % common.XML_NS_V10
+        self.assertTrue(data.startswith(prefix))
+
+    def test_namespace_servers(self):
+        """/servers should have v1.1 namespace (has changed in 1.1)."""
+        headers = {}
+        headers['Accept'] = 'application/xml'
+
+        response = self.api.api_request('/servers', headers=headers)
+        data = response.read()
+        LOG.debug("data: %s" % data)
+
+        prefix = '<servers xmlns="%s"' % common.XML_NS_V11
+        self.assertTrue(data.startswith(prefix))
diff --git a/nova/tests/test_cloud.py b/nova/tests/test_cloud.py
index 00803d0ad..5cb969979 100644
--- a/nova/tests/test_cloud.py
+++ b/nova/tests/test_cloud.py
@@ -41,6 +41,7 @@ from nova.compute import power_state
 from nova.api.ec2 import cloud
 from nova.api.ec2 import ec2utils
 from nova.image import local
+from nova.exception import NotFound
 
 
 FLAGS = flags.FLAGS
@@ -71,7 +72,8 @@ class CloudTestCase(test.TestCase):
         host = self.network.get_network_host(self.context.elevated())
 
         def fake_show(meh, context, id):
-            return {'id': 1, 'properties': {'kernel_id': 1, 'ramdisk_id': 1}}
+            return {'id': 1, 'properties': {'kernel_id': 1, 'ramdisk_id': 1,
+                    'type': 'machine'}}
 
         self.stubs.Set(local.LocalImageService, 'show', fake_show)
         self.stubs.Set(local.LocalImageService, 'show_by_name', fake_show)
@@ -216,6 +218,35 @@ class CloudTestCase(test.TestCase):
         db.service_destroy(self.context, comp1['id'])
         db.service_destroy(self.context, comp2['id'])
 
+    def test_describe_images(self):
+        describe_images = self.cloud.describe_images
+
+        def fake_detail(meh, context):
+            return [{'id': 1, 'properties': {'kernel_id': 1, 'ramdisk_id': 1,
+                    'type': 'machine'}}]
+
+        def fake_show_none(meh, context, id):
+            raise NotFound
+
+        self.stubs.Set(local.LocalImageService, 'detail', fake_detail)
+        # list all
+        result1 = describe_images(self.context)
+        result1 = result1['imagesSet'][0]
+        self.assertEqual(result1['imageId'], 'ami-00000001')
+        # provided a valid image_id
+        result2 = describe_images(self.context, ['ami-00000001'])
+        self.assertEqual(1, len(result2['imagesSet']))
+        # provide more than 1 valid image_id
+        result3 = describe_images(self.context, ['ami-00000001',
+                                                 'ami-00000002'])
+        self.assertEqual(2, len(result3['imagesSet']))
+        # provide an non-existing image_id
+        self.stubs.UnsetAll()
+        self.stubs.Set(local.LocalImageService, 'show', fake_show_none)
+        self.stubs.Set(local.LocalImageService, 'show_by_name', fake_show_none)
+        self.assertRaises(NotFound, describe_images,
+                          self.context, ['ami-fake'])
+
     def test_console_output(self):
         instance_type = FLAGS.default_instance_type
         max_count = 1
diff --git a/nova/virt/libvirt_conn.py b/nova/virt/libvirt_conn.py
index 099ef647c..db1dc1aaa 100644
--- a/nova/virt/libvirt_conn.py
+++ b/nova/virt/libvirt_conn.py
@@ -972,7 +972,8 @@ class LibvirtConnection(driver.ComputeDriver):
                     'nics': nics}
 
         if FLAGS.vnc_enabled:
-            xml_info['vncserver_host'] = FLAGS.vncserver_host
+            if FLAGS.libvirt_type != 'lxc':
+                xml_info['vncserver_host'] = FLAGS.vncserver_host
         if not rescue:
             if instance['kernel_id']:
                 xml_info['kernel'] = xml_info['basepath'] + "/kernel"
diff --git a/nova/wsgi.py b/nova/wsgi.py
index ba0819466..94aafdf1c 100644
--- a/nova/wsgi.py
+++ b/nova/wsgi.py
@@ -355,24 +355,25 @@ class Controller(object):
 
         if type(result) is dict:
             content_type = req.best_match_content_type()
-            body = self._serialize(result, content_type)
+            default_xmlns = self.get_default_xmlns(req)
+            body = self._serialize(result, content_type, default_xmlns)
 
             response = webob.Response()
             response.headers["Content-Type"] = content_type
             response.body = body
             return response
-
         else:
             return result
 
-    def _serialize(self, data, content_type):
+    def _serialize(self, data, content_type, default_xmlns):
         """
         Serialize the given dict to the provided content_type.
         Uses self._serialization_metadata if it exists, which is a dict mapping
         MIME types to information needed to serialize to that type.
         """
         _metadata = getattr(type(self), "_serialization_metadata", {})
-        serializer = Serializer(_metadata)
+
+        serializer = Serializer(_metadata, default_xmlns)
         try:
             return serializer.serialize(data, content_type)
         except exception.InvalidContentType:
@@ -388,19 +389,24 @@ class Controller(object):
         serializer = Serializer(_metadata)
         return serializer.deserialize(data, content_type)
 
+    def get_default_xmlns(self, req):
+        """Provide the XML namespace to use if none is otherwise specified."""
+        return None
+
 
 class Serializer(object):
     """
     Serializes and deserializes dictionaries to certain MIME types.
     """
 
-    def __init__(self, metadata=None):
+    def __init__(self, metadata=None, default_xmlns=None):
         """
         Create a serializer based on the given WSGI environment.
         'metadata' is an optional dict mapping MIME types to information
         needed to serialize a dictionary to that type.
         """
         self.metadata = metadata or {}
+        self.default_xmlns = default_xmlns
 
     def _get_serialize_handler(self, content_type):
         handlers = {
@@ -478,11 +484,23 @@ class Serializer(object):
         root_key = data.keys()[0]
         doc = minidom.Document()
         node = self._to_xml_node(doc, metadata, root_key, data[root_key])
+
+        xmlns = node.getAttribute('xmlns')
+        if not xmlns and self.default_xmlns:
+            node.setAttribute('xmlns', self.default_xmlns)
+
         return node.toprettyxml(indent='    ')
 
     def _to_xml_node(self, doc, metadata, nodename, data):
         """Recursive method to convert data members to XML nodes."""
         result = doc.createElement(nodename)
+
+        # Set the xml namespace if one is specified
+        # TODO(justinsb): We could also use prefixes on the keys
+        xmlns = metadata.get('xmlns', None)
+        if xmlns:
+            result.setAttribute('xmlns', xmlns)
+
         if type(data) is list:
             singular = metadata.get('plurals', {}).get(nodename, None)
             if singular is None:
@@ -532,6 +550,7 @@ def paste_config_file(basename):
     """
 
     configfiles = [basename,
+                   os.path.join(FLAGS.state_path, 'etc', 'nova', basename),
                    os.path.join(FLAGS.state_path, 'etc', basename),
                    os.path.join(FLAGS.state_path, basename),
                    '/etc/nova/%s' % basename]