state/apiserver/provisioner: refactor canWatchMachines logic
Merge pull request #534 from davecheney/178-state-apiserver-provisioner-refactor-canwatchmachines-logic

state/apiserver/provisioner: refactor canWatchMachines logic

This proposal removes the last deliberate use of `canWatch("")` in the apiserver.

There are some inadvertent uses where the tag string passed to `canWatch` will be addressed in the next proposal.
environs/cloudinit: use actual tools version in bootstrap agent.conf

The upgradedToVersion field in the bootstrap machine agent's config
will now match the tools version that's it's going to use, instead of
the version of the client. This avoids unnecesarily triggering
upgrades at bootstrap time (fixing bug #1358078).
provider/manual: return hardware characteristics

StartInstance is updated to construct hardware
characteristics based on the node object returned
by MAAS in the result of "acquire".

We also fix StartInstance to use the architecture
of the acquired node to choose the appropriate
tools. We will acquire a node with an arbitrary
architecture unless specified, but we will now
guarantee correct tools.

Fixes https://bugs.launchpad.net/juju-core/+bug/1193998
Fixes https://bugs.launchpad.net/juju-core/+bug/1303853
provider/azure: custom data test needs to provide a real tools version

...now that MachineConfig.Tools is used to populate upgradedToVersion
in the initial agent.conf.
Merge pull request #535 from mjs/1358078-avoid-upgrade-with-bootstrap-upload-tools

environs/cloudinit: use actual tools version in bootstrap agent.conf

The upgradedToVersion field in the bootstrap machine agent's config will now match the tools version that's it's going to use, instead of the version of the client. This avoids unnecesarily triggering upgrades at bootstrap time (fixing bug #1358078).
state/apiserver/common: NewEnvironMachinesWatcher takes an authorizer

This PR removes the incorrect use of `canWatch("")`, replacing it with a call to the underlying authorizer as it is that authorizer which can tell if the authenticated entity is permitted to act as an Environment manager.

A similar change is coming for EnvironWatcher in a followup PR.
Address review comments, update test
provider/maas: don't use args.Tools.OneSeries in match
Merge pull request #536 from axw/provider-maas-hardwarecharacteristics

provider/manual: return hardware characteristics

StartInstance is updated to construct hardware
characteristics based on the node object returned
by MAAS in the result of "acquire".

We also fix StartInstance to use the architecture
of the acquired node to choose the appropriate
tools. We will acquire a node with an arbitrary
architecture unless specified, but we will now
guarantee correct tools.

Fixes https://bugs.launchpad.net/juju-core/+bug/1193998
Fixes https://bugs.launchpad.net/juju-core/+bug/1303853
upgrades: added AreUpgradesDefined

This function return true if there are upgrade operations defined
between the version specified and the running software version. The
logic shared by this and PerformUpgrade has been extracted to an
iterator.
Use AreUpgradesDefined to decide agent if upgrade mode is needed

This moves the decision of whether an upgrade mode should be entered
to the upgrades package (where it should be) and also means upgrade
mode is only entered if there are actually upgrade steps defined.
Merge pull request #541 from mjs/are-upgrades-defined

Added updates.AreUpgradesDefined

Two bits:

1. Adds upgrades.AreUpgradesDefined which returns if there are upgrade operations defined between the version specified and the running software version. 
2. Use AreUpgradesDefined in the machine agent to decide whether upgrade mode should be entered. This moves the decision of whether an upgrade mode should be entered to the upgrades package where it should be and also means upgrade mode is only entered if there are actually upgrade steps defined.
Merge pull request #540 from davecheney/179-state-apiserver-common-environmachineswatcher-drop-canwatch

state/apiserver/common: NewEnvironMachinesWatcher takes an authorizer

This PR removes the incorrect use of `canWatch("")`, replacing it with a call to the underlying authorizer as it is that authorizer which can tell if the authenticated entity is permitted to act as an Environment manager.

A similar change is coming for EnvironWatcher in a followup PR.
state/apiserver/common: NewEnvironsWatcher takes an authorizer

This PR is a followup to #540, and removes the last incorrect use of canWatch(""), replacing it with a call to the underlying authorizer as it is that authorizer which can tell if the authenticated entity is permitted to act as an Environment manager.
state/apiserver/common: AuthAlways requires a valid tag

AuthAlways would previously authenticate any string, even if it was not a valid tag.

This made it a poor mock, not to mention a potential security risk.

This PR requires AuthAlways to validate the tag it is passed and will only return true if the tag is valid. This prepares for latter changes which will alter the signature of common.AuthFunc to require a tag, not a string.
update commentary
Merge pull request #543 from davecheney/180--state-apiserver-common-environwatcher-drop-canwatch

state/apiserver/common: NewEnvironsWatcher takes an authorizer

This PR is a followup to #540, and removes the last incorrect use of canWatch(""), replacing it with a call to the underlying authorizer as it is that authorizer which can tell if the authenticated entity is permitted to act as an Environment manager.
Merge branch 'master' of https://github.com/juju/juju into 181-state-apiserver-common-authalways-requires-valid-tag
Merge pull request #545 from davecheney/181-state-apiserver-common-authalways-requires-valid-tag

state/apiserver/common: AuthAlways requires a valid tag

AuthAlways would previously authenticate any string, even if it was not a valid tag.

This made it a poor mock, not to mention a potential security risk.

This PR requires AuthAlways to validate the tag it is passed and will only return true if the tag is valid. This prepares for latter changes which will alter the signature of common.AuthFunc to require a tag, not a string.