environs/cloudinit: add RootCertPEM

environs/cloudinit/cloudinit.go

Index: environs/cloudinit/cloudinit.go
=== modified file 'environs/cloudinit/cloudinit.go'
--- environs/cloudinit/cloudinit.go	2012-11-14 14:09:56 +0000
+++ environs/cloudinit/cloudinit.go	2012-11-15 16:11:30 +0000
@@ -29,6 +29,10 @@
 	// or MongoDB instance.
 	StateServer bool
 
+	// RootCertPEM holds the x509 certificate of the root CA
+	// that signed the state server certificate, in PEM format.
+	RootCertPEM []byte
+
 	// StateServerPEM holds the state server certificate and private
 	// key in PEM format; it is required when StateServer is set,
 	// and ignored otherwise.
@@ -85,7 +89,10 @@
 	return base64.StdEncoding.EncodeToString(data)
 }
 
-const serverPEMPath = "/var/lib/juju/server.pem"
+const (
+	serverPEMPath   = "/var/lib/juju/server.pem"
+	rootCertPEMPath = "/var/lib/juju/root.pem"
+)
 
 func New(cfg *MachineConfig) (*cloudinit.Config, error) {
 	if err := verifyConfig(cfg); err != nil {
@@ -115,6 +122,10 @@
 		debugFlag = " --debug"
 	}
 
+	addScripts(c,
+		fmt.Sprintf("echo %s > %s", shquote(string(cfg.RootCertPEM)), rootCertPEMPath),
+	)
+
 	if cfg.StateServer {
 		addScripts(c,
 			fmt.Sprintf("echo %s > %s",
@@ -280,6 +291,9 @@
 	if cfg.StateInfo == nil {
 		return fmt.Errorf("missing state info")
 	}
+	if len(cfg.RootCertPEM) == 0 {
+		return fmt.Errorf("missing root CA certificate PEM")
+	}
 	if cfg.StateServer {
 		if cfg.InstanceIdAccessor == "" {
 			return fmt.Errorf("missing instance id accessor")