CSS-4744 - Merge main forward into feature-rebac

.air.toml

@@ -29,6 +29,7 @@ tmp_dir = "tmp"
 
 [log]
   time = false
+  main_only = true
 
 [misc]
   clean_on_exit = false

Dockerfile

@@ -20,7 +20,7 @@ COPY . .
 RUN echo "${GIT_COMMIT}" | tee ./version/commit.txt
 RUN echo "${VERSION}" | tee ./version/version.txt
 RUN --mount=type=ssh source /root/.gvm/scripts/gvm && go mod vendor
-RUN --mount=type=ssh source /root/.gvm/scripts/gvm && go build -o jimmsrv -race -v -a -mod vendor ./cmd/jimmsrv
+RUN --mount=type=ssh source /root/.gvm/scripts/gvm && go build -tags version -o jimmsrv -v -a -mod vendor ./cmd/jimmsrv
 
 # Define a smaller single process image for deployment
 FROM ${DOCKER_REGISTRY}ubuntu:20.04 AS deploy-env

charms/jimm-k8s/src/charm.py

@@ -88,6 +88,7 @@ def __init__(self, *args):
         super().__init__(*args)
 
         self._state = State(self.app, lambda: self.model.get_relation("peer"))
+        self._unit_state = State(self.unit, lambda: self.model.get_relation("peer"))
 
         self.framework.observe(self.on.peer_relation_changed, self._on_peer_relation_changed)
         self.framework.observe(self.on.jimm_pebble_ready, self._on_jimm_pebble_ready)
@@ -236,6 +237,7 @@ def _update_workload(self, event):
             return
 
         self._ensure_bakery_agent_file(event)
+        self._ensure_vault_file(event)
         self._install_dashboard(event)
 
         dns_name = self._get_dns_name(event)
@@ -313,12 +315,13 @@ def _update_workload(self, event):
         else:
             logger.info("workload container not ready - defering")
             event.defer()
+            return
 
         dashboard_relation = self.model.get_relation("dashboard")
         if dashboard_relation and self.unit.is_leader():
             dashboard_relation.data[self.app].update(
                 {
-                    "controller-url": dns_name,
+                    "controller-url": "wss://{}".format(dns_name),
                     "identity-provider-url": self.config.get("candid-url"),
                     "is-juju": str(False),
                 }
@@ -347,7 +350,7 @@ def _on_dashboard_relation_joined(self, event: RelationJoinedEvent):
 
         event.relation.data[self.app].update(
             {
-                "controller-url": dns_name,
+                "controller-url": "wss://{}".format(dns_name),
                 "identity-provider-url": self.config["candid-url"],
                 "is-juju": str(False),
             }
@@ -416,6 +419,7 @@ def _install_dashboard(self, event):
         # this event.
         if not container.can_connect():
             event.defer()
+            return
 
         # fetch the resource filename
         try:
@@ -496,10 +500,14 @@ def _on_vault_relation_joined(self, event):
         event.relation.data[self.unit]["access_address"] = json.dumps(self._get_network_address(event))
         event.relation.data[self.unit]["isolated"] = json.dumps(False)
 
-    @requires_state_setter
-    def _on_vault_relation_changed(self, event):
+    def _ensure_vault_file(self, event):
         container = self.unit.get_container(WORKLOAD_CONTAINER)
 
+        if not self._unit_state.is_ready():
+            logger.info("unit state not ready")
+            event.defer()
+            return
+
         # if we can't connect to the container we should defer
         # this event.
         if not container.can_connect():
@@ -509,6 +517,16 @@ def _on_vault_relation_changed(self, event):
         if container.exists(self._vault_secret_filename):
             container.remove_path(self._vault_secret_filename)
 
+        secret_data = self._unit_state.vault_secret_data
+        if secret_data:
+            self._push_to_workload(self._vault_secret_filename, secret_data, event)
+
+    def _on_vault_relation_changed(self, event):
+        if not self._unit_state.is_ready() or not self._state.is_ready():
+            logger.info("state not ready")
+            event.defer()
+            return
+
         addr = _json_data(event, "vault_url")
         if not addr:
             return
@@ -523,9 +541,13 @@ def _on_vault_relation_changed(self, event):
         secret["data"]["role_id"] = role_id
 
         secret_data = json.dumps(secret)
-        self._push_to_workload(self._vault_secret_filename, secret_data, event)
 
-        self._state.vault_address = addr
+        logger.error("setting unit state data {}".format(secret_data))
+        self._unit_state.vault_secret_data = secret_data
+        if self.unit.is_leader():
+            self._state.vault_address = addr
+
+        self._update_workload(event)
 
     def _path_exists_in_workload(self, path: str):
         """Returns true if the specified path exists in the

charms/jimm-k8s/tests/unit/test_charm.py

@@ -44,7 +44,8 @@ def setUp(self):
         self.addCleanup(self.tempdir.cleanup)
         self.harness.charm.framework.charm_dir = pathlib.Path(self.tempdir.name)
 
-        self.harness.add_relation("peer", "jimm")
+        jimm_id = self.harness.add_relation("peer", "juju-jimm-k8s")
+        self.harness.add_relation_unit(jimm_id, "juju-jimm-k8s/1")
         self.harness.container_pebble_ready("jimm")
 
         rel_id = self.harness.add_relation("ingress", "nginx-ingress")
@@ -269,7 +270,7 @@ def test_dashboard_relation_joined(self):
         self.assertTrue(data)
         self.assertEqual(
             data["controller-url"],
-            "juju-jimm-k8s-0.juju-jimm-k8s-endpoints.None.svc.cluster.local",
+            "wss://juju-jimm-k8s-0.juju-jimm-k8s-endpoints.None.svc.cluster.local",
         )
         self.assertEqual(data["identity-provider-url"], "https://candid.example.com")
         self.assertEqual(data["is-juju"], "False")

charms/jimm/README.md

@@ -43,6 +43,7 @@ juju deploy openfga
 juju add-relation juju-jimm:openfga postgresql:openfga
 ```
 
+
 ## Developing
 
 Create and activate a virtualenv with the development requirements:

charms/jimm/charmcraft.yaml

@@ -4,16 +4,21 @@ type: "charm"
 parts:
   charm:
     prime:
-    - ./templates
-    - ./files
-    - README.md
+      - ./templates
+      - ./files
+      - README.md
     charm-python-packages: [setuptools]
+    charm-binary-python-packages:
+      - Jinja2 >= 2.11.3
+      - markupsafe >= 2.0.1
+      - pydantic == 1.10.*
+      - cosl
 bases:
   # Ensure run-on is the same or newer than build-on
   # since jimm-server is a Go binary using CGO dependencies
   - build-on:
-    - name: "ubuntu"
-      channel: "20.04"
+      - name: "ubuntu"
+        channel: "20.04"
     run-on:
-    - name: "ubuntu"
-      channel: "20.04"
+      - name: "ubuntu"
+        channel: "20.04"

charms/jimm/lib/charms/grafana_agent/v0/cos_agent.py

@@ -191,7 +191,7 @@ class _MetricsEndpointDict(TypedDict):
 LIBAPI = 0
 LIBPATCH = 3
 
-PYDEPS = ["cosl", "pydantic"]
+PYDEPS = ["cosl", "pydantic == 1.10.*"]
 
 DEFAULT_RELATION_NAME = "cos-agent"
 DEFAULT_PEER_RELATION_NAME = "peers"

charms/jimm/metadata.yaml

@@ -22,7 +22,7 @@ issues: https://github.com/canonical/jimm/issues
 
 description: |
   JIMM is a juju controller, used in conjunction with the JaaS dashboard to provide a seamless way
-  to manage models, regardless of where their controllers reside or what cloud they may be running on. 
+  to manage models, regardless of where their controllers reside or what cloud they may be running on.
 
 provides:
   website:

charms/jimm/requirements.txt

@@ -3,5 +3,5 @@ Jinja2 >= 2.11.3
 ops >= 2.0.0
 charmhelpers >= 0.20.22
 hvac >= 0.11.0
-pydantic
+pydantic == 1.10.*
 cosl

charms/jimm/src/charm.py

@@ -142,7 +142,6 @@ def _on_config_changed(self, _):
 
         with open(self._env_filename(), "wt") as f:
             f.write(self._render_template("jimm.env", **args))
-
         if self._ready():
             self.restart()
         self._on_update_status(None)
@@ -151,7 +150,7 @@ def _on_config_changed(self, _):
         if dashboard_relation:
             dashboard_relation.data[self.app].update(
                 {
-                    "controller-url": self.config["dns-name"],
+                    "controller-url": "wss://{}".format(self.config["dns-name"]),
                     "identity-provider-url": self.config["candid-url"],
                     "is-juju": str(False),
                 }
@@ -399,7 +398,7 @@ def _snap(self, *args):
     def _on_dashboard_relation_joined(self, event):
         event.relation.data[self.app].update(
             {
-                "controller-url": self.config["dns-name"],
+                "controller-url": "wss://{}".format(self.config["dns-name"]),
                 "identity-provider-url": self.config["candid-url"],
                 "is-juju": str(False),
             }

charms/jimm/tests/test_charm.py

@@ -510,7 +510,7 @@ def test_dashboard_relation_joined(self):
             harness.charm._agent_filename = tmp.name
             harness.update_config(
                 {
-                    "dns-name": "https://jimm.example.com",
+                    "dns-name": "jimm.example.com",
                     "candid-agent-username": "username@candid",
                     "candid-agent-private-key": "agent-private-key",
                     "candid-agent-public-key": "agent-public-key",
@@ -526,7 +526,7 @@ def test_dashboard_relation_joined(self):
         harness.add_relation_unit(id, "juju-dashboard/0")
         data = harness.get_relation_data(id, "juju-jimm")
         self.assertTrue(data)
-        self.assertEqual(data["controller-url"], "https://jimm.example.com")
+        self.assertEqual(data["controller-url"], "wss://jimm.example.com")
         self.assertEqual(data["identity-provider-url"], "https://candid.example.com")
         self.assertEqual(data["is-juju"], "False")
 

charms/jimm/tox.ini

@@ -9,7 +9,6 @@ envlist = lint, unit
 [vars]
 src_path = {toxinidir}/src/
 tst_path = {toxinidir}/tests/
-;lib_path = {toxinidir}/lib/charms/operator_name_with_underscores
 all_path = {[vars]src_path} {[vars]tst_path} 
 
 [testenv]

cmd/jimmctl/cmd/modelstatus.go

@@ -63,7 +63,7 @@ func (c *modelStatusCommand) SetFlags(f *gnuflag.FlagSet) {
 
 // Init implements the cmd.Command interface.
 func (c *modelStatusCommand) Init(args []string) error {
-	if len(args) < 0 {
+	if len(args) < 1 {
 		return errors.E("missing model uuid")
 	}
 	c.modelUUID, args = args[0], args[1:]

cmd/jimmsrv/main.go

@@ -15,6 +15,7 @@ import (
 	"go.uber.org/zap"
 
 	"github.com/CanonicalLtd/jimm"
+	"github.com/CanonicalLtd/jimm/version"
 )
 
 func main() {
@@ -32,6 +33,10 @@ func main() {
 
 // start initialises the jimmsrv service.
 func start(ctx context.Context, s *service.Service) error {
+	zapctx.Info(ctx, "jimm info",
+		zap.String("version", version.VersionInfo.Version),
+		zap.String("commit", version.VersionInfo.GitCommit),
+	)
 	if logLevel := os.Getenv("JIMM_LOG_LEVEL"); logLevel != "" {
 		if err := zapctx.LogLevel.UnmarshalText([]byte(logLevel)); err != nil {
 			zapctx.Error(ctx, "cannot set log level", zap.Error(err))

docker-compose.yaml

@@ -33,6 +33,7 @@ services:
     ports:
       - 17070:80
     environment:
+      JIMM_LOG_LEVEL: "debug"
       JIMM_UUID: "3217dbc9-8ea9-4381-9e97-01eab0b3f6bb"
       JIMM_DSN: "postgresql://jimm:jimm@db/jimm"
       CANDID_URL: "http://0.0.0.0:8081" # For external client redirects (in the case of compose and running outside)
@@ -78,9 +79,9 @@ services:
         condition: service_healthy
     labels:
       traefik.enable: true
-      traefik.http.routers.httpd.rule: Host(`jimm.localhost`)
-      traefik.http.routers.httpd.entrypoints: websecure
-      traefik.http.routers.httpd.tls: true
+      traefik.http.routers.jimm.rule: Host(`jimm.localhost`)
+      traefik.http.routers.jimm.entrypoints: websecure
+      traefik.http.routers.jimm.tls: true
 
   db:
     image: postgres
@@ -134,8 +135,6 @@ services:
     image: candid:latest
     container_name: candid
     entrypoint: "/candid.sh"
-    command: ""
-    # command: "/etc/candid/config.yaml && echo 'hi' && ls"
     expose:
       - 8081
     ports:

internal/dashboard/dashboard.go

@@ -118,7 +118,6 @@ func Handler(ctx context.Context, loc string) http.Handler {
 				)
 				continue
 			}
-
 			type guiArchiveVersion struct {
 				// Version holds the Juju GUI version number.
 				Version version.Number `json:"version"`

internal/dashboard/dashboard_test.go

@@ -183,7 +183,6 @@ func TestGUIArchiveEndpoint(t *testing.T) {
 	c.Check(resp.StatusCode, qt.Equals, http.StatusOK)
 	buf, err := io.ReadAll(resp.Body)
 	c.Assert(err, qt.IsNil)
-
 	c.Check(
 		string(buf),
 		qt.Equals,

internal/jujuapi/applicationoffers.go

@@ -60,7 +60,7 @@ func init() {
 		r.AddMethod("ApplicationOffers", 4, "FindApplicationOffers", findOffersMethod)
 		r.AddMethod("ApplicationOffers", 4, "ApplicationOffers", applicationOffersMethod)
 
-		return []int{1, 2, 3}
+		return []int{1, 2, 3, 4}
 	}
 }
 

internal/jujuapi/jimm.go

@@ -63,6 +63,7 @@ func init() {
 		r.AddMethod("JIMM", 3, "UpdateMigratedModel", updateMigratedModelMethod)
 		r.AddMethod("JIMM", 3, "AddCloudToController", addCloudToControllerMethod)
 		r.AddMethod("JIMM", 3, "RemoveCloudFromController", removeCloudFromControllerMethod)
+		r.AddMethod("JIMM", 3, "CrossModelQuery", crossModelQueryMethod)
 
 		// JIMM Generic RPC
 		r.AddMethod("JIMM", 4, "AddController", addControllerMethod)

internal/jujuclient/modelmanager_test.go

@@ -183,7 +183,6 @@ func (s *modelmanagerSuite) TestRevokeModelAccessError(c *gc.C) {
 
 func (s *modelmanagerSuite) TestValidateModelUpgrade(c *gc.C) {
 	c.Skip("juju 3.x no longer implements this method")
-
 	ctx := context.Background()
 
 	args := jujuparams.ModelCreateArgs{