stuck in blocked when deployed without --trust

[PietroPasotti]

Bug Description

grafana-k8s is stuck in blocked if deployed without --trust
the status message recommends juju trust, but that does not seem to fix it.

To Reproduce

juju deploy grafana-k8s
juju trust grafana-k8s

Environment

multipass -> juju 3.1.5

Relevant log output

Time                        Type       Status     Message                                                          
13 Sep 2023 15:06:59+02:00  juju-unit  executing  running action juju-exec                                         
13 Sep 2023 15:06:59+02:00  juju-unit  idle                                                                        
13 Sep 2023 15:07:29+02:00  juju-unit  executing  running grafana-pebble-ready hook                                
13 Sep 2023 15:07:31+02:00  juju-unit  executing  running grafana-relation-changed hook                            
13 Sep 2023 15:07:32+02:00  juju-unit  idle                                                                        
13 Sep 2023 15:07:36+02:00  juju-unit  executing  running litestream-pebble-ready hook                             
13 Sep 2023 15:08:09+02:00  juju-unit  idle                                                                        
13 Sep 2023 15:08:09+02:00  workload   blocked    Kubernetes resources patch failed: `juju trust` this application.
statefulsets.apps "grafana-k8s" is forbidden: User "system:serviceaccount:grafana:grafana-k8s" cannot get resource 
statefulsets" in API group "apps" in the namespace "grafana"

Additional context

No response

[sed-i]

When I forget --trust, following up with juju trust --scope=cluster auto resolves. I do not recall if grafana specifically too.
Might be related to absence of common exit hook (not to mention calling it from update_status)?

[PietroPasotti]

tried that, but it didn't fix the issue.

[sed-i]

Let's compare this charm's behavior to alertmanager/prometheus.
Perhaps related to install hook.

[sed-i]

Turns out juju trust results in an upgrade sequence, so we just need to confirm the status is cleared on upgrade.
(BTW, this appears when rbac microk8s addon is enabled.)