fix(upgrades): grant k8s cluster trust before refreshing octavia-k8s#798
Merged
Merged
Conversation
There was a problem hiding this comment.
Pull request overview
This PR addresses k8s charm refresh failures where juju refresh --trust does not create the required Kubernetes ClusterRoleBinding, causing octavia-k8s upgrade hooks to hit RBAC 403s. It introduces an explicit juju trust --scope=cluster call before refresh for charms that require cluster-scoped RBAC.
Changes:
- Added
JujuHelper.charm_trust()(cluster-scoped) and updatedcharm_refresh()to call it first whentrust=True. - Introduced
CHARMS_REQUIRING_TRUST = {"octavia-k8s"}and ensuredrefresh_apps()passestrust=Truefor those charms. - Updated/expanded unit tests to validate trust propagation and ordering.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| sunbeam-python/sunbeam/core/juju.py | Adds charm_trust() and makes charm_refresh(trust=True) grant cluster trust before refreshing. |
| sunbeam-python/sunbeam/steps/upgrades/intra_channel.py | Passes trust=True during refresh for octavia-k8s (and trust=False for others). |
| sunbeam-python/tests/unit/sunbeam/core/test_juju.py | Adds coverage ensuring juju.trust(..., scope="cluster") is invoked before refresh when requested. |
| sunbeam-python/tests/unit/sunbeam/steps/upgrades/test_intra_channel.py | Updates assertions to include trust and adds cases for octavia trust behavior. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
On k8s models, `juju refresh --trust` does not create a
ClusterRoleBinding. The octavia-k8s upgrade-charm hook calls
_remove_legacy_containers() which needs GET/PATCH access on
StatefulSets, resulting in HTTP 403 without the binding in place.
Fix this by:
- Adding charm_trust() to JujuHelper that calls
juju.trust(app, scope="cluster"), creating the ClusterRoleBinding
if the cloud is of type caas
- Updating charm_refresh() to call charm_trust() first when trust=True
- Adding CHARMS_REQUIRING_TRUST = {"octavia-k8s"} in intra_channel.py
so refresh_apps() passes trust=True for octavia during cluster refresh
Closes: https://bugs.launchpad.net/snap-openstack/+bug/2152670
Assisted-by: Claude:claude-4.6-sonnet
Signed-off-by: Hemanth Nakkina <hemanth.nakkina@canonical.com>
hemanthnakkina
force-pushed
the
octavia-refresh
branch
from
b4f22eb to
656381c
Compare
gboutry
approved these changes
May 20, 2026
| def charm_trust(self, application_name: str, model: str) -> None: | ||
| """Grant cluster-scoped trust to a k8s charm application. | ||
|
|
||
| On k8s models, ``juju refresh --trust`` does not create a |
Collaborator
There was a problem hiding this comment.
Is that expected? Should we raise a bug on Juju?
Collaborator
Author
There was a problem hiding this comment.
Checking with juju team
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
On k8s models,
juju refresh --trustdoes not create a ClusterRoleBinding. The octavia-k8s upgrade-charm hook calls _remove_legacy_containers() which needs GET/PATCH access on StatefulSets, resulting in HTTP 403 without the binding in place.Fix this by:
Closes: https://bugs.launchpad.net/snap-openstack/+bug/2152670
Assisted-by: Claude:claude-4.6-sonnet