Support juju 4 in integration tests by Thanhphan1147 · Pull Request #596 · canonical/haproxy-operator

Thanhphan1147 · 2026-07-02T13:18:58Z

What this PR does

Replaces all juju.ssh(unit, cmd) / cli("ssh", ...) calls that read files on units with juju.exec(cmd, unit=...).stdout.
Stabilize TLS, route, policy, config, and legacy tests with more aggressive juju.wait
Run OAuth SPOE coverage separately on Juju 3 due to an upstream Juju 4 Kubernetes image issue.
Update relation addresses to use ingress-address.

juju ssh fails on Juju 4 with 'Permission denied (publickey)' due to changed SSH key provisioning timing. Replace all ssh calls that read files on units with juju.exec(..., unit=...).stdout, which routes through the Juju agent and requires no SSH keypair. Affected tests: test_haproxy_route, test_haproxy_route_tcp (x4), test_haproxy_ddos, and the apache2 log helper.

Dependency charms (postgresql 16/edge, postgresql-k8s 14/edge, hydra, kratos, traefik-k8s, identity-platform-login-ui-operator, self-signed-certificates) declare 'assumes: juju < 4.0.0' (or < 3.5.0), blocking deployment on Juju 4. Juju 4's deploy validator skips assumes checks when --force is passed. Add force=True to all external charm deploys in test fixtures so the assumes gate is bypassed without changing the charm revisions. Affected fixtures: postgresql_fixture, deploy_iam_bundle_fixture, certificate_provider_application_fixture (both top-level and haproxy-operator conftest).

f-atwi · 2026-09-03T10:03:56Z

+    juju.wait(
+        lambda status: (
+            status.apps[configured_application_with_tls].is_blocked
+            and jubilant.all_agents_idle(
+                status, configured_application_with_tls, haproxy_route_requirer
+            )
+        ),
+    )


nit

Suggested change

juju.wait(

lambda status: (

status.apps[configured_application_with_tls].is_blocked

and jubilant.all_agents_idle(

status, configured_application_with_tls, haproxy_route_requirer

)

),

)

juju.wait(

lambda status: (

jubilant.all_blocked(status, configured_application_with_tls)

and jubilant.all_agents_idle(

status, configured_application_with_tls, haproxy_route_requirer

)

),

)

f-atwi · 2026-09-03T10:05:12Z

+    juju.wait(
+        lambda status: (
+            status.apps[configured_application_with_tls].is_blocked
+            and jubilant.all_agents_idle(
+                status, configured_application_with_tls, any_charm_haproxy_route_tcp_requirer
+            )
+        ),
+    )


nit

Suggested change

juju.wait(

lambda status: (

status.apps[configured_application_with_tls].is_blocked

and jubilant.all_agents_idle(

status, configured_application_with_tls, any_charm_haproxy_route_tcp_requirer

)

),

)

juju.wait(

lambda status: (

jubilant.all_blocked(status, configured_application_with_tls)

and jubilant.all_agents_idle(

status, configured_application_with_tls, any_charm_haproxy_route_tcp_requirer

)

),

)

f-atwi · 2026-09-03T10:06:57Z

+
+    deadline = time.monotonic() + 300
+    hashed_tcp_client = None
+    while time.monotonic() < deadline:
+        with (
+            socket.create_connection((str(haproxy_ip_address), 4444), timeout=30) as sock,
+            context.wrap_socket(sock, server_hostname="example.com") as secure_socket,
+        ):
+            secure_socket.sendall(b"ping")
+            assert b"pong" in secure_socket.read()
+        field = _last_client_field(juju, unit, "haproxy_route_tcp_4444", required=False)
+        if field is not None and not _is_plaintext_address(field):
+            hashed_tcp_client = field
+            break
+        time.sleep(5)
+    assert hashed_tcp_client is not None, "no hashed client field found in haproxy TCP logs"


nit
use tenacity

f-atwi · 2026-09-03T10:08:34Z

+def _is_plaintext_address(field: str) -> bool:
+    """Return whether a logged client field is a plaintext IP:port entry."""
+    try:
+        ip_address(field.rsplit(":", 1)[0])
+    except ValueError:
+        return False
+    return True


not sure if relevant
but should we validate the port?
i assume something like 127.0.0.1: would pass validation

f-atwi · 2026-09-03T10:09:03Z

+    deadline = time.monotonic() + timeout
+    while time.monotonic() < deadline:
+        marker = f"{marker_prefix}-{uuid.uuid4().hex}"
+        response = requests.get(f"{address}/?{marker}", verify=False, timeout=30)  # nosec
+        assert response.status_code == 200
+        field = _last_client_field(juju, unit, marker, required=False)
+        if field is not None and _is_plaintext_address(field) == expect_plaintext:
+            return field
+        time.sleep(5)
+    raise TimeoutError(
+        f"no {'plaintext' if expect_plaintext else 'hashed'} client field found"
+        f" in haproxy logs within {timeout}s"
+    )


nit
tenacity

f-atwi · 2026-09-03T10:10:00Z

+    juju.wait(
+        lambda status: (
+            status.apps[configured_application_with_tls].is_blocked
+            and jubilant.all_agents_idle(
+                status, configured_application_with_tls, any_charm_haproxy_route_requirer
+            )
+        ),
+    )


nit

Suggested change

juju.wait(

lambda status: (

status.apps[configured_application_with_tls].is_blocked

and jubilant.all_agents_idle(

status, configured_application_with_tls, any_charm_haproxy_route_requirer

)

),

)

juju.wait(

lambda status: (

jubilant.all_blocked(status, configured_application_with_tls)

and jubilant.all_agents_idle(

status, configured_application_with_tls, any_charm_haproxy_route_requirer

)

),

)

seb4stien · 2026-09-03T10:10:40Z

+                status, configured_application_with_tls, any_charm_haproxy_route_requirer
+            )
+        ),
+    )


Unless I misunderstood previous suggestions from Fouad, they may apply here too?

f-atwi · 2026-09-03T10:11:17Z

+        lambda status: (
+            status.apps[configured_application_with_tls].is_blocked
+            and jubilant.all_agents_idle(
+                status, configured_application_with_tls, any_charm_haproxy_route_requirer
+            )
+        ),


nit

Suggested change

lambda status: (

status.apps[configured_application_with_tls].is_blocked

and jubilant.all_agents_idle(

status, configured_application_with_tls, any_charm_haproxy_route_requirer

)

),

lambda status: (

jubilant.all_blocked(status, configured_application_with_tls)

and jubilant.all_agents_idle(

status, configured_application_with_tls, any_charm_haproxy_route_requirer

)

),

f-atwi · 2026-09-03T10:12:23Z

+        lambda status: (
+            status.apps[configured_application_with_tls].is_blocked
+            and jubilant.all_agents_idle(
+                status, configured_application_with_tls, any_charm_haproxy_route_requirer
+            )
+        ),


nit

Suggested change

lambda status: (

status.apps[configured_application_with_tls].is_blocked

and jubilant.all_agents_idle(

status, configured_application_with_tls, any_charm_haproxy_route_requirer

)

),

lambda status: (

jubilant.all_blocked(status, configured_application_with_tls)

and jubilant.all_agents_idle(

status, configured_application_with_tls, any_charm_haproxy_route_requirer

)

),

f-atwi · 2026-09-03T10:13:16Z

    juju.deploy(
        "postgresql",
        app=POSTGRESQL_APPLICATION,
        channel="16/edge",
        base="ubuntu@24.04",
+        force=True,


out of curiosity
why do we need force?
also what is the reason for deploy to have a force option in the first place?

f-atwi · 2026-09-03T10:14:10Z

+        lambda status: (
+            status.apps[configured_application_with_tls].is_blocked
+            and jubilant.all_agents_idle(
+                status, configured_application_with_tls, HAPROXY_ROUTE_REQUIRER_NAME
+            )
+        ),
+        timeout=10 * 60,


nit

Suggested change

lambda status: (

status.apps[configured_application_with_tls].is_blocked

and jubilant.all_agents_idle(

status, configured_application_with_tls, HAPROXY_ROUTE_REQUIRER_NAME

)

),

timeout=10 * 60,

lambda status: (

jubilant.all_blocked(status, configured_application_with_tls)

and jubilant.all_agents_idle(

status, configured_application_with_tls, HAPROXY_ROUTE_REQUIRER_NAME

)

),

timeout=10 * 60,

f-atwi · 2026-09-03T10:14:36Z

 artifacts.build.yaml

 .worktrees
+**/superpowers/**


seb4stien · 2026-09-03T10:15:38Z

+  k8s:
+    enable: true
+    bootstrap: false
+    channel: 1.32-classic/stable


Any reason to not be on 1.35-classic/stable?

f-atwi

LGTM
mostly nits

Thanhphan1147 requested a review from a team as a code owner July 2, 2026 13:18

github-actions Bot added Libraries: Out of sync Libraries: OK and removed Libraries: Out of sync labels Jul 2, 2026

Thanhphan1147 changed the title ~~test: replace juju ssh with juju exec to fix Juju 4 SSH key auth failures~~ Support juju 4 in integration tests Jul 2, 2026

github-actions Bot added Libraries: Out of sync and removed Libraries: OK labels Jul 2, 2026

Thanhphan1147 added 2 commits July 3, 2026 16:58

Merge branch 'main' into migrate-integration-tests-juju4

7912111

github-actions Bot added Libraries: OK Libraries: Out of sync and removed Libraries: Out of sync Libraries: OK labels Aug 12, 2026

Thanhphan1147 added the no-release-note This PR does not require a change artifact label Aug 12, 2026

move concierge to juju 4.1/edge

e1325e5

github-actions Bot added Libraries: OK Libraries: Out of sync and removed Libraries: Out of sync Libraries: OK labels Aug 12, 2026

Thanhphan1147 added 3 commits August 12, 2026 21:53

test(spoe): replace juju ssh with juju exec for Juju 4 compatibility

139adc4

test: replace juju scp with exec-based cert injection for Juju 4

7fae349

test(route-policy): add force=True to store charm deploys for Juju 4

1aa8bbc

github-actions Bot added Libraries: OK Libraries: Out of sync and removed Libraries: Out of sync Libraries: OK labels Aug 12, 2026

change juju.ssh to juju.exec

3ffef08

github-actions Bot added the Libraries: OK label Aug 13, 2026

github-actions Bot removed the Libraries: Out of sync label Sep 2, 2026

add more aggressive wait checks to account for juju 4 behavior

90d6e37

github-actions Bot added Libraries: Out of sync Libraries: OK and removed Libraries: OK Libraries: Out of sync labels Sep 3, 2026

run hacluster tests in juju3, wait more aggressively for legacy tests

a516330

github-actions Bot added Libraries: OK Libraries: Out of sync and removed Libraries: Out of sync Libraries: OK labels Sep 3, 2026

Thanhphan1147 enabled auto-merge (squash) September 3, 2026 10:00

f-atwi reviewed Sep 3, 2026

View reviewed changes

seb4stien reviewed Sep 3, 2026

View reviewed changes

f-atwi reviewed Sep 3, 2026

View reviewed changes

Comment thread .gitignore

artifacts.build.yaml

.worktrees

**/superpowers/** No newline at end of file

f-atwi Sep 3, 2026

Copy link
Copy Markdown

Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

newline

seb4stien reviewed Sep 3, 2026

View reviewed changes

f-atwi approved these changes Sep 3, 2026

View reviewed changes

seb4stien approved these changes Sep 3, 2026

View reviewed changes

Uh oh!

Conversation

Thanhphan1147 commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

f-atwi left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Thanhphan1147 commented Jul 2, 2026 •

edited

Loading