Support juju 4 in integration tests

.gitignore

@@ -38,3 +38,4 @@ haproxy-route-policy/.python-version
 artifacts.build.yaml
 
 .worktrees
+**/superpowers/**

concierge-ck8s-juju3.yaml

@@ -0,0 +1,22 @@
+# Copyright 2026 Canonical Ltd.
+# See LICENSE file for licensing details.
+
+juju:
+  channel: 3/stable
+  model-defaults:
+    test-mode: "true"
+    automatically-retry-hooks: "false"
+
+providers:
+  lxd:
+    enable: true
+    bootstrap: true
+  k8s:
+    enable: true
+    bootstrap: false
+    channel: 1.32-classic/stable
+    features:
+      load-balancer:
+        enabled: true
+        l2-mode: true
+        cidrs: 10.43.45.0/24

concierge-ck8s.yaml

@@ -2,7 +2,7 @@
 # See LICENSE file for licensing details.
 
 juju:
-  channel: 3/stable
+  channel: 4.1/edge
   model-defaults:
     test-mode: "true"
     automatically-retry-hooks: "false"

concierge-lxd-juju3.yaml

@@ -0,0 +1,19 @@
+# Copyright 2026 Canonical Ltd.
+# See LICENSE file for licensing details.
+
+juju:
+  channel: 3/stable
+  model-defaults:
+    test-mode: "true"
+    automatically-retry-hooks: "false"
+
+providers:
+  lxd:
+    enable: true
+    bootstrap: true
+
+host:
+  snaps:
+    charmcraft:
+      channel: latest/stable
+      classic: true

concierge-lxd.yaml

@@ -2,7 +2,7 @@
 # See LICENSE file for licensing details.
 
 juju:
-  channel: 3/stable
+  channel: 4.1/edge
   model-defaults:
     test-mode: "true"
     automatically-retry-hooks: "false"

haproxy-operator/src/charm.py

@@ -668,7 +668,7 @@ def _get_peer_units_address(self) -> list[str]:
             for unit in haproxy_peer_integration.units:
                 if unit != self.unit:
                     if peer_unit_address := haproxy_peer_integration.data[unit].get(
-                        "private-address"
+                        "ingress-address"
                     ):
                         peer_units_address.append(peer_unit_address)
                     else:

haproxy-operator/src/http_interface.py

@@ -185,7 +185,14 @@ def _on_relation_joined(self, event: RelationJoinedEvent) -> None:
             event: relation-changed event.
         """
         event.relation.data[self.charm.unit].update(
-            {"hostname": self.bind_address, "port": f"{DEFAULT_HAPROXY_PORT}"}
+            {
+                "hostname": self.bind_address,
+                "port": f"{DEFAULT_HAPROXY_PORT}",
+                # Juju >= 4.0 no longer populates `private-address` in unit
+                # relation data automatically. Write it explicitly so legacy
+                # charms integrating over the http interface keep working.
+                "private-address": self.bind_address,
+            }
         )
 
     # We add a placeholder implementation of this method because of parent class

haproxy-operator/src/state/haproxy_route.py

@@ -342,9 +342,9 @@ def from_requirer(
                 provider_data = relation.load(HaproxyRoutePolicyProviderAppData, relation.app)
                 provider_unit_addresses = [
                     # explicitly cast to IPvAnyAddress because we already filtered out None values.
-                    cast(IPvAnyAddress, relation.data[unit].get("private-address"))
+                    cast(IPvAnyAddress, unit_address)
                     for unit in relation.units
-                    if relation.data[unit].get("private-address") is not None
+                    if (unit_address := relation.data[unit].get("ingress-address")) is not None
                 ]
                 return cls(
                     policy_backend_port=provider_data.policy_backend_port,

haproxy-operator/tests/integration/conftest.py

@@ -92,7 +92,10 @@ def certificate_provider_application_fixture(
         logger.warning("Using existing application: %s", SELF_SIGNED_CERTIFICATES_APP_NAME)
         return SELF_SIGNED_CERTIFICATES_APP_NAME
     juju.deploy(
-        "self-signed-certificates", app=SELF_SIGNED_CERTIFICATES_APP_NAME, channel="1/edge"
+        "self-signed-certificates",
+        app=SELF_SIGNED_CERTIFICATES_APP_NAME,
+        channel="1/edge",
+        force=True,
     )
     return SELF_SIGNED_CERTIFICATES_APP_NAME
 
@@ -334,6 +337,14 @@ def haproxy_route_tcp_relation_fixture(
         f"{configured_application_with_tls}:haproxy-route-tcp",
         any_charm_haproxy_route_tcp_requirer,
     )
+    juju.wait(
+        lambda status: (
+            status.apps[configured_application_with_tls].is_blocked
+            and jubilant.all_agents_idle(
+                status, configured_application_with_tls, any_charm_haproxy_route_tcp_requirer
+            )
+        ),
+    )
     juju.run(
         f"{any_charm_haproxy_route_tcp_requirer}/0",
         "rpc",

haproxy-operator/tests/integration/helper.py

@@ -196,10 +196,10 @@ def get_http_version_from_apache2_logs(
     Returns:
         The extracted HTTP version string.
     """
-    last_httpx_log_entry = juju.ssh(
-        f"{app_name}/0",
+    last_httpx_log_entry = juju.exec(
         f"grep '{request_id}' /var/log/apache2/access.log | tail -n 1",
-    )
+        unit=f"{app_name}/leader",
+    ).stdout
 
     match = pattern.search(last_httpx_log_entry)
     if not match:

haproxy-operator/tests/integration/legacy/test_action.py

@@ -27,7 +27,9 @@ def test_get_certificate_action(
     )
     assert "-----BEGIN CERTIFICATE-----" in task.results.get("certificate", "")
 
-    stdout = juju.ssh(f"{configured_application_with_tls}/0", "ls /var/lib/haproxy/certs")
+    stdout = juju.exec(
+        "ls /var/lib/haproxy/certs", unit=f"{configured_application_with_tls}/0"
+    ).stdout
     assert f"{TEST_EXTERNAL_HOSTNAME_CONFIG}.pem" in stdout
 
     # The action should fail when run without the required hostname parameter.

haproxy-operator/tests/integration/legacy/test_config.py

@@ -19,5 +19,5 @@ def test_config(application: str, juju: jubilant.Juju):
     juju.config(application, {"global-maxconn": "1024"})
     juju.wait(lambda status: jubilant.all_active(status, application))
 
-    stdout = juju.ssh(f"{application}/0", "cat /etc/haproxy/haproxy.cfg")
+    stdout = juju.exec("cat /etc/haproxy/haproxy.cfg", unit=f"{application}/0").stdout
     assert "maxconn 1024" in stdout

haproxy-operator/tests/integration/legacy/test_cos.py

@@ -12,5 +12,5 @@ def test_metrics(application: str, juju: jubilant.Juju):
     act: request haproxy metrics endpoint via SSH.
     assert: confirm that metrics are available.
     """
-    stdout = juju.ssh(f"{application}/0", "curl -m 10 localhost:8404/metrics")
+    stdout = juju.exec("curl -m 10 localhost:8404/metrics", unit=f"{application}/0").stdout
     assert "haproxy_backend_max_connect_time_seconds" in stdout

haproxy-operator/tests/integration/legacy/test_haproxy_route.py

@@ -7,7 +7,7 @@
 import pytest
 from requests import Session
 
-from .conftest import TEST_EXTERNAL_HOSTNAME_CONFIG, get_unit_ip_address
+from .conftest import TEST_EXTERNAL_HOSTNAME_CONFIG, all_active_and_idle, get_unit_ip_address
 from .helper import DNSResolverHTTPSAdapter
 
 HAPROXY_ROUTE_REQUIRER_HOSTNAME = f"ok.{TEST_EXTERNAL_HOSTNAME_CONFIG}"
@@ -28,10 +28,18 @@ def test_haproxy_route_integration(
         f"{configured_application_with_tls}:haproxy-route",
         f"{haproxy_route_requirer}:require-haproxy-route",
     )
+    juju.wait(
+        lambda status: (
+            status.apps[configured_application_with_tls].is_blocked
+            and jubilant.all_agents_idle(
+                status, configured_application_with_tls, haproxy_route_requirer
+            )
+        ),
+    )
     juju.run(f"{haproxy_route_requirer}/0", "rpc", {"method": "update_relation"})
 
     juju.wait(
-        lambda status: jubilant.all_active(
+        lambda status: all_active_and_idle(
             status, configured_application_with_tls, haproxy_route_requirer
         )
     )

haproxy-operator/tests/integration/legacy/test_http_interface.py

@@ -9,7 +9,7 @@
 import pytest
 import requests
 
-from .conftest import get_unit_address
+from .conftest import all_active_and_idle, get_unit_address
 
 
 @pytest.mark.abort_on_fail
@@ -27,8 +27,17 @@ def test_reverseproxy_relation(
     juju.run(f"{any_charm_requirer}/0", "rpc", {"method": "start_server"})
 
     juju.integrate(f"{application}:reverseproxy", any_charm_requirer)
+    juju.wait(
+        lambda status: (
+            any(
+                relation.related_app == application
+                for relation in status.apps[any_charm_requirer].relations.get("provide-http", [])
+            )
+            and jubilant.all_agents_idle(status, application, any_charm_requirer)
+        )
+    )
     juju.run(f"{any_charm_requirer}/0", "rpc", {"method": "update_relation_data"})
-    juju.wait(lambda status: jubilant.all_active(status, application, any_charm_requirer))
+    juju.wait(lambda status: all_active_and_idle(status, application, any_charm_requirer))
 
     unit_address = get_unit_address(juju, application)
 

haproxy-operator/tests/integration/legacy/test_website.py

@@ -7,7 +7,7 @@
 import pytest
 import requests
 
-from .conftest import get_unit_address
+from .conftest import all_active_and_idle, get_unit_address
 
 
 @pytest.mark.abort_on_fail
@@ -22,7 +22,19 @@ def test_website_relation(
     assert: Requests to reverseproxy-requirer return the default haproxy page.
     """
     juju.integrate(f"{application}:website", f"{reverseproxy_requirer}:reverseproxy")
-    juju.wait(lambda status: jubilant.all_active(status, application, reverseproxy_requirer))
+    juju.wait(
+        lambda status: (
+            any(
+                relation.related_app == application
+                for relation in status.apps[reverseproxy_requirer].relations.get(
+                    "reverseproxy", []
+                )
+            )
+            and all_active_and_idle(status, application, reverseproxy_requirer)
+        ),
+        delay=5,
+        successes=6,
+    )
 
     unit_address = get_unit_address(juju, reverseproxy_requirer)
     response = requests.get(unit_address, timeout=5)

haproxy-operator/tests/integration/test_actions.py

@@ -9,6 +9,8 @@
 import jubilant
 import pytest
 
+from .conftest import all_active_and_idle
+
 
 @pytest.mark.abort_on_fail
 def test_action(
@@ -23,6 +25,14 @@ def test_action(
     juju.integrate(
         f"{configured_application_with_tls}:haproxy-route", any_charm_haproxy_route_requirer
     )
+    juju.wait(
+        lambda status: (
+            status.apps[configured_application_with_tls].is_blocked
+            and jubilant.all_agents_idle(
+                status, configured_application_with_tls, any_charm_haproxy_route_requirer
+            )
+        ),
+    )
 
     juju.run(
         f"{any_charm_haproxy_route_requirer}/0",
@@ -43,7 +53,7 @@ def test_action(
         },
     )
     juju.wait(
-        lambda status: jubilant.all_active(
+        lambda status: all_active_and_idle(
             status, configured_application_with_tls, any_charm_haproxy_route_requirer
         )
     )
@@ -79,7 +89,9 @@ def test_action(
     assert task.results == {"endpoints": "[]"}, task.results
 
     # get-configuration returns exactly the configuration currently on disk.
-    on_disk = juju.ssh(f"{configured_application_with_tls}/0", "cat /etc/haproxy/haproxy.cfg")
+    on_disk = juju.exec(
+        "cat /etc/haproxy/haproxy.cfg", unit=f"{configured_application_with_tls}/0"
+    ).stdout
     task = juju.run(f"{configured_application_with_tls}/0", "get-configuration")
     assert task.results["source"] == "disk", task.results
     assert task.results["configuration"].splitlines() == on_disk.splitlines(), task.results