failed migration leaves model unkillable

[John A Meinel]

Follow on from: https://bugs.launchpad.net/juju-core/+bug/1611391

presumably because the migration hasn't fully "completed successfully", we are unable to "juju destroy-model A:foo".

However:

1) "juju destroy-model" returns successfully, making you think it has already killed the model, or at the very list it will die soon.
2) no obvious errors in "juju debug-log -m A:controller"
3) no way to kick the migration and abort it, nor complete it, nor forcibly destroy the model. I seem to have to kill the entire controller in order to recover.

I actually have the same problem running
"juju destroy-application elasticsearch"
It doesn't give any indication that it didn't work, but the services still appear to be perfectly happy (they are not in a DYING state).

I would have expected that we might go into a "destroying applications not allowed during a migration", and at least inform the user that we are rejecting their request.

Oh, and I can't run "juju destroy-controller" because it waits for the model to be killed, and I can't run "juju kill-controller" because it does a destroy-controller before it tries to do the rest.

[Menno Finlay-Smits (menno.smits)]

Alexis just ran into this as well found something potentially useful. Although destroy-controller --destroy-all-models was stuck she was able to destroy each model separately and then destroy the controller (without --destroy-all-models). There might be some interaction with what --destroy-all-models is doing.

[Anastasia (anastasia-macmood)]

It appears that there are a few things in here:

1. User cannot abort migration;
2. On failed migration, model is indestructible;
3. On failed migration, controller is indestructible;
4. On failed migration, destroying controller with --destroy-all-models does not seem to work;
5. Destroying anything during migration - unit, application, etc - should be prevented during model migration.

Destroying or affecting model during migration is not allowed. The model is in read-only mode and currently reports "model migration in progress". We should have a functional test for it.

Destroy controller, 3 and 4 above, are tested indirectly in model migration functional test suite. There is a test that fails migration due to user permissions and then destroys controller. This test passes as seen in http://reports.vapour.ws/releases/4861 (functional-model-migration).

Destroying model (2 above) has been fixed by the time comment # 1 was written.

As for user to abort migration (5), this is a feature request.
@John,
Are you requesting an ability for the user to be able to abort migration in progress? Please file a separate bug if this is the case.

I am marking this bug as Fix Committed against current active milestone as model and controller can now be destroyed once migration fails.