egress-subnets not equivalent to --via

[Paul Collins]

The documentation at https://juju.is/docs/cross-model-relations#heading--relations-and-firewalls leads me to believe that the following should be equivalent:

Case 1)

juju model-config egress-subnets=10.9.8.0/24
juju relate mattermost admin/othermodel.postgresql

Case 2)

juju relate mattermost admin/othermodel.postgresql --via 10.9.8.0/24

However, with Juju 2.8-rc2, in my testing, for case 1, cs:postgresql charm adds entries to pg_hba.conf for the k8s internal subnet, whereas in case 2 it behaves as I expect and adds entries for the specified network.

[Ian Booth (wallyworld)]

It looks like there's 2 code paths here.

When a unit enters scope, the relation data is set up and initial ingress and egress info is added to the relation data. It seems there's a bug in this code which does not fall back to the model default egress-subnets if --via is not used.

Then there's the network-get hook command which prints out the network info and which does seem to do the right thing.

So if the charm gets its network info straight from relation data and not network-get, then that could explain the observed behaviour.

[Paul Collins (pjdc)]

Without:

(mojo-prod-mattermost)prod-mattermost@wekufe:~$ juju model-config egress-subnets
(mojo-prod-mattermost)prod-mattermost@wekufe:~$ juju run --application mattermost -- network-get --egress-subnets db
10.85.3.128/32
(mojo-prod-mattermost)prod-mattermost@wekufe:~$ _

With:

(mojo-prod-mattermost)prod-mattermost@wekufe:~$ juju model-config egress-subnets=10.25.148.0/23
(mojo-prod-mattermost)prod-mattermost@wekufe:~$ juju run --application mattermost -- network-get --egress-subnets db
10.25.148.0/23
(mojo-prod-mattermost)prod-mattermost@wekufe:~$ _

[Ian Booth (wallyworld)]

I checked the code in a bit more detail and the unused method parameter I thought was the culprit was a red herring (the default is set elsewhere, that method parameter should be removed).
Anyway, it could be that with the postgresql charm, the offer is done on the consuming side and so the egress-subnets model default needs to be set in that other model.

[Ian Booth (wallyworld)]

I'll mark as Incomplete since it seems it could be a charm issue.
If we can get a reproduction case that confirms a juju bug we can reopen.

[Launchpad Janitor (janitor)]

[Expired for juju because there has been no activity for 60 days.]