When a secret's tracked revision is removed, it cannot track a new one

Bug #2063519 reported by Tony Meyer
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Canonical Juju
Triaged
High
Caner Derici

Bug Description

Juju 3.4.2, microk8s.

Given an application secret and a unit that is tracking a non-latest revision, if the charm executing on that unit removes the tracked revision, then it seems to get into a broken state (with respect to the secret) that it cannot get out of, in that it can't get the secret (fine - the revision is gone), but it also can't `--refresh` to move to a newer revision either.

To reproduce:

Given this charm:

```python
class TestingSecretRevisionsCharm(ops.CharmBase):
    def __init__(self, framework: ops.Framework):
        super().__init__(framework)
        framework.observe(self.on.install, self._on_install)
        framework.observe(self.on.set_action, self._on_set)
        framework.observe(self.on.get_action, self._on_get)
        framework.observe(self.on.remove_action, self._on_remove)

    def _on_install(self, event):
        self.app.add_secret({"foo": "bar"}, label="my-secret")

    def _on_set(self, event):
        secret = self.model.get_secret(label="my-secret")
        secret.set_content(event.params)

    def _on_get(self, event):
        secret = self.model.get_secret(label="my-secret")
        event.set_results(secret.get_content(refresh=event.params.get("refresh", False)))

    def _on_remove(self, event):
        secret = self.model.get_secret(label="my-secret")
        secret.remove_revision(event.params["revision"])
```

Pack and deploy, and then run:

```
juju run testing-secret-revisions/0 set two=two
juju run testing-secret-revisions/0 remove revision=1
juju run testing-secret-revisions/0 get # this will fail as expected
juju run testing-secret-revisions/0 get refresh=true # this would ideally succeed
```

Ian Booth (wallyworld)
Changed in juju:
milestone: none → 3.4.3
importance: Undecided → High
status: New → Triaged
Caner Derici (cderici)
Changed in juju:
assignee: nobody → Caner Derici (cderici)
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.