Key retrieval not covered by apt-proxy settings in juju

[Jason Hobbs]

While installing the package is covered by juju's apt-http-proxy and apt-https-proxy settings, retrieving the key is not.

It would be a lot nicer if the charm had a config setting for the key, and included the key as the default setting.

Right now to work around this, I have to host the key internally somewhere on my network.

[Nobuto Murata (nobuto)]

Looks like this is an upstream bug report:
https://github.com/ansible/ansible/issues/31691

[David Coronel (davecore)]

This original code fails:

- name: Add apt key.
  tags:
    - install
    - upgrade-charm
    - config-changed
  apt_key: url={{ apt_key_url }} state=present id={{gpg_key_id}}
  when: (apt_key_url != "" and gpg_key == "")

But adding http_proxy and https_proxy in an environment section of that play works:

- name: Add apt key.
  tags:
    - install
    - upgrade-charm
    - config-changed
  apt_key: url={{ apt_key_url }} state=present id={{gpg_key_id}}
  environment:
    http_proxy: 'http://192.168.210.1:3128'
    https_proxy: 'http://192.168.210.1:3128'
  when: (apt_key_url != "" and gpg_key == "")

I do that by editing the file /var/lib/juju/agents/unit-elasticsearch-0/charm/tasks/install-elasticsearch.yml directly on the elasticsearch/0 unit after it failed. It succeeds on the next try.

Maybe we can carry this workaround in the code while upstream fixes the bug?

[Mia Altieri (miaaltieri)]

I also encountered this, it appears on install there is a task path is for this install Task in the file: `task path: /var/lib/juju/agents/unit-elasticsearch-1/charm/tasks/install-elasticsearch.yml:19` and in there is:
```
16: shell: HTTPS_PROXY={{ lookup('env','JUJU_CHARM_HTTPS_PROXY') }} curl -s {{ apt_key_url }} | apt-key add -
26: https_proxy: "{{ lookup('env','JUJU_CHARM_HTTPS_PROXY') }}"
```
so I think it is using the `JUJU_CHARM` proxy rather than the HTTPS_PROXY. doing `juju model-config juju-http-proxy=www.myproxy.cool juju-https-proxy=www.myproxy.cool` resolved this

[Mia Altieri (miaaltieri)]

Some more context on my above message (I can't figure out how to edit my response :sweat_smile:

I notice the key retrival was failing when the ansible command `ansible-playbook -vvv -c local playbook.yaml --tags install` failed due to a network error in the install hook. Which was interesting becasue I was using `https_proxy` and `http_proxy` variables in the juju config.

When I looked at the output of the failing ansible command from the a `juju ssh` session it said:
```
<localhost> EXEC /bin/sh -c 'https_proxy='"'"''"'"' /usr/bin/python3 /root/.ansible/tmp/ansible-tmp-1656513347.4230187-271040282805840/AnsiballZ_apt_key.py && sleep 0'
```
and that proxy looked VERY odd, above this I saw the Task it was trying to execute and it said it was in the file `/var/lib/juju/agents/unit-elasticsearch-1/charm/tasks/install-elasticsearch.yml:19` so I thought I would inspect this to see what this file was setting up for its proxy, after `grep`ing around I saw that it was setting its proxy relative to the `juju_http/s_proxy` enviornemnt variable NOT the `http/s_proxy` enviornment variable

```
16: shell: HTTPS_PROXY={{ lookup('env','JUJU_CHARM_HTTPS_PROXY') }} curl -s {{ apt_key_url }} | apt-key add -
26: https_proxy: "{{ lookup('env','JUJU_CHARM_HTTPS_PROXY') }}"
```
to update the enviornment variable I did `juju model-config juju-http-proxy=www.myproxy.cool juju-https-proxy=www.myproxy.cool` and sure enough it resolved the issue :)