DNS HA configuration should be able to update MAAS API credentials

[Gábor Mészáros]

It is currently not possible to update maas credentials via the charm configuration, as it does not trigger the necessary pacemaker resource configuration update.
If the unit was deployed with a bogus maas credential (or the MAAS API credential had to be updated for security reasons), the charm will fail to connect to MAAS to maintain its DNS entry.
Current workaround is to manually adjust the credential for the resource, but this could be easily done by the charm upon config-changed.

[Frode Nordahl (fnordahl)]

Could you share anything about the frequency of hitting this issue?

[Gábor Mészáros (gabor.meszaros)]

Hi Frode,

it happens always, in case of faulty maas credential configuration in the bundle.
Let me paste here a snippet:

# Copyright (c) 2017 Canonical USA Inc. All rights reserved.
#
# Foundation Converged
#
series: xenial
variables:
...

  # MAAS info
  maas_url: &maas_url http://100.99.5.100/MAAS
  maas_credentials: &maas_credentials e2Nr84yjuTBAYkJAqN:kZvmpm8Qt3TS9Hcv2d:jQ5waMrLWRtJWkeXpGLuqUFmyYXP3bch
  maas_source: &maas_source ""
...

machines:
  "0":
    constraints: tags=4-management
    series: xenial
  "1":
    constraints: tags=5-management
    series: xenial
  "2":
    constraints: tags=6-management
    series: xenial
...
applications:
  hacluster-cinder:
    charm: ../charms/hacluster
    options:
      cluster_count: 3
      maas_url: *maas_url
      maas_credentials: *maas_credentials
      maas_source: *maas_source
...
  cinder:
    charm: ../charms/cinder
    num_units: 3
    constraints: *ceph-access-constr
    bindings:
      "": *oam-space
      public: *public-space
      admin: *admin-space
      internal: *internal-space
      shared-db: *internal-space
    options:
      worker-multiplier: *worker-multiplier
...
    to:
    - lxd:0
    - lxd:1
    - lxd:2
...
relations:
  - [ cinder, hacluster-cinder ]
...

This is just a cut&paste, but I hope it gives you the basic idea how I have this setup.
From hereon, when I try
    juju config hacluster-cinder maas_credentials=ABCD
nothing happens in the charm, it does not handle the maas creds reconfiguration.

[Launchpad Janitor (janitor)]

[Expired for OpenStack hacluster charm because there has been no activity for 60 days.]

[Vern Hart (vern)]

Reopening this.

Customer's deployment has units in multiple subnets so can't use L2 vip. If the MAAS API key changes, running juju config does not update the pacemaker configuration.

After running:

  juju config hacluster-mysql maas_credentials='<new api key>'

Checking pacemaker shows the old key:

  juju ssh hacluster-mysql/0 sudo crm configure show

[Alex Kavanagh (ajkavanagh)]

The config-changed hook doesn't attempt to update the credentials in the pacemaker; it looks like it is currently an install only option. It's obviously useful for it to be configurable on an installed system.

[Pedro Victor Lourenço Fragola (pedrovlf)]

I have the same issue using the Masakari+hacluster and the only way to update the maas_credentials was manually adjust the credential:

crm config edit st-maas