The interface gates raising the state '{relation_name}.available' on the presence of the allowed_units key in the relation data. But it does not check that the unit in question is in the list. This means that the available state is raised potentially triggering charms to run actions against the database before the unit acl has been created. This situation caused a test failure with gnocchi recently.
I believe the reason this hasn't caused too many problems before now is that most reactive openstack charms wait until all interfaces are complete before doing anything (including db migrations). So they will be waiting on keystone to complete the identity relation which usually will take quite a long time and in that window the db will have processed all the acl requests.
Fix proposed to branch: master
Review: https:/