setting amp-ssh-pub-key after initial deployment requires configure-resources action to take effect

[Nobuto Murata]

For debugging purpose, I tried to use the following option to enable SSH access to Amphora instances.

> amp-ssh-key-name
> (string) Name of nova key to use to provide ssh access to Amphora
> VMs. Note that this key must be visible to the project used by Octavia.
>
> amp-ssh-pub-key
> (string) Base64 encoded public ssh key. This will be used when
> creating the key named by amp-ssh-key-name. Note that once the key is
> created it cannot be modified and the only way to do so is to delete it
> and have the charm create a new one.

However, the key wasn't uploaded unless configure-resources action was invoked explicitly. It would be nice the config description is more clear on this requirement.

[Nobuto Murata (nobuto)]

As far as I see, create_nova_keypair is only called by src/actions/actions.py not from config-chaned.

[Frode Nordahl (fnordahl)]

Yes, the action exist due to the inherent inaccuracy of charm readiness vs. payload readiness ref bug 1854518. And this also affects the Nova API calls required to create the SSH keys.

To fully resolve this class of issues we need a outside view of the model with something like a governor charm. This is not possible to resolve within the current APIs and guarantees provided by Juju.

As such I'll triage this as a feature request.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/charm-octavia/+/828996

[OpenStack Infra (hudson-openstack)]

Change abandoned by "James Page <email address hidden>" on branch: master
Review: https://review.opendev.org/c/openstack/charm-octavia/+/828996
Reason: This review is > 12 weeks without comment, and failed testing the last time it was checked. We are abandoning this for now. Feel free to reactivate the review by pressing the restore button and leaving a 'recheck' comment to get fresh test results.