Comment 9 for bug 1849323

Hi Rodrigo, well spotted, the tokens were indeed changing on leader switch hence why it was working - I just misread the values. That at least makes sense now.

Regarding your testing, the issue here is that the consuming charms are not currently tolerant of eventual consistency and that is irrespective of if they are using the interface or charmhelpers code. That and, as you point out, that the last_token logic is not sufficient. So I think the way we need to fix is not on the provider (vault) side but actually on the consumer/requires side such that it is tolerant of invalid tokens, records which ones it has tried regardless of success and then moves on to try any others that are presented until one works. That takes advantage of the fact that vault is currently guaranteeing that at least one will be valid and, crucially, it means that we dont need to introduce logic on the provider side that will result in extra hooks noise (e.g. settings propagation or relation clearing) and that would still be eventually consistent so would not actually resolve the issue entirely. I am therefore going to add all charms that will need updating to this bug.