Share cloud credentials on the controller

[George Kraft]

Our original machine is configured with an openstack cloud and credentials, which we used to bootstrap the controller.

On the original machine, as the admin user, we ran:

$ juju add-user vpil-01
$ juju grant vpil-01 addmodel

On a different machine which does -not- have openstack cloud or credentials, we register the vpil-01 user and observe that we're not able to create models:

$ juju register MGsTB3ZwaWwtMD...
$ juju add-model test
ERROR no credential specified

However, if we logout and login as admin on that same machine, we can add models with no problem:

$ juju logout
$ juju login admin
$ juju add-model test2
Added 'test2' model on vpil-openstack/RegionOne with credential 'admin' for user 'admin'

Occurs using Juju 2.0 RC2.

[Anastasia (anastasia-macmood)]

This is working as expected.
Users need to be granted permissions to create models.
Admin users have this permission by default.

[Ian Booth (wallyworld)]

The real issue here is that when you try and add a model, you need to supply credentials to use. If you are the admin user, your credentials will already be stored in the controller. If you are another user with add-model permission, you will need to specify what credential you want to use the first time a model is added. You may need to run juju add-credential first to make Juju aware of any credential you want to use.

[Anastasia (anastasia-macmood)]

We need to update helpdoc for add-model command.

Doc issue is here: https://github.com/juju/docs/issues/1433

[Anastasia (anastasia-macmood)]

PR: https://github.com/juju/juju/pull/6422

[Marco Ceppi (marcoceppi)]

This is actually largely problematic. There is a clear path where I, as an admin of a controller, want users to not have credentials and simply use the admins credentials again. This worked in beta18 but was removed in rc1.

[Ian Booth (wallyworld)]

To do the feature work required requires some thought about how credentials are managed in various scenarios, including management of credentials per user per cloud, sharing of credentials and associated permissions, setting default credentials, etc. The work here is more than just a bug fix. There's no way this can be done for 2.1-beta2. It is doubtful 2.1 is realistic (depending on timeframe of the release). However, there's some scope to do some work in the 2.2 cycle.

[Antonio Rosales (arosales)]

This is also effects Charm CI where we would like to add a controller to the CI model and then have Jenkins create new models for testing under that shared controller without having to pass credentials.

[Cory Johns (johnsca)]

https://bugs.launchpad.net/juju/+bug/1652171 is also relevant to this, since I get this error even after having added the credential (though explicitly naming the credential via --credential does work).

[Anastasia (anastasia-macmood)]

Upgraded to 'High' based on comment #5 and comment # 7.

[Tim Penhey (thumper)]

If the admin wants to share the credential with other users, then for now, the non-admin users will need to add-credential.

[Tim Penhey (thumper)]

Other work is taking priority over this right now, so I'm going to stop pretending that this is going to be fixed in the next release.

[Anastasia (anastasia-macmood)]

There is 2 issues conflicted in this report:

1. New user needs to have 'add-model' permission granted and their credentials added locally and to the controller, before this user can add-model. This is tracked in a different bug # 1814395.

2. A user with cloud credential on the controller wants to share this credential with other controller users.

I'll rename this bug to be focused on 2 only.