When there is no local credential but the controller has a credential, the add-model command will ignore the region that's been specified on the command line.
A brief look at the code shows the likely cause. This statement overrides the region that's been specified by the user with whatever findCredential returns.
// Find a credential to use with the new model.
credential, credentialTag, cloudRegion, err := c.findCredential(ctx, cloudClient, &findCredentialParams{
cloudTag: cloudTag,
cloudRegion: cloudRegion,
cloud: cloud,
modelOwner: modelOwner,
})
if err != nil {
return errors.Trace(err)
}
In findUnspecifiedCredential, when the UserCredentials API call returns a credential tag, and findLocalCredential returns nothing, we'll return a blank cloudRegion.
Here is a sample log transcript of a command that gets it wrong. We are trying to add a model in the google/asia-east1 region, but observe that the model was actually created in google/us-central1.
% juju add-model testing4 google/asia-east1 --debug --logging-config TRACE
17:07:33 INFO juju.cmd supercommand.go:63 running juju [2.2.6 gc devel +6e9960e Mon Nov 13 00:35:25 2017 +0000]
17:07:33 DEBUG juju.cmd supercommand.go:64 args: []string{"juju", "add-model", "testing4", "google/asia-east1", "--debug", "--logging-config", "TRACE"}
17:07:33 INFO juju.juju api.go:67 connecting to API addresses: [jimm.jujucharms.com:443]
17:07:33 DEBUG juju.api apiclient.go:715 looked up jimm.jujucharms.com -> [162.213.33.250 162.213.33.28]
17:07:33 DEBUG juju.api apiclient.go:863 successfully dialed "wss://jimm.jujucharms.com:443/api"
17:07:33 DEBUG juju.api apiclient.go:863 successfully dialed "wss://jimm.jujucharms.com:443/api"
17:07:33 INFO juju.api apiclient.go:617 connection established to "wss://jimm.jujucharms.com:443/api"
17:07:33 TRACE juju.rpc.jsoncodec codec.go:225 -> {"request-id":1,"type":"Admin","version":3,"request":"Login","params":{"auth-tag":"","credentials":"","nonce":"","macaroons":"elided","user-data":""}}
17:07:33 TRACE juju.rpc.jsoncodec codec.go:120 <- {"request-id":1,"response":{"controller-tag":"controller-a030379a-940f-4760-8fcf-3062b41a04e7","user-info":{"display-name":"rogpeppe","identity":"user-rogpeppe@external","controller-access":"","model-access":""},"facades":[{"name":"Admin","versions":[3]},{"name":"Bundle","versions":[1]},{"name":"Cloud","versions":[1]},{"name":"Controller","versions":[3]},{"name":"JIMM","versions":[1]},{"name":"ModelManager","versions":[2]},{"name":"Pinger","versions":[1]},{"name":"UserManager","versions":[1]}],"server-version":"2.2.2"}}
17:07:33 INFO cmd authkeys.go:114 Adding contents of "/home/rog/.local/share/juju/ssh/juju_id_rsa.pub" to authorized-keys
17:07:33 INFO cmd authkeys.go:114 Adding contents of "/home/rog/.ssh/id_rsa.pub" to authorized-keys
17:07:33 TRACE juju.rpc.jsoncodec codec.go:225 -> {"request-id":2,"type":"Cloud","version":1,"request":"Cloud","params":{"entities":[{"tag":"cloud-google"}]}}
17:07:33 TRACE juju.rpc.jsoncodec codec.go:120 <- {"request-id":2,"response":{"results":[{"cloud":{"type":"gce","auth-types":["jsonfile","oauth2"],"regions":[{"name":"asia-east1","endpoint":"https://www.googleapis.com"},{"name":"europe-west1","endpoint":"https://www.googleapis.com"},{"name":"us-central1","endpoint":"https://www.googleapis.com"},{"name":"us-east1","endpoint":"https://www.googleapis.com"}]}}]}}
17:07:33 TRACE juju.rpc.jsoncodec codec.go:225 -> {"request-id":3,"type":"Cloud","version":1,"request":"UserCredentials","params":{"user-clouds":[{"user-tag":"user-rogpeppe@external","cloud-tag":"cloud-google"}]}}
17:07:33 TRACE juju.rpc.jsoncodec codec.go:120 <- {"request-id":3,"response":{"results":[{"result":["cloudcred-google_rogpeppe@external_google"]}]}}
17:07:33 TRACE juju.rpc.jsoncodec codec.go:225 -> {"request-id":4,"type":"ModelManager","version":2,"request":"CreateModel","params":{"name":"testing4","owner-tag":"user-rogpeppe@external","config":{"authorized-keys":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDcIkCNX3r2ElBdnP5Sn/vWlrRzYvRYmRDhl0/rPZeWQrfYHygL7q34BFkZ/ce1xl/bm809CxzB3mFSzrUn565duS/p2i9XtEr6oJp392RZhSf4i0/w7bIQ5tv3WI+59tH6iFEtOHvuSWf28JPc46R9ps11LGzyu9P7SQyqNlaKMIHSBTbVZ3IguNh8xXriWy1O3KABMR18hRVB5yTbOP/dSkN+GNl8zuL6PeLxiUB8I8RIafBLbigC/+dsrHVtFQO3SBnlBHx0VsvpD3uV971RIac6+Pl0+98G6en6n4vNhV7g3c+k9Tw+IiGyrYN9qeGG0WMtv8WbJHobunHMLkX7 juju-client-key\nssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDOjaOjVRHchF2RFCKQdgBqrIA5nOoqSprLK47l2th5I675jw+QYMIihXQaITss3hjrh3+5ITyBO41PS5rHLNGtlYUHX78p9CHNZsJqHl/z1Ub1tuMe+/5SY2MkDYzgfPtQtVsLasAIiht/5g78AMMXH3HeCKb9V9cP6/lPPq6mCMvg8TDLrPp/P2vlyukAsJYUvVgoaPDUBpedHbkMj07pDJqe4D7c0yEJ8hQo/6nS+3bh9Q1NvmVNsB1pbtk3RKONIiTAXYcjclmOljxxJnl1O50F5sOIi38vyl7Q63f6a3bXMvJEf1lnPNJKAxspIfEu8gRasny3FEsbHfrxEwVj rog@rog-x220\n"},"cloud-tag":"cloud-google","credential":"cloudcred-google_rogpeppe@external_google"}}
17:07:34 TRACE juju.rpc.jsoncodec codec.go:120 <- {"request-id":4,"response":{"name":"testing4","uuid":"a64d43a9-4d18-4a45-800b-7609891c8959","controller-uuid":"a030379a-940f-4760-8fcf-3062b41a04e7","provider-type":"gce","default-series":"xenial","cloud-tag":"cloud-google","cloud-region":"us-central1","cloud-credential-tag":"cloudcred-google_rogpeppe@external_google","owner-tag":"user-rogpeppe@external","life":"alive","status":{"status":"available","info":"","since":null},"users":[{"user":"rogpeppe@external","display-name":"rogpeppe","last-connection":null,"access":"admin"}],"machines":[],"sla":null,"agent-version":null}}
17:07:34 INFO cmd addmodel.go:281 Added 'testing4' model on google/us-central1 with credential 'google' for user 'rogpeppe'
17:07:34 TRACE juju.rpc.jsoncodec codec.go:123 <- error: read tcp 192.168.0.240:49758->162.213.33.28:443: use of closed network connection (closing true)
17:07:34 DEBUG juju.api monitor.go:35 RPC connection died
17:07:34 INFO cmd supercommand.go:465 command finished
So juju should not be changing the region underneath a user. If the user has specified a specific region that doesn't match the credential, juju should warn them.
Secondly, locking a credential to a specific region is currently intentional, though perhaps that's not a sane default. IMHO, this is largely a usability issue. It would seem a saner default might be to simply warn the user the credential and region doesn't match, and if it fails, the user should understand why given the warning. By default it seems most users wouldn't be using region locked credentials (and then explicitly asking for a different region!). Juju should just attempt to do what the user has requested.