Comment 1 for bug 1765722

Here is a reproducer:

 ~ $ juju bootstrap --bootstrap-series xenial --agent-version 2.3.5 lxd lxd
Creating Juju controller "lxd" on lxd/localhost
Looking for packaged Juju agent version 2.3.5 for amd64
To configure your system to better support LXD containers, please see: https://github.com/lxc/lxd/blob/master/doc/production-setup.md
Launching controller instance(s) on localhost/localhost...
 - juju-00402b-0 (arch=amd64)
Installing Juju agent on bootstrap instance
Fetching Juju GUI 2.12.1
Waiting for address
Attempting to connect to 10.0.4.173:22
Connected to 10.0.4.173
Running machine configuration script...
Bootstrap agent now started
Contacting Juju controller at 10.0.4.173 to verify accessibility...
Bootstrap complete, "lxd" controller now available
Controller machines are in the "controller" model
Initial model "default" added
 ~ $ juju deploy cs:percona-cluster
Located charm "cs:percona-cluster-261".
Deploying charm "cs:percona-cluster-261".
 ~ $ juju run --unit percona-cluster/0 leader-get
leader-ip: 10.0.4.37
mysql.passwd: g6yHsw3fJysLKfwkVpxxY2CBKS7mWFsSsLdKGzb5
root-password: g6yHsw3fJysLKfwkVpxxY2CBKS7mWFsSsLdKGzb5
sst-password: JwMGKp7ysm9963xGWMt9zrHt2psNKzBX2ykc3CZcg
 ~ $ juju model-config -m controller logging-config="<root>=DEBUG;unit=DEBUG"
 ~ $ juju model-config logging-config="<root>=DEBUG;unit=DEBUG"
 ~ $ juju upgrade-juju -m controller --agent-version 2.3.6
best version:
    2.3.6
started upgrade to 2.3.6
 ~ $ juju upgrade-juju --agent-version 2.3.6
ERROR upgrade in progress (upgrade in progress)
 ~ $ juju status -m controller
Model Controller Cloud/Region Version Notes SLA
controller lxd localhost/localhost 2.3.6 upgrade in progress since "2018-04-20T14:08:20Z" unsupported

App Version Status Scale Charm Store Rev OS Notes

Unit Workload Agent Machine Public address Ports Message

Machine State DNS Inst id Series AZ Message
0 error 10.0.4.173 juju-00402b-0 xenial Running

Error in machine-0.log

2018-04-20 14:08:21 ERROR juju.upgrade upgrade.go:140 upgrade step "ensure container-image-stream config defaults to released" failed: The dotted field 'mysql.passwd' in 'settings.mysql.passwd' is not valid for storage.
2018-04-20 14:08:21 ERROR juju.worker.upgradesteps worker.go:379 upgrade from 2.3.5 to 2.3.6 for "machine-0" failed (will retry): ensure container-image-stream config defaults to released: The dotted field 'mysql.passwd' in 'settings.mysql.passwd' is not valid for storage.

Full machine-0.log -> http://paste.ubuntu.com/p/GzGfyMtsv6/

At the moment any juju controller that hosts a model with percona-cluster (the default for OpenStack installations) will get into this broken state when upgrading to 2.3.6