juju deploy does not apply network space binding correctly

[Pascal Hobus]

Versions
------------------------------------------------------------
Juju (snap): 2.8.10
Maas: 3.0beta3 and 2.9rc4 and 2.8.5

Tested with Charms/Bundles:
- hello-juju
- mysql
- chamred kubernetes

Attachment
------------------------------------------------------------
- MaaS config description as PDF

Description
------------------------------------------------------------
In a setup with MaaS and Juju it is not possible to control on which public-address an application is listening. Despite a charm is deployed with bind to a specific network space, the public-address is always on the subnet on which MaaS performs the PXE boot (space infrastructure).

The endpoints seem always to be accessible on all spaces (computing, infrastructure) despite I explicitely bind to only computing space. I would strongly expect that endpoints are only available on specified spaces - that's also what the documentation describes.

Sample juju deploy command for mysql:
juju deploy mysql --bind "computing"

Juju Summary
------------------------------------------------------------
dev@debughost:~$ juju spaces --format=yaml
spaces:
- id: "0"
  name: alpha
  subnets: {}
- id: "2"
  name: computing
  subnets:
    10.1.20.0/24:
      type: ipv4
      provider-id: "2"
      status: in-use
      zones: []
- id: "1"
  name: infrastructure
  subnets:
    10.1.1.0/24:
      type: ipv4
      provider-id: "1"
      status: in-use
      zones: []

dev@debughost:~$ juju status --format=yaml
model:
  name: test
  type: iaas
  controller: maas-controller
  cloud: mycloud
  region: default
  version: 2.8.10
  model-status:
    current: available
    since: 18 Apr 2021 10:23:11+02:00
  sla: unsupported
machines:
  "2":
    juju-status:
      current: started
      since: 18 Apr 2021 11:10:31+02:00
      version: 2.8.10
    hostname: wkfbk-prd-k8s-master-1
    dns-name: 10.1.1.46
    ip-addresses:
    - 10.1.1.46
    - 10.1.20.45
    instance-id: nqxxef
    display-name: wkfbk-prd-k8s-master-1
    machine-status:
      current: running
      message: Deployed
      since: 18 Apr 2021 11:09:41+02:00
    modification-status:
      current: idle
      since: 18 Apr 2021 11:03:57+02:00
    series: xenial
    network-interfaces:
      ens18:
        ip-addresses:
        - 10.1.1.46
        mac-address: c2:b3:3b:97:75:9a
        gateway: 10.1.1.254
        space: infrastructure
        is-up: true
      ens19:
        ip-addresses:
        - 10.1.20.45
        mac-address: 62:72:fd:a3:b2:19
        space: computing
        is-up: true
    hardware: arch=amd64 cores=2 mem=4096M tags=virtual availability-zone=default
applications:
  mysql:
    charm: cs:mysql-58
    series: xenial
    os: ubuntu
    charm-origin: jujucharms
    charm-name: mysql
    charm-rev: 58
    exposed: false
    application-status:
      current: active
      message: Ready
      since: 18 Apr 2021 11:12:56+02:00
    relations:
      cluster:
      - mysql
    units:
      mysql/2:
        workload-status:
          current: active
          message: Ready
          since: 18 Apr 2021 11:12:56+02:00
        juju-status:
          current: idle
          since: 18 Apr 2021 11:13:00+02:00
          version: 2.8.10
        leader: true
        machine: "2"
        open-ports:
        - 3306/tcp
        public-address: 10.1.1.46
    version: 5.7.33
    endpoint-bindings:
      "": computing
      ceph: computing
      cluster: computing
      data: computing
      db: computing
      db-admin: computing
      ha: computing
      local-monitors: computing
      master: computing
      monitors: computing
      munin: computing
      nrpe-external-master: computing
      shared-db: computing
      slave: computing
storage: {}
controller:
  timestamp: 11:23:31+02:00

[Pascal Hobus (pascalhobus)]

Any update on that one?

[John A Meinel (jameinel)]

"The endpoints seem always to be accessible on all spaces (computing, infrastructure) despite I explicitely bind to only computing space."

The charm explicitly configures its application for how it wants that application to Listen. Juju usually does give information to the charm for it to not listen on 0.0.0.0, but many charms have chosen to just do so.

This is likely a charm issue.