Vault charm does not download with the correct code

[Erlon R. Cruz]

While trying to install and test a vault fix in the `1.7/edge` channel. I
realized that the code in the channel is not what ends up in the installed
deployment.

How to reproduce:

0. Install a bundle with explicit channel versions for vault[1]. Also added etdc
for comparison in the linked bundle:

```yaml
applications:
  vault:
    charm: vault
    channel: 1.7/edge
    revision: 54
    series: xenial
    resources:
      core: -1
      vault: -1
    num_units: 3
```

1. Download the corresponding code from charmhub:

```sh
juju download --channel 1.7/edge ch:vault
juju download --channel 1.24/stable ch:etcd
```

2. Unzip the charms and compare the downloaded charm with the installed charm:

The vault charm has a `repo-info` file pointing to the commit the charm was
built from. Also, the last commit in the `1.7/edge`, rev 54 has the string
TOP_LEVEL_CERT_KEY added in the last commit.

```sh
unzip vault_178c710.charm
cat version
# 2ff5f11
grep -rnI TOP_LEVEL_CERT_KEY * | wc -l
# 4

juju ssh vault/3 'cat /var/lib/juju/agents/unit-vault-3/charm/repo-info'
commit-sha-1: b09d5aa6d5bf9755f90d3eaf6accd8ecfe13968c
commit-short: b09d5aa
branch: HEAD
remote: https://opendev.org/openstack/charm-vault
info-generated: Thu Oct 21 16:54:33 UTC 2021
note: This file should exist only in a built or released charm artifact (not in the charm source code tree).

juju ssh vault/3 'sudo grep -rnI TOP_LEVEL_CERT_KEY /var/lib/juju/agents/unit-vault-3/charm/'
#
```

See also that the charm is installed in the mentioned version 1.7/stable, but
vault is in the 1.5 version:

```sh
juju status | grep vault | head -1
# vault 1.5.9 active 3 vault 1.7/edge 54 no Unit is ready (active: true, mlock: enabled)
```

I didnt a similar comparison with etcd, thinking that it could be something
related to the fact that both charms have a `channel` option. But the problem
only happens with vault.

I'm logging this bug here because I don't believe this is something in the
charm. But, I'm also logging this in the vault charm LP.

______________
[1] https://gist.github.com/sombrafam/aaa8b856258f093dcfa69da2b781d68b

[Alex Kavanagh (ajkavanagh)]

I'm not sure if this is related, but the 1.7/edge charm for vault doesn't support xenial, which is specified in the bundle. Juju info for series xenial only shows 1.5 and 1.6 supports:

$ juju info vault --series xenial
name: vault
charm-id: u3vtXfBTJwhYCwwvkzCs0YqdCfsOBMdO
summary: a tool for managing secrets
publisher: OpenStack Charmers
supports: xenial, bionic, focal, groovy, hirsute, impish
tags: security
subordinate: false
store-url: https://charmhub.io/vault
description: |
  Vault secures, stores, and tightly controls access to
  tokens, passwords, certificates, API keys, and other
  secrets in modern computing. Vault handles leasing, key
  revocation, key rolling, and auditing. Through a unified
  API, users can access an encrypted Key/Value store and
  network encryption-as-a-service, or generate AWS IAM/STS
  credentials, SQL/NoSQL databases, X.509 certificates,
  SSH credentials, and more.
relations:
  provides:
    certificates: tls-certificates
    nrpe-external-master: nrpe-external-master
    secrets: vault-kv
  requires:
    db: pgsql
    etcd: etcd
    ha: hacluster
    lb-provider: loadbalancer
    shared-db: mysql-shared
channels: |
  latest/stable: 54 2022-02-09 (54) 44MB
  latest/candidate: ↑
  latest/beta: ↑
  latest/edge: ↑
  1.7/stable: –
  1.7/candidate: –
  1.7/beta: –
  1.7/edge: –
  1.6/stable: –
  1.6/candidate: –
  1.6/beta: –
  1.6/edge: 54 2022-03-04 (54) 44MB
  1.5/stable: –
  1.5/candidate: –
  1.5/beta: –
  1.5/edge: 54 2022-03-04 (54) 44MB

I suspect that revision 54 got deployed? Really, the bundle should have failed as there is no 1.7/edge vault charm for xenial. 1.7 on vault only supports focal and jammy.

[Alex Kavanagh (ajkavanagh)]

Marking the vault-charm as invalid as I'm fairly certain it's not a vault charm issue; I suspect the bundle is invalid but that juju still went and found a charm for xenial?

[Erlon R. Cruz (sombrafam)]

Indeed, I suspect that the missing support is the problem here but from the juju info you posted:

```supports: xenial, bionic, focal, groovy, hirsute, impish```

The xenial and bionic are included, while jammy, not (hub shows support for focal/jammy).

So, this is something that need to be fixed, not sure where. Do you know, where that information is coming from?

[Felipe Reyes (freyes)]

On Wed, 2022-06-22 at 17:28 +0000, Erlon R. Cruz wrote:
> Indeed, I suspect that the missing support is the problem here but from
> the juju info you posted:
>
> ```supports: xenial, bionic, focal, groovy, hirsute, impish```
>
> The xenial and bionic are included, while jammy, not (hub shows support
> for focal/jammy).
>
> So, this is something that need to be fixed, not sure where. Do you
> know, where that information is coming from?
>

juju info will request what charms are available based on a set of constraints,
in this case "what vault charms support Xenial?", the charmhub replied with the
revision 54, then juju identified that the revision 54 also supports bionic,
focal, groovy, hirsute and impish, and that's what the output showed.

$ juju info vault --series xenial
name: vault
supports: xenial, bionic, focal, groovy, hirsute, impish
...
channels: |
  latest/stable: 54 2022-02-09 (54) 44MB
...

The output of juju info varies greatly based on the set of constraints passed,
this is because there is no single charm available to deploy like it used to be
in the charmstore.

[Alex Kavanagh (ajkavanagh)]

Just as an additional note, the 1.7 version of the charm has had xenial support deliberately left off from a support perspective. Only 1.6 and 1.5 support (and will support) xenial. New tracks of the vault charm, for example, won't support bionic once it leaves LTS support. This is so that the Python code in the charm doesn't need to support old, EOL, versions of Python along with all the difficulties of supporting the associated Python modules.

[Juan M. Tirado (tiradojm)]

Does this problem persists with juju 2.9.33?

[Heather Lanigan (hmlanigan)]

Does this problem still exist?

[Launchpad Janitor (janitor)]

[Expired for Canonical Juju because there has been no activity for 60 days.]