TL;DR; seems there's a bug checking offer access for users who at not controller superusers but are model admins so for now explicit consume access needs to be granted for those users.
--
There's 2 postgresql offers in different models so it's not 100% clear to me which model is the stg-netbox one hosting the offer "admin/stg-netbox.postgresql", but based on the comment that explicit consume access was granted...
The permissions for one of the postgresql offers shows
This should have been enough to allow access to the offer without needing to grant consume access explicitly. But it seems there's a bug here because looking at the code, I think the check for model admin access during macaroon discharge is done on the controller model, not the model hosting the offer. That might explain why explicit consume access is required even for model admin users.
In terms of the show-offer output, the list of users and their permissions is influenced by the logged in user who is running show-offer. The code looks at explicit offer grants and also includes "admin" access if the logged in user is a model admin. Thus
TL;DR; seems there's a bug checking offer access for users who at not controller superusers but are model admins so for now explicit consume access needs to be granted for those users.
--
There's 2 postgresql offers in different models so it's not 100% clear to me which model is the stg-netbox one hosting the offer "admin/ stg-netbox. postgresql" , but based on the comment that explicit consume access was granted...
The permissions for one of the postgresql offers shows
{ f21c-49a7- 8b68-6cd45c68ba 6d#us#admin" ,
"object- global- key" : "ao#f207d2fb- f21c-49a7- 8b68-6cd45c68ba 6d",
"subject- global- key" : "us#admin", f21c-49a7- 8b68-6cd45c68ba 6d#us#everyone@ external" ,
"object- global- key" : "ao#f207d2fb- f21c-49a7- 8b68-6cd45c68ba 6d",
"subject- global- key" : "us#everyone@ external" , f21c-49a7- 8b68-6cd45c68ba 6d#us#stg- netbox" ,
"object- global- key" : "ao#f207d2fb- f21c-49a7- 8b68-6cd45c68ba 6d",
"subject- global- key" : "us#stg-netbox",
"_id" : "ao#f207d2fb-
"access" : "admin",
"txn-revno" : 2
}
{
"_id" : "ao#f207d2fb-
"access" : "read",
"txn-revno" : 2
}
{
"_id" : "ao#f207d2fb-
"access" : "consume",
"txn-revno" : 2
}
Hence the explicit consume permission granted to user "stg-netbox" would allow access.
The model hosting the offer is abd1188b- 7883-4bfa- 8f57-b71722bd78 f7 and the stg-netbox user does have admin on that model
{ 7883-4bfa- 8f57-b71722bd78 f7#us#stg- netbox" ,
"object- global- key" : "e#abd1188b- 7883-4bfa- 8f57-b71722bd78 f7",
"subject- global- key" : "us#stg-netbox",
"_id" : "e#abd1188b-
"access" : "admin",
"txn-revno" : 2
}
This should have been enough to allow access to the offer without needing to grant consume access explicitly. But it seems there's a bug here because looking at the code, I think the check for model admin access during macaroon discharge is done on the controller model, not the model hosting the offer. That might explain why explicit consume access is required even for model admin users.
In terms of the show-offer output, the list of users and their permissions is influenced by the logged in user who is running show-offer. The code looks at explicit offer grants and also includes "admin" access if the logged in user is a model admin. Thus
stg-netbox@ is-bastion- ps6:~$ juju show-offer postgresql --format yaml
will show access of the stg-netbox logged in user based on them being a model admin
stg-netbox:
access: admin
juju-controller -34-staging- ps6@is- bastion- ps6:~$ juju show-offer admin/stg- netbox. postgresql --format yaml
will show
stg-netbox:
access: consume
since this is showing explicit access grants for users other than the logged in user.