From 06c260ac217f4d5e1d6b7439417a5b866d0ccbf9 Mon Sep 17 00:00:00 2001 From: Dragomir Penev Date: Mon, 20 Jul 2026 16:53:56 +0300 Subject: [PATCH 1/4] Pin ops --- requirements/v1/requirements.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/requirements/v1/requirements.txt b/requirements/v1/requirements.txt index d9baa983..e7124ae8 100644 --- a/requirements/v1/requirements.txt +++ b/requirements/v1/requirements.txt @@ -1,3 +1,3 @@ -ops >= 2.1.1 +ops >= 2.1.1,<3.8.0 pydantic>=2.11,<3 -poetry-core \ No newline at end of file +poetry-core From 1b656ccb934e1fd8ba9a90cc769abc0ed5d90f2a Mon Sep 17 00:00:00 2001 From: Dragomir Penev Date: Mon, 20 Jul 2026 20:15:14 +0300 Subject: [PATCH 2/4] SCP as root --- tests/jubilant_helpers.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/jubilant_helpers.py b/tests/jubilant_helpers.py index baca3ce5..bcf83998 100644 --- a/tests/jubilant_helpers.py +++ b/tests/jubilant_helpers.py @@ -74,7 +74,7 @@ def download_client_certificate_from_unit(juju: Juju, app_name: str = ETCD_APP_N tls_path = TLS_ROOT_DIR for file in ["client.pem", "client.key", "client_ca.pem"]: - juju.scp(f"{unit}:{tls_path}/{file}", file) + juju.scp(f"root@{unit}:{tls_path}/{file}", file) def get_secret_by_label_jubilant(juju: Juju, label: str) -> Dict[str, str]: From 4935901113d571497911a5ed2e07ffb5cd27f7cd Mon Sep 17 00:00:00 2001 From: Dragomir Penev Date: Mon, 20 Jul 2026 23:07:00 +0300 Subject: [PATCH 3/4] Disable tls --- tests/v0/integration/test_etcd_charm.py | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/tests/v0/integration/test_etcd_charm.py b/tests/v0/integration/test_etcd_charm.py index b1a2df14..8d94e7bb 100644 --- a/tests/v0/integration/test_etcd_charm.py +++ b/tests/v0/integration/test_etcd_charm.py @@ -17,7 +17,7 @@ from tests.jubilant_helpers import ( TLSType, apps_active_and_agents_idle, - download_client_certificate_from_unit, + # download_client_certificate_from_unit, get_certificate_from_unit, get_cluster_endpoints, get_role, @@ -120,8 +120,8 @@ def test_relate_client_charm(juju_lxd_model: Juju): ) ) - endpoints = get_cluster_endpoints(juju_lxd_model, ETCD_APP_NAME, tls_enabled=True) - download_client_certificate_from_unit(juju_lxd_model, ETCD_APP_NAME) + endpoints = get_cluster_endpoints(juju_lxd_model, ETCD_APP_NAME) + # download_client_certificate_from_unit(juju_lxd_model, ETCD_APP_NAME) secret = get_secret_by_label_jubilant( juju_lxd_model, label=f"{PEER_RELATION}.{ETCD_APP_NAME}.app" ) @@ -131,9 +131,7 @@ def test_relate_client_charm(juju_lxd_model: Juju): # check if user and role are created for the common name and that the role is assigned to the user common_name = get_requirer_common_name(juju_lxd_model) logger.info(f"Requirer has common names: {common_name}") - user_roles = get_user( - endpoints, common_name, user=INTERNAL_USER, password=password, tls_enabled=True - ) + user_roles = get_user(endpoints, common_name, user=INTERNAL_USER, password=password) assert user_roles, f"failed to get user roles for {common_name}" assert common_name in user_roles, f"failed to get user roles for {common_name}" From 902a43109b496706f363ad3c45813a134d37aed3 Mon Sep 17 00:00:00 2001 From: Dragomir Penev Date: Tue, 21 Jul 2026 01:13:24 +0300 Subject: [PATCH 4/4] Get secret client --- tests/jubilant_helpers.py | 14 ++++++++++++-- tests/v0/integration/test_etcd_charm.py | 10 ++++++---- 2 files changed, 18 insertions(+), 6 deletions(-) diff --git a/tests/jubilant_helpers.py b/tests/jubilant_helpers.py index bcf83998..d2fa47da 100644 --- a/tests/jubilant_helpers.py +++ b/tests/jubilant_helpers.py @@ -17,6 +17,9 @@ TLS_ROOT_DIR = "/var/snap/charmed-etcd/current/tls" CLIENT_PORT = 2379 +TLSLIBID = "afd8c2bccf834997afce12c2706d2ede" +CLIENT_TLS_RELATION_NAME = "client-certificates" + logger = logging.getLogger(__name__) @@ -73,8 +76,15 @@ def download_client_certificate_from_unit(juju: Juju, app_name: str = ETCD_APP_N tls_path = TLS_ROOT_DIR - for file in ["client.pem", "client.key", "client_ca.pem"]: - juju.scp(f"root@{unit}:{tls_path}/{file}", file) + for file in ["client.pem", "client_ca.pem"]: + juju.scp(f"{unit}:{tls_path}/{file}", file) + + private_key = get_secret_by_label_jubilant( + juju, label=f"{TLSLIBID}-private-key-{unit.split('/')[1]}-{CLIENT_TLS_RELATION_NAME}" + )["private-key"] + + with open("client.key", "w") as f: + f.write(private_key) def get_secret_by_label_jubilant(juju: Juju, label: str) -> Dict[str, str]: diff --git a/tests/v0/integration/test_etcd_charm.py b/tests/v0/integration/test_etcd_charm.py index 8d94e7bb..b1a2df14 100644 --- a/tests/v0/integration/test_etcd_charm.py +++ b/tests/v0/integration/test_etcd_charm.py @@ -17,7 +17,7 @@ from tests.jubilant_helpers import ( TLSType, apps_active_and_agents_idle, - # download_client_certificate_from_unit, + download_client_certificate_from_unit, get_certificate_from_unit, get_cluster_endpoints, get_role, @@ -120,8 +120,8 @@ def test_relate_client_charm(juju_lxd_model: Juju): ) ) - endpoints = get_cluster_endpoints(juju_lxd_model, ETCD_APP_NAME) - # download_client_certificate_from_unit(juju_lxd_model, ETCD_APP_NAME) + endpoints = get_cluster_endpoints(juju_lxd_model, ETCD_APP_NAME, tls_enabled=True) + download_client_certificate_from_unit(juju_lxd_model, ETCD_APP_NAME) secret = get_secret_by_label_jubilant( juju_lxd_model, label=f"{PEER_RELATION}.{ETCD_APP_NAME}.app" ) @@ -131,7 +131,9 @@ def test_relate_client_charm(juju_lxd_model: Juju): # check if user and role are created for the common name and that the role is assigned to the user common_name = get_requirer_common_name(juju_lxd_model) logger.info(f"Requirer has common names: {common_name}") - user_roles = get_user(endpoints, common_name, user=INTERNAL_USER, password=password) + user_roles = get_user( + endpoints, common_name, user=INTERNAL_USER, password=password, tls_enabled=True + ) assert user_roles, f"failed to get user roles for {common_name}" assert common_name in user_roles, f"failed to get user roles for {common_name}"