Skip to content

fix: scope LDAP domain terraform applies to LDAP resources #880

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
MylesJP merged 1 commit into from
Jul 10, 2026
Merged

fix: scope LDAP domain terraform applies to LDAP resources #880

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 13 additions & 3 deletions sunbeam-python/sunbeam/features/ldap/feature.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,16 @@
APPLICATION_DEPLOY_TIMEOUT = 900 # 15 minutes
APPLICATION_REMOVE_TIMEOUT = 300 # 5 minutes

# The LDAP steps reapply the whole OpenStack plan, which reverts any
# out-of-band charm config (e.g. Traefik TLS set with juju config) as
# drift. Restrict the apply to the LDAP domain resources only.
# See LP#2159042.
LDAP_APPLY_TARGETS = [
"-target=juju_application.ldap-apps",
"-target=juju_integration.ldap-apps-to-logging",
"-target=juju_integration.ldap-to-keystone",
]


class DisableLDAPDomainStep(BaseStep, JujuStepHelper):
"""Generic step to enable OpenStack application using Terraform."""
Expand Down Expand Up @@ -95,7 +105,7 @@ def run(self, context: StepContext) -> Result:
update_config(self.client, config_key, tfvars)

try:
self.tfhelper.apply(reporter=context.reporter)
self.tfhelper.apply(LDAP_APPLY_TARGETS, reporter=context.reporter)
except TerraformException as e:
return Result(ResultType.FAILED, str(e))

Expand Down Expand Up @@ -163,7 +173,7 @@ def run(self, context: StepContext) -> Result:
update_config(self.client, config_key, tfvars)

try:
self.tfhelper.apply(reporter=context.reporter)
self.tfhelper.apply(LDAP_APPLY_TARGETS, reporter=context.reporter)
except TerraformException as e:
return Result(ResultType.FAILED, str(e))
charm_name = "keystone-ldap-{}".format(self.charm_config["domain-name"])
Expand Down Expand Up @@ -233,7 +243,7 @@ def run(self, context: StepContext) -> Result:
update_config(self.client, config_key, tfvars)

try:
self.tfhelper.apply(reporter=context.reporter)
self.tfhelper.apply(LDAP_APPLY_TARGETS, reporter=context.reporter)
except TerraformException as e:
return Result(ResultType.FAILED, str(e))
charm_name = "keystone-ldap-{}".format(self.charm_config["domain-name"])
Expand Down
33 changes: 25 additions & 8 deletions sunbeam-python/tests/unit/sunbeam/features/test_ldap.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@
from sunbeam.core.terraform import TerraformException
from sunbeam.features.interface.v1.openstack import TerraformPlanLocation
from sunbeam.features.ldap.feature import (
LDAP_APPLY_TARGETS,
AddLDAPDomainStep,
DisableLDAPDomainStep,
LDAPFeature,
Expand Down Expand Up @@ -71,7 +72,9 @@ def test_enable_first_domain(self, read_config, update_config, snap, step_contex
"ldap-apps": {"dom1": {"domain-name": "dom1"}},
}
)
step.tfhelper.apply.assert_called_once_with(reporter=step_context.reporter)
step.tfhelper.apply.assert_called_once_with(
LDAP_APPLY_TARGETS, reporter=step_context.reporter
)
assert result.result_type == ResultType.COMPLETED

def test_enable_second_domain(self, read_config, update_config, snap, step_context):
Expand All @@ -90,7 +93,9 @@ def test_enable_second_domain(self, read_config, update_config, snap, step_conte
},
}
)
step.tfhelper.apply.assert_called_once_with(reporter=step_context.reporter)
step.tfhelper.apply.assert_called_once_with(
LDAP_APPLY_TARGETS, reporter=step_context.reporter
)
assert result.result_type == ResultType.COMPLETED

def test_enable_tf_apply_failed(
Expand Down Expand Up @@ -120,7 +125,9 @@ def test_enable_waiting_timed_out(
"ldap-apps": {"dom1": {"domain-name": "dom1"}},
}
)
step.tfhelper.apply.assert_called_once_with(reporter=step_context.reporter)
step.tfhelper.apply.assert_called_once_with(
LDAP_APPLY_TARGETS, reporter=step_context.reporter
)
assert result.result_type == ResultType.FAILED
assert result.message == "timed out"

Expand Down Expand Up @@ -150,7 +157,9 @@ def test_disable(self, read_config, update_config, snap, step_context):
step.tfhelper.write_tfvars.assert_called_with(
{"ldap-channel": "2023.2/edge", "ldap-apps": {}}
)
step.tfhelper.apply.assert_called_once_with(reporter=step_context.reporter)
step.tfhelper.apply.assert_called_once_with(
LDAP_APPLY_TARGETS, reporter=step_context.reporter
)

def test_disable_tf_apply_failed(
self, read_config, update_config, snap, step_context
Expand All @@ -165,7 +174,9 @@ def test_disable_tf_apply_failed(
step.tfhelper.write_tfvars.assert_called_with(
{"ldap-channel": "2023.2/edge", "ldap-apps": {}}
)
step.tfhelper.apply.assert_called_once_with(reporter=step_context.reporter)
step.tfhelper.apply.assert_called_once_with(
LDAP_APPLY_TARGETS, reporter=step_context.reporter
)
assert result.result_type == ResultType.FAILED
assert result.message == "apply failed..."

Expand Down Expand Up @@ -214,7 +225,9 @@ def test_update_domain(self, read_config, update_config, snap, step_context):
"ldap-apps": {"dom1": {"domain-name": "dom1"}},
}
)
step.tfhelper.apply.assert_called_once_with(reporter=step_context.reporter)
step.tfhelper.apply.assert_called_once_with(
LDAP_APPLY_TARGETS, reporter=step_context.reporter
)
assert result.result_type == ResultType.COMPLETED

def test_update_wrong_domain(self, read_config, update_config, snap, step_context):
Expand All @@ -239,7 +252,9 @@ def test_tf_apply_failed(self, read_config, update_config, snap, step_context):
)
step.tfhelper.apply.side_effect = TerraformException("apply failed...")
result = step.run(step_context)
step.tfhelper.apply.assert_called_once_with(reporter=step_context.reporter)
step.tfhelper.apply.assert_called_once_with(
LDAP_APPLY_TARGETS, reporter=step_context.reporter
)
assert result.result_type == ResultType.FAILED
assert result.message == "apply failed..."

Expand All @@ -256,6 +271,8 @@ def test_update_waiting_timed_out(
self.jhelper.wait_until_active.side_effect = TimeoutError("timed out")
step.tfhelper.apply.side_effect = TerraformException("apply failed...")
result = step.run(step_context)
step.tfhelper.apply.assert_called_once_with(reporter=step_context.reporter)
step.tfhelper.apply.assert_called_once_with(
LDAP_APPLY_TARGETS, reporter=step_context.reporter
)
assert result.result_type == ResultType.FAILED
assert result.message == "apply failed..."
Loading