[DPE-10184] fix mtls certificate for cross-model-relations by reneradoi · Pull Request #266 · canonical/data-platform-libs

reneradoi · 2026-05-27T07:48:39Z

This PR fixes an issue when providing the mTLS certificate in a cross-model relation.

Due to juju/juju#21248 (comment), granting a Juju secret from the requirer side of a cross-model relations fails with sharing consumer secrets across a cross model relation not supported. The proposed workaround from DA264 is to place the mtls-cert into regular relation data instead of a secret, if the relation is a cross-model relation.

The scope of this PR is to fix this issue for data-interfaces v0. The required fixes for v1 will be provided in a separate PR to https://github.com/canonical/data-platform-charmlibs (see canonical/data-platform-charmlibs#16).

Changes:

add dependency to cryptography for using Fernet
add list CROSS_MODEL_RELATION_CONSUMER_SECRETS (currently only includes mtls-cert
ignore keys defined in CROSS_MODEL_RELATION_CONSUMER_SECRETS for requirer-side secrets in cross-model relations
add handling for relation-created event in ProviderEventHandlers class: in cross-model relations, generate the encryption key, store it in a secret, grant the secret to the requirer and add the secret id to relation data
add logic for cross-model relations in _update_relation_data_without_secrets: read the encryption key from the secret encryption-secret and encrypt keys defined in CROSS_MODEL_RELATION_CONSUMER_SECRETS; in case of failures, values will be left blank
add logic for cross-model relations in _fetch_relation_data_without_secrets: read the encryption key from the secret encryption-secret and decrypt keys defined in CROSS_MODEL_RELATION_CONSUMER_SECRETS
adjust the relation-changed events in EtcdRequirerEventHandlers and KafkaRequirerEventHandlers classes: resend a previous request if the encryption secret was added to relation data from provider side, to ensure data is sent correctly

Testing:
Functionality was tested manually and with integration test coverage on charmed-etcd (see this draft PR, example CI run here). Integration test coverage for this repo can be added after changes where merged in this etcd PR (because a provider charm with mtls support is needed)

add cryptography to deps for all test charms
fix the broken s3-app test charm
remove check_logs where possible (only if action results are ensured otherwise) to avoid test flakyness

…`mtls-cert` from requirer secrets in cross-model-relations

…s-model relations

… updating a request in case the `encryption-secret` was added

…r updating a request in case the `encryption-secret` was added

… in cross-model relations

… data when fetching

…is highly error-prone

Gu1nness · 2026-06-09T08:09:03Z

+        try:
+            remote_model = relation.remote_model.uuid
+        except (FileNotFoundError, ModelError, RuntimeError):
+            # access to remote model added in Juju 3.6.2, fails with 2.9


What is the error raised in case of Juju 2.9 ?
Maybe we could have a log line for that specific case?

I've added a log line.

According to ops, this raises a ModelError. But I've also seen instances of FileNotFoundError and RuntimeError in integration test runs, that's why I added those.

Gu1nness · 2026-06-09T08:11:24Z

+
+        # in cross-model relations, generate an encryption key and share it with the requirer as a secret
+        event_data = {}
+        secret_label = f"{self.model.uuid}-{event.relation.id}-encryption-secret"


What is the need for the model uuid in the secret label ?

Mostly consistency with another instance of creating a "helper" secret here.

Gu1nness · 2026-06-09T08:16:22Z

-series:
-  - focal


Isn't this for juju 2.9 purposes?

Well, interesting one: I think this is a mistake (or leftover from the past). Even when deployed on jammy juju container, the container image was always focal, which resulted in issues when using the default Python of the container. It took quite some time to figure out why integration tests started to fail since the last commit and this repo and my PR.

Building for different bases is defined here, which stays untouched.

Gu1nness · 2026-06-09T08:17:34Z

What's the reason of all this cleanup ?
Where those tests testing nothing?

Yes, these assertions where useless. The actual check happens afterwards, in the assertion of the relation data to be present (or not). Asserting log messages is error prone and should be avoided in general, I believe. Especially if there are random wait times (3s) for a message to be present. In these cases, it caused test flakeyness and CI instability, and as it doesn't bring value, I decided to remove.

imanenami

Thanks for the effort, looks good to me 👍

dragomirp · 2026-06-14T13:14:46Z

+LIBPATCH = 59

-PYDEPS = ["ops>=2.0.0"]
+PYDEPS = ["ops>=2.0.0", "cryptography"]


I would prefer if cryptography is inline import with a runtime error instead of a hard dependency. It's a pretty big library a lot of products don't necessarily need and latest versions already dropped support for Python versions on some of our supported platforms (focal with 3.8).

reneradoi added 15 commits May 27, 2026 09:42

add property for cross-model-relation to RequirerData class, exclude …

e00bbd3

…`mtls-cert` from requirer secrets in cross-model-relations

encrypt sensitive information before storing to relation data in cros…

4b27666

…s-model relations

adjust relation-changed handling in EtcdRequirerEventHandlers for…

6d55224

… updating a request in case the `encryption-secret` was added

adjust relation-changed handling in KafkaRequirerEventHandlers fo…

6136481

…r updating a request in case the `encryption-secret` was added

add cryptography dependency to test charms

ea87e6f

add cryptography binary to test charms build recipe

0ca0d4a

generate encryption key and create secret on relation-created event…

b662e78

… in cross-model relations

use cryptography 47.0.0

293cb0f

error handling for remote model in Juju versions < '3.6.2'

7630d67

also handle RuntimeError for remote_model_get

b490a27

add some build deps

94f0d12

remote_model might also raise FileNotFoundError

b540ba9

fix build deps in case of conflicts with cryptography version

c595ffc

in cross-model relations, decrypt sensitive information from relation…

12a6e2e

… data when fetching

fix builds and build deps

dfadf62

reneradoi force-pushed the mtls-cross-model-relations branch from 291b50e to dfadf62 Compare June 5, 2026 07:39

reneradoi added 5 commits June 5, 2026 11:04

improve error handling, fix s3-app

7197840

integration test: increase stability by avoiding to check logs which …

6062c39

…is highly error-prone

integration test: increase stability by avoiding to check logs which …

164b89f

…is highly error-prone

add cryptography to PYDEPS field in the lib

370a1db

bugfix

3f4aa1a

reneradoi mentioned this pull request Jun 8, 2026

[DPE-10184] Fix mTLS in cross model relations canonical/charmed-etcd-operator#236

Draft

3 tasks

reneradoi marked this pull request as ready for review June 8, 2026 14:51

reneradoi requested review from Gu1nness, Mehdi-Bendriss, dragomirp, imanenami and sinclert-canonical June 8, 2026 14:52

Gu1nness reviewed Jun 9, 2026

View reviewed changes

address review comments

ae38e42

imanenami approved these changes Jun 10, 2026

View reviewed changes

Comment thread lib/charms/data_platform_libs/v0/data_interfaces.py Outdated

Comment thread lib/charms/data_platform_libs/v0/data_interfaces.py Outdated

minor code improvements (PR feedback)

0cda55a

reneradoi requested a review from Gu1nness June 10, 2026 15:20

dragomirp reviewed Jun 14, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[DPE-10184] fix mtls certificate for cross-model-relations#266

[DPE-10184] fix mtls certificate for cross-model-relations#266
reneradoi wants to merge 22 commits into
mainfrom
mtls-cross-model-relations

reneradoi commented May 27, 2026 •

edited

Loading

Uh oh!

Uh oh!

Gu1nness Jun 9, 2026

Uh oh!

reneradoi Jun 9, 2026

Uh oh!

Gu1nness Jun 9, 2026

Uh oh!

reneradoi Jun 9, 2026

Uh oh!

Uh oh!

Gu1nness Jun 9, 2026

Uh oh!

reneradoi Jun 9, 2026

Uh oh!

Gu1nness Jun 9, 2026

Uh oh!

reneradoi Jun 9, 2026

Uh oh!

imanenami left a comment

Uh oh!

Uh oh!

Uh oh!

dragomirp Jun 14, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		series:
		- focal

Conversation

reneradoi commented May 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

imanenami left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

dragomirp Jun 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

reneradoi commented May 27, 2026 •

edited

Loading

dragomirp Jun 14, 2026 •

edited

Loading