Merge ~ack/maas:1988759-vmhost-deploy into maas:master

[Alberto Donato]

LP:1988759 don't restrict LXD credentials to the maas project on LXD deploy

This causes MAAS not to be able to read storage volumes and networks from LXD

[Adam Collard (adam-collard)]

review: Approve

[MAAS Lander (maas-lander)]

UNIT TESTS
-b 1988759-vmhost-deploy lp:~ack/maas/+git/maas into -b master lp:~maas-committers/maas

STATUS: SUCCESS
COMMIT: 9667f89bc33d9b4b0b91fee1cae8f05405ec0136

review: Approve

[Thomas Parrott (tomparrott)]

stgraber has advised that this will fail for anyone who manually adds the MAAS cert and won't allow it access to all projects (like LXD does for its CI).

diff --git a/src/metadataserver/api_twisted.py b/src/metadataserver/api_twisted.py
index bf84b70..070e0c1 100644
--- a/src/metadataserver/api_twisted.py
+++ b/src/metadataserver/api_twisted.py
@@ -185,13 +185,14 @@ POD_CREATION_ERROR = (
 
 
 def _create_vmhost_for_deployment(node):
+    node = node.as_node()  # ensure a Node instance is passed
     secret_manager = SecretManager()
     deploy_secrets = secret_manager.get_composite_secret(
         "deploy-metadata",
         obj=node,
         default={},
     )
-    secret_manager.delete_secret("deploy-metadata", obj=node.as_node())
+    secret_manager.delete_secret("deploy-metadata", obj=node)
 
     # ensure only specified VM host types are registered
     if not node.register_vmhost:
diff --git a/src/metadataserver/tests/test_vendor_data.py b/src/metadataserver/tests/test_vendor_data.py
index ba3519e..c682bcb 100644
--- a/src/metadataserver/tests/test_vendor_data.py
+++ b/src/metadataserver/tests/test_vendor_data.py
@@ -441,7 +441,7 @@ class TestGenerateKVMPodConfiguration(MAASServerTestCase):
                         "lxd init --auto --network-address=[::]",
                         "lxc project create maas",
                         "sh -c 'lxc project edit maas </root/maas-project.yaml'",
-                        "lxc config trust add /root/lxd.crt --restricted --projects maas",
+                        "lxc config trust add /root/lxd.crt",
                         "rm /root/lxd.crt /root/maas-project.yaml",
                     ],
                 ),
diff --git a/src/metadataserver/vendor_data.py b/src/metadataserver/vendor_data.py
index 8d992fa..f32b54c 100644
--- a/src/metadataserver/vendor_data.py
+++ b/src/metadataserver/vendor_data.py
@@ -229,7 +229,7 @@ def generate_kvm_pod_configuration(node):
             "lxd init --auto --network-address=[::]",
             f"lxc project create {maas_project}",
             f"sh -c 'lxc project edit {maas_project} <{project_conf_file}'",
-            f"lxc config trust add {cert_file} --restricted --projects {maas_project}",
+            f"lxc config trust add {cert_file}",
             f"rm {cert_file} {project_conf_file}",
         ]
 
@@ -293,12 +293,13 @@ def generate_kvm_pod_configuration(node):
         ]
 
     secret_manager = SecretManager()
+    node = node.as_node()
     if deploy_secrets:
         secret_manager.set_composite_secret(
             "deploy-metadata", deploy_secrets, obj=node
         )
     else:
-        secret_manager.delete_secret("deploy-metadata", obj=node.as_node())
+        secret_manager.delete_secret("deploy-metadata", obj=node)
 
     if arch == "ppc64el":
         rc_script = dedent(
diff --git a/src/provisioningserver/drivers/pod/lxd.py b/src/provisioningserver/drivers/pod/lxd.py
index 3244747..05b6575 100644
--- a/src/provisioningserver/drivers/pod/lxd.py
+++ b/src/provisioningserver/drivers/pod/lxd.py
@@ -875,7 +875,7 @@ class LXDPodDriver(PodDriver):
                 try:
                     client.authenticate(password)
                 except LXDAPIException as e:
-                    raise Error(f"Password authentication failed: {e}")
+                    raise Error(f"Password authentication failed: {e}") from e
             return client
 
         try:
@@ -898,10 +898,10 @@ class LXDPodDriver(PodDriver):
                 raise Error(
                     "Certificate is not trusted and no password was given"
                 )
-        except ClientConnectionFailed:
+        except ClientConnectionFailed as e:
             raise LXDPodError(
-                f"Pod {pod_id}: Failed to connect to the LXD REST API."
-            )
+                f"Pod {pod_id}: Failed to connect to the LXD REST API: {e}"
+            ) from e
         else:
             yield client
         finally: