Merge ~mthaddon/charm-k8s-ingress/+git/charm-k8s-ingress:prompt-for-trust into charm-k8s-ingress:master

[Tom Haddon]

Handle a permissions error from the k8s api, and prompt the user to run juju trust

[🤖 prod-jenkaas-is (prod-jenkaas-is)]

A CI job is currently in progress. A follow up comment will be added when it completes.

[🤖 prod-jenkaas-is (prod-jenkaas-is)]

PASSED: Continuous integration, rev:fd1c492dac14743a05a6aae3fb4d4a22dcfa25c1
https://jenkins.canonical.com/is/job/lp-charm-k8s-ingress-ci/50/
Executed test runs:
    SUCCESS: https://jenkins.canonical.com/is/job/lp-charm-test/100/
    None: https://jenkins.canonical.com/is/job/lp-update-mp/170644/

Click here to trigger a rebuild:
https://jenkins.canonical.com/is/job/lp-charm-k8s-ingress-ci/50//rebuild

review: Approve (continuous-integration)

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

This merge proposal is being monitored by mergebot. Change the status to Approved to merge.

[John A Meinel (jameinel)]

I definitely appreciate the idea of going into Blocked with a nice message rather than just failing.
Small tweak to the message which has a typo.

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

Change successfully merged at revision 62135286c86ac0517c406210ce4c288262d4e9f6

diff --git a/src/charm.py b/src/charm.py
index 4716bba..8c3560e 100755
--- a/src/charm.py
+++ b/src/charm.py
@@ -14,7 +14,7 @@ from charms.nginx_ingress_integrator.v0.ingress import (
 )
 from ops.charm import CharmBase
 from ops.main import main
-from ops.model import ActiveStatus
+from ops.model import ActiveStatus, BlockedStatus
 
 
 logger = logging.getLogger(__name__)
@@ -371,11 +371,28 @@ class NginxIngressCharm(CharmBase):
         # We only want to do anything here if we're the leader to avoid
         # collision if we've scaled out this application.
         if self.unit.is_leader() and self._service_name:
-            self._define_service()
-            self._define_ingress()
-            # It's not recommended to do this via ActiveStatus, but we don't
-            # have another way of reporting status yet.
-            msg = "Ingress with service IP(s): {}".format(", ".join(self._report_service_ips()))
+            try:
+                self._define_service()
+                self._define_ingress()
+                # It's not recommended to do this via ActiveStatus, but we don't
+                # have another way of reporting status yet.
+                msg = "Ingress with service IP(s): {}".format(
+                    ", ".join(self._report_service_ips())
+                )
+            except kubernetes.client.exceptions.ApiException as e:
+                if e.status == 403:
+                    logger.error(
+                        "Insufficient permissions to create the k8s service, "
+                        "will request `juju trust` to be run"
+                    )
+                    self.unit.status = BlockedStatus(
+                        "Insufficuent permissions, try: `juju trust {} --scope=cluster`".format(
+                            self.app.name
+                        )
+                    )
+                    return
+                else:
+                    raise
         self.unit.status = ActiveStatus(msg)
 
 
diff --git a/tests/unit/test_charm.py b/tests/unit/test_charm.py
index 0e94711..ffd1aaa 100644
--- a/tests/unit/test_charm.py
+++ b/tests/unit/test_charm.py
@@ -60,6 +60,20 @@ class TestCharm(unittest.TestCase):
         # Confirm status is as expected.
         self.assertEqual(self.harness.charm.unit.status, ActiveStatus())
 
+        # Confirm if we get a 403 error from k8s API we block with an appropriate message.
+        _define_ingress.reset_mock()
+        _define_service.reset_mock()
+        _define_service.side_effect = kubernetes.client.exceptions.ApiException(status=403)
+        self.harness.set_leader(True)
+        self.harness.update_config()
+        self.assertEqual(
+            self.harness.charm.unit.status,
+            BlockedStatus(
+                "Insufficuent permissions, try: "
+                "`juju trust nginx-ingress-integrator --scope=cluster`"
+            ),
+        )
+
     def test_get_ingress_relation_data(self):
         """Test for getting our ingress relation data."""
         # Confirm we don't have any relation data yet in the relevant properties