Skip to content

fix(sunbeam-python): Use Deployment Client to Determine LoadbalancerFeature Requirements - #924

Merged
hemanthnakkina merged 1 commit into
canonical:stable/2025.1from
bryanfraschetti:2025.1/lp_2167289
Sep 18, 2026
Merged

hemanthnakkina merged 1 commit into
canonical:stable/2025.1from
bryanfraschetti:2025.1/lp_2167289

Conversation

@bryanfraschetti

Copy link
Copy Markdown

The Loadbalancer feature was made generally available, which means on its enablement, the requires property attempts to communicate with the local clusterd UNIX socket to obtain the configuration. This socket is owned by the root user and snap_daemon group but the sunbeam CLI is invoked from the ubuntu user. Therefore, the read fails with Errno 13 Permission denied and the feature gating falls back to requiring secrets, which unintentionally pulls in vault as a dependency even when using the OVN loadbalancer rather than amphorae.

The proposed change is to use the deployment client rather than the UNIX socket to correctly determine the configuration and requirements.

Assisted-By: GPT-5.6 Sol

Closes-bug: #2167289
Jira card: OPEN-4763

QA steps

  1. Deploy a multi-node OpenStack Sunbeam environment using MAAS with revision 1101 of the openstack snap
  2. Run: openstack.sunbeam enable loadbalancer or sunbeam enable loadbalancer
  3. Observe that the process attempts to install Vault rather than Octavia.
OpenStack vault application enabled.
Error: Cannot enable secrets as Vault is not active.
  1. Remove both the vault application that was accidentally deployed and the loadbalancer
openstack.sunbeam disable vault
openstack.sunbeam disable loadbalancer
  1. Repeat with the patched sunbeam and observe that Vault is not pulled in

…eature Requirements

The Loadbalancer feature was made generally available, which means on enablement
the requires property attempts to communicate with the local clusterd UNIX
socket. This socket is owned by the root user and snap_daemon group but the
sunbeam CLI is invoked from the ubuntu user. Therefore, the read fails with
Errno 13 Permission denied and the feature gating falls back to requiring
secrets, which unintentionally pulls in vault as a dependency even when using
the OVN loadbalancer rather than amphorae.

The proposed change is to use the deployment client rather than the UNIX socket
to correctly determine the configuration and requirements.

LP: #2167289

Signed-off-by: Bryan Fraschetti <bryan.fraschetti@canonical.com>
(cherry picked from commit 689b225)
@hemanthnakkina
hemanthnakkina merged commit 715f321 into canonical:stable/2025.1 Sep 18, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants