Unable to retrieve secret value

[gruyaume]

Description

I am unable to retrieve the Juju secret content. I'm not certain whether this is a real bug or whether "I'm holding it wrong". In any case I haven't found how this can be done by looking at the documentation.

Whenever I try to retrieve the juju secret value, I receive "None" even though I know the secret exists and has some content (via the CLI).

Urgency

Blocker for our release

Python-libjuju version

3.2.2

Juju version

3.1.5

Reproduce / Test

Here's how I am using the lib:

from juju import jasyncio
from juju.model import Model


async def main():

    m = Model()
    await m.connect()

    secrets = await m.list_secrets(show_secrets=True)

    first_secret = secrets.results[0]
    print(first_secret.value)
    await m.disconnect()


if __name__ == '__main__':
    jasyncio.run(main())

And the results I'm getting:

None

On the other hand, I am able to get the secret via the Juju CLI

(venv) guillaume@thinkpad:~/code/vault-k8s-operator$ juju secrets
ID                    Owner      Rotation  Revision  Last updated
cjt5s4lp3des77vsgehg  vault-k8s  never            1  36 minutes ago 
(venv) guillaume@thinkpad:~/code/vault-k8s-operator$ juju show-secret cjt5s4lp3des77vsgehg --reveal
cjt5s4lp3des77vsgehg:
  revision: 1
  owner: vault-k8s
  created: 2023-09-07T23:34:42Z
  updated: 2023-09-07T23:34:42Z
  content:
    roottoken: hvs.p9v8yPn1iM0tE3w20vRyVmED
    unsealkeys: '["8adf4e322076da1de3a1b955f1a2edd0edd726ed171424b6c82cf769d9e709e0"]'

[github-actions]

This issue is marked as incomplete because it has been open 30 days with no activity. Please remove incomplete label or comment or this will be closed in 5 days.

[gruyaume]

@cderici This issue was automatically marked as incomplete. Is there any effort placed on implementing what is required here?

[cderici]

@cderici This issue was automatically marked as incomplete. Is there any effort placed on implementing what is required here?

Sorry for the late response, Guillaume, I do have an active ticket for this, I'll take a look very soon. Though keep in mind, the support for the secrets are pretty rudimentary at this point (on libjuju), only some basic stuff that Juan implemented to enable people to use it a little bit. We'll have a proper roadmap item to bring full support of secrets in the next cycle to both pylibjuju and the terraform provider.

[github-actions]

This issue is marked as incomplete because it has been open 30 days with no activity. Please remove incomplete label or comment or this will be closed in 5 days.

[github-actions]

This issue was closed because it has been stalled for 5 days with no activity.

[gboutry]

@cderici is there any news on this issue?

Unblocked myself by using the facade directly:

await f.ListSecrets(filter_={"uri": pk_id}, show_secrets=True)

[arturo-seijas]

@cderici we are also affected by this issue. Is there any way we can track progress?

[benhoyt]

We recommend using @gboutry's (fairly simple) workaround of using facade.ListSecrets directly. Apart from making python-libjuju work with Juju 4 (the "all-watcher removal" work that @dimaqq is doing), we're not going to be making many more updates to python-libjuju.

Instead, for new charm integration tests moving forward, we're focussing our efforts on https://github.com/canonical/jubilant -- which is far too alpha to use right now, but just letting you know the direction. Our intention with that is to have an alpha version to try by the end of Jan, and a v1 to use by the end of the 25.04 cycle.

[gboutry]

This is supposed to be fixed since 3.5.2.0: #1071

• fix(model): fix wrong instanciation of list-secrets facade #1065

[benhoyt]

Okay, I hadn't read carefully and presumed it would require a new feature. I'll reopen, and we can look into this after the Christmas break -- if it's a straight-forward bug in python-libjuju we'll try to fix it, if it requires new wiring or a new feature, we'll probably skip. Note that Charm Tech agreed to take over maintenance of python-libjuju from the Juju team as they didn't have time with the Juju Mongo-to-dqlite transition, but Charm Tech also has our own roadmap items. :-)

For reference: model.list_secrets actually just calls ListSecrets pretty directly, passing the filter and show_secrets value through, so maybe the workaround is actually to provide the URI filter rather than using the facade directly.

[benhoyt]

@james-garner-canonical Assigning to you to look at after the break. Let's determine the cause of this, and if it's a straight-forward bug fix we should go ahead and fix it.