fix: Scraping Grafana when ingressed

justfile

@@ -2,11 +2,16 @@ set quiet  # Recipes are silent by default
 set export  # Just variables are exported to the environment
 
 terraform := `which terraform || which tofu || echo ""` # require 'terraform' or 'opentofu'
+uv_flags := "--frozen --isolated"
 
 [private]
 default:
   just --list
 
+# Update uv.lock with the latest deps
+lock:
+  uv lock --upgrade --no-cache
+
 # Lint everything
 [group("Lint")]
 lint: lint-workflows lint-terraform lint-terraform-docs
@@ -53,4 +58,4 @@ validate-terraform:
 # Run integration tests
 [working-directory("./tests/integration")]
 integration *args='':
-  uv run pytest -vv --capture=no --exitfirst "${args}"
+  uv run ${uv_flags} pytest -vv --capture=no --exitfirst "${args}"

pyproject.toml

@@ -8,5 +8,4 @@ version = "0.0.0"
 dependencies = [
   "jubilant",
   "pytest",
-  "jinja2",
 ]

terraform/cos-lite/integrations.tf

@@ -411,3 +411,17 @@ resource "juju_integration" "external_grafana_ca_cert" {
     endpoint = module.grafana.endpoints.receive_ca_cert
   }
 }
+
+resource "juju_integration" "external_prom_ca_cert" {
+  count      = local.tls_termination ? 1 : 0
+  model_uuid = var.model_uuid
+
+  application {
+    offer_url = var.external_ca_cert_offer_url
+  }
+
+  application {
+    name     = module.prometheus.app_name
+    endpoint = module.prometheus.endpoints.receive_ca_cert
+  }
+}

terraform/cos/integrations.tf

@@ -438,6 +438,20 @@ resource "juju_integration" "external_grafana_ca_cert" {
   }
 }
 
+resource "juju_integration" "external_otelcol_ca_cert" {
+  count      = local.tls_termination ? 1 : 0
+  model_uuid = var.model_uuid
+
+  application {
+    offer_url = var.external_ca_cert_offer_url
+  }
+
+  application {
+    name     = module.opentelemetry_collector.app_name
+    endpoint = module.opentelemetry_collector.endpoints.receive_ca_cert
+  }
+}
+
 # -------------- # Telemetry correlations ---------------------
 
 resource "juju_integration" "traces_and_logs_correlation" {

tests/integration/cos_lite/tls_external/test_upgrade_cos_lite_tls_external.py

@@ -20,12 +20,14 @@
 
 
 def test_deploy_from_track(
-    tf_manager, ca_model: jubilant.Juju, cos_model: jubilant.Juju
+    tmp_path, tf_manager, ca_model: jubilant.Juju, cos_model: jubilant.Juju
 ):
     # GIVEN a module deployed from track n-1
     tf_manager.init(TRACK_2_TF_FILE)
     tf_manager.apply(ca_model=ca_model.model, cos_model=cos_model.model)
     wait_for_active_idle_without_error([ca_model, cos_model])
+    tls_ctx = get_tls_context(tmp_path, ca_model, "self-signed-certificates")
+    catalogue_apps_are_reachable(cos_model, tls_ctx)
 
 
 def test_deploy_to_track(

tests/integration/cos_lite/tls_full/test_upgrade_cos_lite_tls_full.py

@@ -20,12 +20,14 @@
 
 
 def test_deploy_from_track(
-    tf_manager, ca_model: jubilant.Juju, cos_model: jubilant.Juju
+    tmp_path, tf_manager, ca_model: jubilant.Juju, cos_model: jubilant.Juju
 ):
     # GIVEN a module deployed from track n-1
     tf_manager.init(TRACK_2_TF_FILE)
     tf_manager.apply(ca_model=ca_model.model, cos_model=cos_model.model)
     wait_for_active_idle_without_error([ca_model, cos_model])
+    tls_ctx = get_tls_context(tmp_path, ca_model, "self-signed-certificates")
+    catalogue_apps_are_reachable(cos_model, tls_ctx)
 
 
 def test_deploy_to_track(

tests/integration/cos_lite/tls_internal/test_upgrade_cos_lite_tls_internal.py

@@ -23,6 +23,7 @@ def test_deploy_from_track(tf_manager, cos_model: jubilant.Juju):
     tf_manager.init(TRACK_2_TF_FILE)
     tf_manager.apply(model=cos_model.model)
     wait_for_active_idle_without_error([cos_model])
+    catalogue_apps_are_reachable(cos_model)
 
 
 def test_deploy_to_track(tmp_path, tf_manager, cos_model: jubilant.Juju):

tests/integration/cos_lite/tls_none/test_upgrade_cos_lite_tls_none.py

@@ -23,6 +23,7 @@ def test_deploy_from_track(tf_manager, cos_model: jubilant.Juju):
     tf_manager.init(TRACK_2_TF_FILE)
     tf_manager.apply(model=cos_model.model)
     wait_for_active_idle_without_error([cos_model])
+    catalogue_apps_are_reachable(cos_model)
 
 
 def test_deploy_to_track(tmp_path, tf_manager, cos_model: jubilant.Juju):

tests/integration/helpers.py

@@ -11,17 +11,6 @@
 import jubilant
 
 
-def refresh_o11y_apps(juju: jubilant.Juju, channel: str, base: Optional[str] = None):
-    """Temporary workaround for the issue:
-
-    FIXME: https://github.com/juju/terraform-provider-juju/issues/967
-    """
-    for app in juju.status().apps:
-        if app in {"traefik", "ca"}:
-            continue
-        juju.refresh(app, channel=channel, base=base)
-
-
 class TfDirManager:
     def __init__(self, base_tmpdir):
         self.base: str = str(base_tmpdir)
@@ -53,21 +42,30 @@ def destroy(self, **kwargs):
         subprocess.run(shlex.split(cmd_str), check=True)
 
 
+def refresh_o11y_apps(juju: jubilant.Juju, channel: str, base: Optional[str] = None):
+    """Temporary workaround for the issue:
+
+    FIXME: https://github.com/juju/terraform-provider-juju/issues/967
+    """
+    for app in juju.status().apps:
+        if app in {"traefik", "ca"}:
+            continue
+        if "s3-integrator" in app:
+            continue
+        juju.refresh(app, channel=channel, base=base)
+
+
 def wait_for_active_idle_without_error(
-    jujus: List[jubilant.Juju], timeout: int = 60 * 30
+    jujus: List[jubilant.Juju], timeout: int = 60 * 45
 ):
     for juju in jujus:
         print(f"\nwaiting for the model ({juju.model}) to settle ...\n")
-        juju.wait(jubilant.all_active, delay=5, timeout=timeout)
-        print("\nwaiting for no errors ...\n")
-        juju.wait(
-            jubilant.all_active, delay=5, timeout=60 * 5, error=jubilant.any_error
-        )
+        juju.wait(jubilant.all_active, delay=10, timeout=timeout)
         print("\nwaiting for agents idle ...\n")
         juju.wait(
             jubilant.all_agents_idle,
-            delay=5,
-            timeout=60 * 10,
+            delay=10,
+            timeout=timeout,
             error=jubilant.any_error,
         )