Discussion:
Juju Charm Store and CI
Sandor Zeestraten
2018-02-27 21:44:46 UTC
Permalink
Hey Juju folks,

I feel like I'm hitting some rough spots while setting up a simple pipeline
which pushes a charm build to the edge channel using the charm store CLI.
The last Juju Show (#30) talked about macaroon support in libjuju and CI
which sounds great, but that seems to be aimed at those using libjuju
and/or JAAS controllers.

Here are some of the steps for a new project:
* Create a launchpad team for a namespace in the charm store
- Fair enough
* Create a launchpad CI user/bot and add it project so we can push to the
store without using personal credentials
- This feels like a hack and rather insecure. Why not use limited
deploy/API keys? https://github.com/juju/charmstore/issues/776
* Manually login to launchpad with the CI user in order to activate it in
the charm store
- This gotcha took me a few moments to figure out.
https://jujucharms.com/docs/stable/authors-charm-store#the-juju-charm-store
* Manually login to the charm store with the CI user with `charm login` to
create a token.
- Had to find this bug, https://github.com/juju/c
harmstore-client/issues/61, after I figured out that `charm login` did not
have a non-interactive way to authenticate
- This is still not document anywhere as far as I can tell.
https://github.com/juju/charmstore-client/issues/145
- According to the comments in #61 it needs to be updated periodically
- I've seen another approach using expect, https://lists.ubuntu.c
om/archives/juju/2017-November/009691.html, but that seems like a
workaround too
* Encrypt and deploy token to a specific directory in CI in order for
`charm login` to work
- Again, https://github.com/juju/charmstore-client/issues/61 and
https://github.com/juju/charmstore-client/issues/145
* Mess around with `charm push` and `charm release` in order to push charm
to the edge channel
- This involves dealing with revisions which feels rather unnecessary
- See https://github.com/juju/charmstore-client/issues/135 and
https://github.com/juju/charmstore-client/issues/146
* Celebrate with your favourite beverage

How are you all interacting with the charm store with your charm CI?
Am I missing some obvious steps which would simplify things?
Is anyone working on proper deploy/API keys for the charm store?

Cheers
--
Sandor Zeestraten
Tom Barber
2018-02-27 21:54:08 UTC
Permalink
I have a proper hack for a circleci build chain I wrote, but works
pretty well:

https://github.com/spiculedata/circleci-juju
Post by Sandor Zeestraten
Hey Juju folks,
I feel like I'm hitting some rough spots while setting up a simple
pipeline which pushes a charm build to the edge channel using the
charm store CLI.
The last Juju Show (#30) talked about macaroon support in libjuju and
CI which sounds great, but that seems to be aimed at those using
libjuju and/or JAAS controllers.
* Create a launchpad team for a namespace in the charm store
  - Fair enough
* Create a launchpad CI user/bot and add it project so we can push to
the store without using personal credentials
  - This feels like a hack and rather insecure. Why not use limited
deploy/API keys? https://github.com/juju/charmstore/issues/776
<https://github.com/juju/charmstore/issues/776>
* Manually login to launchpad with the CI user in order to activate it
in the charm store
    - This gotcha took me a few moments to figure out.
https://jujucharms.com/docs/stable/authors-charm-store#the-juju-charm-store
<https://jujucharms.com/docs/stable/authors-charm-store#the-juju-charm-store>
* Manually login to the charm store with the CI user with `charm
login` to create a token.
  - Had to find this
bug,https://github.com/juju/charmstore-client/issues/61
<https://github.com/juju/charmstore-client/issues/61>, after I figured
out that `charm login` did not have a non-interactive way to authenticate
  - This is still not document anywhere as far as I can tell.
https://github.com/juju/charmstore-client/issues/145
<https://github.com/juju/charmstore-client/issues/145>
  - According to the comments in #61 it needs to be updated periodically
  - I've seen another approach using expect,
https://lists.ubuntu.com/archives/juju/2017-November/009691.html
<https://lists.ubuntu.com/archives/juju/2017-November/009691.html>,
but that seems like a workaround too
* Encrypt and deploy token to a specific directory in CI in order for
`charm login` to work
  - Again, https://github.com/juju/charmstore-client/issues/61
<https://github.com/juju/charmstore-client/issues/61> and
https://github.com/juju/charmstore-client/issues/145
<https://github.com/juju/charmstore-client/issues/145>
* Mess around with `charm push` and `charm release` in order to push
charm to the edge channel
  - This involves dealing with revisions which feels rather unnecessary
  - Seehttps://github.com/juju/charmstore-client/issues/135
<https://github.com/juju/charmstore-client/issues/135>and
https://github.com/juju/charmstore-client/issues/146
<https://github.com/juju/charmstore-client/issues/146>
* Celebrate with your favourite beverage
How are you all interacting with the charm store with your charm CI?
Am I missing some obvious steps which would simplify things?
Is anyone working on proper deploy/API keys for the charm store?
Cheers
--
Sandor Zeestraten
--
Spicule Limited is registered in England & Wales. Company Number: 09954122.
Registered office: First Floor, Telecom House, 125-135 Preston Road,
Brighton, England, BN1 6AF. VAT No. 251478891.


All engagements are subject to Spicule Terms and Conditions of Business.
This email and its contents are intended solely for the individual to whom
it is addressed and may contain information that is confidential,
privileged or otherwise protected from disclosure, distributing or copying.
Any views or opinions presented in this email are solely those of the
author and do not necessarily represent those of Spicule Limited. The
company accepts no liability for any damage caused by any virus transmitted
by this email. If you have received this message in error, please notify us
immediately by reply email before deleting it from your system. Service of
legal notice cannot be effected on Spicule Limited by email.
Sandor Zeestraten
2018-02-27 22:10:24 UTC
Permalink
Hey Tom.

Yes, I saw your hack in
https://lists.ubuntu.com/archives/juju/2017-November/009691.html which was
handy, however I was hoping for something less hacky from the charm store
folks.

--
Sandor Zeestraten

On Feb 27, 2018 22:54, "Tom Barber" <***@spicule.co.uk> wrote:

I have a proper hack for a circleci build chain I wrote, but works pretty
well:

https://github.com/spiculedata/circleci-juju


On 27/02/18 21:44, Sandor Zeestraten wrote:

Hey Juju folks,

I feel like I'm hitting some rough spots while setting up a simple pipeline
which pushes a charm build to the edge channel using the charm store CLI.
The last Juju Show (#30) talked about macaroon support in libjuju and CI
which sounds great, but that seems to be aimed at those using libjuju
and/or JAAS controllers.

Here are some of the steps for a new project:
* Create a launchpad team for a namespace in the charm store
- Fair enough
* Create a launchpad CI user/bot and add it project so we can push to the
store without using personal credentials
- This feels like a hack and rather insecure. Why not use limited
deploy/API keys? https://github.com/juju/charmstore/issues/776
* Manually login to launchpad with the CI user in order to activate it in
the charm store
- This gotcha took me a few moments to figure out.
https://jujucharms.com/docs/stable/authors-charm-store#the-juju-charm-store
* Manually login to the charm store with the CI user with `charm login` to
create a token.
- Had to find this bug, https://github.com/juju/c
harmstore-client/issues/61, after I figured out that `charm login` did not
have a non-interactive way to authenticate
- This is still not document anywhere as far as I can tell.
https://github.com/juju/charmstore-client/issues/145
- According to the comments in #61 it needs to be updated periodically
- I've seen another approach using expect, https://lists.ubuntu.c
om/archives/juju/2017-November/009691.html, but that seems like a
workaround too
* Encrypt and deploy token to a specific directory in CI in order for
`charm login` to work
- Again, https://github.com/juju/charmstore-client/issues/61 and
https://github.com/juju/charmstore-client/issues/145
* Mess around with `charm push` and `charm release` in order to push charm
to the edge channel
- This involves dealing with revisions which feels rather unnecessary
- See https://github.com/juju/charmstore-client/issues/135 and
https://github.com/juju/charmstore-client/issues/146
* Celebrate with your favourite beverage

How are you all interacting with the charm store with your charm CI?
Am I missing some obvious steps which would simplify things?
Is anyone working on proper deploy/API keys for the charm store?

Cheers
--
Sandor Zeestraten




Spicule Limited is registered in England & Wales. Company Number: 09954122.
Registered office: First Floor, Telecom House, 125-135 Preston Road,
Brighton, England, BN1 6AF. VAT No. 251478891.


All engagements are subject to Spicule Terms and Conditions of Business.
This email and its contents are intended solely for the individual to whom
it is addressed and may contain information that is confidential,
privileged or otherwise protected from disclosure, distributing or copying.
Any views or opinions presented in this email are solely those of the
author and do not necessarily represent those of Spicule Limited. The
company accepts no liability for any damage caused by any virus transmitted
by this email. If you have received this message in error, please notify us
immediately by reply email before deleting it from your system. Service of
legal notice cannot be effected on Spicule Limited by email.
Rick Harding
2018-02-28 15:13:51 UTC
Permalink
Howdy Sandor. I'm just traveling back from a holiday trip but let me take a
look and see what I can find to smooth this out and we'll put together some
better instructions to help folks out.
Post by Sandor Zeestraten
Hey Tom.
Yes, I saw your hack in
https://lists.ubuntu.com/archives/juju/2017-November/009691.html which
was handy, however I was hoping for something less hacky from the charm
store folks.
--
Sandor Zeestraten
I have a proper hack for a circleci build chain I wrote, but works pretty
https://github.com/spiculedata/circleci-juju
Hey Juju folks,
I feel like I'm hitting some rough spots while setting up a simple
pipeline which pushes a charm build to the edge channel using the charm
store CLI.
The last Juju Show (#30) talked about macaroon support in libjuju and CI
which sounds great, but that seems to be aimed at those using libjuju
and/or JAAS controllers.
* Create a launchpad team for a namespace in the charm store
- Fair enough
* Create a launchpad CI user/bot and add it project so we can push to the
store without using personal credentials
- This feels like a hack and rather insecure. Why not use limited
deploy/API keys? https://github.com/juju/charmstore/issues/776
* Manually login to launchpad with the CI user in order to activate it in
the charm store
- This gotcha took me a few moments to figure out.
https://jujucharms.com/docs/stable/authors-charm-store#the-juju-charm-store
* Manually login to the charm store with the CI user with `charm login` to
create a token.
- Had to find this bug,
https://github.com/juju/charmstore-client/issues/61, after I figured out
that `charm login` did not have a non-interactive way to authenticate
- This is still not document anywhere as far as I can tell.
https://github.com/juju/charmstore-client/issues/145
- According to the comments in #61 it needs to be updated periodically
- I've seen another approach using expect,
https://lists.ubuntu.com/archives/juju/2017-November/009691.html, but
that seems like a workaround too
* Encrypt and deploy token to a specific directory in CI in order for
`charm login` to work
- Again, https://github.com/juju/charmstore-client/issues/61 and
https://github.com/juju/charmstore-client/issues/145
* Mess around with `charm push` and `charm release` in order to push charm
to the edge channel
- This involves dealing with revisions which feels rather unnecessary
- See https://github.com/juju/charmstore-client/issues/135 and
https://github.com/juju/charmstore-client/issues/146
* Celebrate with your favourite beverage
How are you all interacting with the charm store with your charm CI?
Am I missing some obvious steps which would simplify things?
Is anyone working on proper deploy/API keys for the charm store?
Cheers
--
Sandor Zeestraten
09954122. Registered office: First Floor, Telecom House, 125-135 Preston
Road, Brighton, England, BN1 6AF. VAT No. 251478891.
All engagements are subject to Spicule Terms and Conditions of Business.
This email and its contents are intended solely for the individual to whom
it is addressed and may contain information that is confidential,
privileged or otherwise protected from disclosure, distributing or copying.
Any views or opinions presented in this email are solely those of the
author and do not necessarily represent those of Spicule Limited. The
company accepts no liability for any damage caused by any virus transmitted
by this email. If you have received this message in error, please notify us
immediately by reply email before deleting it from your system. Service of
legal notice cannot be effected on Spicule Limited by email.
--
Juju mailing list
https://lists.ubuntu.com/mailman/listinfo/juju
--
Juju mailing list
https://lists.ubuntu.com/mailman/listinfo/juju
Mark Shuttleworth
2018-02-28 07:51:31 UTC
Permalink
Post by Sandor Zeestraten
I feel like I'm hitting some rough spots while setting up a simple
pipeline which pushes a charm build to the edge channel using the
charm store CLI.
The last Juju Show (#30) talked about macaroon support in libjuju and
CI which sounds great, but that seems to be aimed at those using
libjuju and/or JAAS controllers.
The charm store should definitely use macaroons, and should have a
language to be able to setup limited-use macaroons ('token to push for
this charm', 'token to release to edge channel for this charm' etc).

Can I suggest a hangout between folks interested in this, and the charm
store folks, to work out whats needed?

Mark
Sandor Zeestraten
2018-03-01 07:29:10 UTC
Permalink
Post by Sandor Zeestraten
I feel like I'm hitting some rough spots while setting up a simple
pipeline which pushes a charm build to the edge channel using the charm
store CLI.
The last Juju Show (#30) talked about macaroon support in libjuju and CI
which sounds great, but that seems to be aimed at those using libjuju
and/or JAAS controllers.
The charm store should definitely use macaroons, and should have a
language to be able to setup limited-use macaroons ('token to push for this
charm', 'token to release to edge channel for this charm' etc).
Can I suggest a hangout between folks interested in this, and the charm
store folks, to work out whats needed?
Mark
Hey Mark, happy to join a hangout if needed. I'm mainly CET, but can do NA
time zones with some planning.

Thanks
--
Sandor Zeestraten
Tom Barber
2018-03-01 16:18:25 UTC
Permalink
Yeah I'd be interested in having a chat with folks about this.
Post by Mark Shuttleworth
Post by Sandor Zeestraten
I feel like I'm hitting some rough spots while setting up a
simple pipeline which pushes a charm build to the edge channel
using the charm store CLI.
The last Juju Show (#30) talked about macaroon support in libjuju
and CI which sounds great, but that seems to be aimed at those
using libjuju and/or JAAS controllers.
The charm store should definitely use macaroons, and should have a
language to be able to setup limited-use macaroons ('token to push
for this charm', 'token to release to edge channel for this charm'
etc).
Can I suggest a hangout between folks interested in this, and the
charm store folks, to work out whats needed?
Mark
Hey Mark, happy to join a hangout if needed. I'm mainly CET, but can
do NA time zones with some planning.
Thanks
--
Sandor Zeestraten
--
Spicule Limited is registered in England & Wales. Company Number: 09954122.
Registered office: First Floor, Telecom House, 125-135 Preston Road,
Brighton, England, BN1 6AF. VAT No. 251478891.


All engagements are subject to Spicule Terms and Conditions of Business.
This email and its contents are intended solely for the individual to whom
it is addressed and may contain information that is confidential,
privileged or otherwise protected from disclosure, distributing or copying.
Any views or opinions presented in this email are solely those of the
author and do not necessarily represent those of Spicule Limited. The
company accepts no liability for any damage caused by any virus transmitted
by this email. If you have received this message in error, please notify us
immediately by reply email before deleting it from your system. Service of
legal notice cannot be effected on Spicule Limited by email.
Loading...