This page refers to Cross model relations. See that page for background information.
In this example, we supply a CMR infrastructure “out of the box” with a few nimble commands and then proceed to query, poke, analyse, and finally extend it by addressing firewall concerns.
This scenario describes a MediaWiki deployment, based upon multiple (LXD) controllers, used by a non-admin user, and consumed by a single model.
Build the infrastructure
The infrastructure is built in this way:
juju bootstrap localhost lxd-cmr-1
juju add-model cmr-model-1
juju deploy mysql
juju offer mysql:db
juju bootstrap localhost lxd-cmr-2
juju add-model cmr-model-2
juju deploy mediawiki
juju add-relation mediawiki:db lxd-cmr-1:admin/cmr-model-1.mysql
juju status
The status command provides a summary of what offers have been made. Here we’ll apply it to the model ‘cmr-model-1’ in the ‘lxd-cmr-1’ controller:
juju status --relations -m lxd-cmr-1:cmr-model-1
Output:
Model Controller Cloud/Region Version SLA Timestamp
cmr-model-1 lxd-cmr-1 localhost/localhost 2.4-beta4 unsupported 18:32:57Z
App Version Status Scale Charm Store Rev OS Notes
mysql 5.7.22 active 1 mysql jujucharms 58 ubuntu
Unit Workload Agent Machine Public address Ports Message
mysql/0* active idle 0 10.252.47.60 3306/tcp Ready
Machine State DNS Inst id Series AZ Message
0 started 10.252.47.60 juju-68c45a-0 xenial Running
Offer Application Charm Rev Connected Endpoint Interface Role
mysql mysql mysql 58 1/1 db mysql provider
Relation provider Requirer Interface Type Message
mysql:cluster mysql:cluster mysql-ha peer
In the ‘Offer’ section, the ‘Connected’ column shows the number of active connections to the offer and the total number of connections/relations (including those suspended).
juju offers
The offers command (alias juju list-offers) shows similar information. However, it also allows for several formats, each of which displays different kinds of information.
The ‘summary’ format provides information very similar to that gained via the status command (it adds the offer URL):
juju offers --format summary -m lxd-cmr-1:cmr-model-1
Output:
Offer Application Charm Connected Store URL Endpoint Interface Role
mysql mysql cs:mysql-58 1/1 lxd-cmr-1 admin/cmr-model-1.mysql db mysql provider
The ‘yaml’ format shows additional information, such as who is allowed to access the offer and what ingress subnets are required to allow traffic from the consuming model:
juju offers --format yaml -m lxd-cmr-1:cmr-model-1
Output:
mysql:
application: mysql
store: lxd-cmr-1
charm: cs:mysql-58
offer-url: admin/cmr-model-1.mysql
endpoints:
db:
interface: mysql
role: provider
connections:
- source-model-uuid: 4f032e24-4912-4620-894e-0b8f5324465c
username: admin
relation-id: 1
endpoint: db
status:
current: joined
since: 2018-06-01
ingress-subnets:
- 10.252.47.222/32
users:
admin:
display-name: admin
access: admin
everyone@external:
access: read
The ‘tabular’ format (the default) shows each relation (connection) to the offer from the consuming model:
juju offers -m lxd-cmr-1:cmr-model-1
Output:
Offer User Relation id Status Endpoint Interface Role Ingress subnets
mysql admin 1 joined db mysql provider 10.252.47.222/32
This command can also filter what offers are included in the result. Note that, for brevity, the scenario model is not specified in the below examples.
To list all offers for a given application:
juju offers --application mysql
To list all offers for a given interface:
juju offers --interface mysql
To list all offers for a given user who has created a relation to the offer:
juju offers --connected-user <user name>
To list all offers for a given user who can consume the offer:
juju offers --format summary --allowed-consumer <user name>
The above command is best run with --format summary as the intent is to see, for a given user, what offers they might relate to, regardless of whether there are existing relations (which is what the tabular view shows).
To list a specific offer (here named ‘mysql’):
juju offers mysql
juju show-offer
The juju show-offer command gives details about a specific offer:
juju show-offer lxd-cmr-1:admin/cmr-model-1.mysql
Output:
Store URL Access Description Endpoint Interface Role
lxd-cmr-1 admin/cmr-model-1.mysql admin MySQL is a fast, stable and true multi-user, db mysql provider
multi-threaded SQL database server. SQL
(Structured Query Language) is the most
popular database query language in the world.
The ma...
Notice how this command takes the offer URL as the argument. The controller portion (‘lxd-cmr-1’) can be omitted if the current controller contains the offer. In the same vein, if the offer resides in the current model then just the short name can be used (‘cmr-model-1.mysql’).
For more details, including which users can access the offer, use the ‘yaml’ format.
A non-admin user with read/consume access can also view an offer’s details, but they won’t see user ACL information.
juju find-offers
Offers can be searched based on various criteria:
- URL (or part thereof)
- offer name
- model name
- interface name
The results will show information about the offer, including the ACL permissions (of the user making the query).
To find all offers on controller lxd-cmr-1:
juju find-offers lxd-cmr-1:
Output:
Store URL Access Interfaces
lxd-cmr-1 admin/cmr-model-1.mysql admin mysql:db
The ‘yaml’ format will display extra information, including users who can access the offer (if an admin is making the query). Below we show this, in addition to searching by offer name:
juju find-offers lxd-cmr-1: --offer mysql --format yaml
Output:
lxd-cmr-1:admin/cmr-model-1.mysql:
access: admin
endpoints:
db:
interface: mysql
role: provider
users:
admin:
display-name: admin
access: admin
everyone@external:
access: read
To find offers in model cmr-model-1 on controller lxd-cmr-1:
juju find-offers lxd-cmr-1:cmr-model-1
Relating to offers from behind a firewall
Let the consuming model in this scenario be protected by a firewall that NATs all outgoing traffic to the single IPv4 address of 69.32.56.10/32.
Here, the admin on the offering side decided to create a whitelist consisting of a range of addresses known to cover the consuming side:
juju set-firewall-rule juju-application-offer --whitelist 69.32.0.0/16
Now request to have the single NAT address contact the offer:
juju add-relation mediawiki:db lxd-cmr-1:admin/cmr-model-1.mysql --via 69.32.56.10/32