Permission denied on relation-get

Today I saw the following error on the juju logs, and when running the command with juju run I get the same error:

$ juju run --unit slurmctld/leader "relation-get -r 71 - slurmdbd --app"
ERROR permission denied

Here are some logs:

machine-32: 17:16:27 DEBUG jujuc running hook tool "relation-list" for slurmctld/11-slurmd-relation-created-2533241742911058760
machine-32: 17:16:27 DEBUG jujuc running hook tool "relation-get" for slurmctld/11-slurmd-relation-created-2533241742911058760
machine-32: 17:16:27 DEBUG jujuc running hook tool "juju-log" for slurmctld/11-slurmd-relation-created-2533241742911058760
machine-32: 17:16:27 ERROR unit.slurmctld/11.juju-log slurmd:72: Uncaught exception while in charm code:
Traceback (most recent call last):
  File "/var/lib/juju/agents/unit-slurmctld-11/charm/venv/ops/model.py", line 1284, in _run
    result = run(args, **kwargs)
  File "/usr/lib64/python3.6/subprocess.py", line 438, in run
    output=stdout, stderr=stderr)
subprocess.CalledProcessError: Command '('/var/lib/juju/tools/unit-slurmctld-11/relation-get', '-r', '71', '-', 'slurmdbd', '--app', '--format=json')' returned non-zero exit status 1.

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "./src/charm.py", line 415, in <module>
    main(SlurmctldCharm)
  File "/var/lib/juju/agents/unit-slurmctld-11/charm/venv/ops/main.py", line 404, in main
    framework.reemit()
  File "/var/lib/juju/agents/unit-slurmctld-11/charm/venv/ops/framework.py", line 732, in reemit
    self._reemit()
  File "/var/lib/juju/agents/unit-slurmctld-11/charm/venv/ops/framework.py", line 767, in _reemit
    custom_handler(event)
  File "/var/lib/juju/agents/unit-slurmctld-11/charm/src/interface_slurmd.py", line 63, in _on_relation_created
    if not self._charm.slurmdbd_info:
  File "./src/charm.py", line 85, in slurmdbd_info
    return self._slurmdbd.get_slurmdbd_info()
  File "/var/lib/juju/agents/unit-slurmctld-11/charm/src/interface_slurmdbd.py", line 111, in get_slurmdbd_info
    if app_data:
  File "/var/lib/juju/agents/unit-slurmctld-11/charm/venv/ops/model.py", line 394, in __len__
    return len(self._data)
  File "/var/lib/juju/agents/unit-slurmctld-11/charm/venv/ops/model.py", line 384, in _data
    data = self._lazy_data = self._load()
  File "/var/lib/juju/agents/unit-slurmctld-11/charm/venv/ops/model.py", line 748, in _load
    return self._backend.relation_get(self.relation.id, self._entity.name, self._is_app)
  File "/var/lib/juju/agents/unit-slurmctld-11/charm/venv/ops/model.py", line 1351, in relation_get
    return self._run(*args, return_output=True, use_json=True)
  File "/var/lib/juju/agents/unit-slurmctld-11/charm/venv/ops/model.py", line 1286, in _run
    raise ModelError(e.stderr)
ops.model.ModelError: b'ERROR permission denied\n'
unit-slurmctld-11: 17:16:27 ERROR juju.worker.uniter.operation hook "slurmd-relation-created" (via hook dispatching script: dispatch) failed: exit status 1
unit-slurmctld-11: 17:16:27 DEBUG juju.machinelock machine lock released for slurmctld/11 uniter (run relation-created (72; app: slurmd) hook)

The charm code that triggered this error is here

Juju controller 2.9.4, Juju client 2.9.4.

[jnsgruk]

Closing this issue for now, the discussion continues at: https://bugs.launchpad.net/juju/+bug/1911010. I think this is not likely to be fixed by OF, but rather in Juju. Thanks for the feedback! 😃

[rbarry82]

Let’s continue this discussion on Launchpad. Strictly speaking, permissions on data bags are “below” the operator framework, and all we can do here is inherit Juju’s permissions/behavior.