chore: improve stability of integration tests

.github/workflows/integration_test.yaml

@@ -119,16 +119,24 @@ jobs:
       - name: Checkout
         timeout-minutes: 3
         uses: actions/checkout@v5
+      # todo: remove when switching back to 24.04 runners
+      - name: Install Python for tests
+        uses: actions/setup-python@v6
+        with:
+          python-version: '3.12'
       - name: Set up environment
         timeout-minutes: 5
         run: |
           sudo apt update
+          snap info lxd
           sudo snap install charmcraft --classic
           sudo snap install go --classic
           go install github.com/snapcore/spread/cmd/spread@latest
           # to build Valkey-glide during tests
           sudo apt install libprotobuf-dev protobuf-compiler -y
-          sudo apt install rustup -y
+          # 22.04 installs rustup from snap
+          # sudo apt install rustup -y
+          sudo snap install rustup --classic
           rustup set profile minimal
           rustup default 1.90.0
       - name: Download packed charm(s)

spread.yaml

@@ -85,6 +85,9 @@ backends:
       sudo systemctl start ssh
 
       sudo passwd --delete runner
+
+      # todo: remove when switching back to 24.04 runners
+      sudo systemctl reload ssh || sudo systemctl restart ssh
 
       ADDRESS localhost
     # HACK: spread does not pass environment variables set on runner
@@ -95,8 +98,11 @@ backends:
       # To install pipx on self-hosted runners
       CONCIERGE_EXTRA_DEBS: pipx
       DOCKERHUB_MIRROR: "$(HOST: echo $DOCKERHUB_MIRROR)"
+      # todo: remove when switching back to 24.04 runners
+      LD_LIBRARY_PATH: '$(HOST: echo $LD_LIBRARY_PATH)'
+      PKG_CONFIG_PATH: '$(HOST: echo $PKG_CONFIG_PATH)'
     systems:
-      - ubuntu-24.04:
+      - ubuntu-22.04:
           username: runner
 
 suites:
@@ -111,6 +117,7 @@ kill-timeout: 3h
 environment:
   PATH: $PATH:$(pipx environment --value PIPX_BIN_DIR)
   CONCIERGE_JUJU_CHANNEL: 3.6/stable
+  pythonLocation: '$(HOST: echo $pythonLocation)'
 prepare: |
   snap refresh --hold
   chown -R root:root "$SPREAD_PATH"
@@ -153,6 +160,7 @@ prepare: |
   fi
 
   pipx install tox poetry
+  poetry env use $pythonLocation/bin/python
   rustup default 1.90.0
 prepare-each: |
   cd "$SPREAD_PATH"
@@ -170,3 +178,4 @@ prepare-each: |
   # Unable to set constraint on all models because of Juju bug:
   # https://bugs.launchpad.net/juju/+bug/2065050
   juju set-model-constraints arch="$(dpkg --print-architecture)"
+  poetry env use $pythonLocation/bin/python

tests/integration/test_charm.py

@@ -220,9 +220,9 @@ async def test_user_secret_permissions(juju: jubilant.Juju) -> None:
     )
 
     logger.info("Secret access will be granted now - wait for updated password")
+    juju.grant_secret(identifier=secret_name, app=APP_NAME)
     # deferred `config_changed` event will be retried before `update_status`
     with fast_forward(juju):
-        juju.grant_secret(identifier=secret_name, app=APP_NAME)
         juju.wait(
             lambda status: are_apps_active_and_agents_idle(status, APP_NAME, idle_period=10),
             timeout=1200,

tests/integration/tls/test_certificate_rotation.py

@@ -218,7 +218,7 @@ async def test_ca_rotation_by_expiration(juju: jubilant.Juju) -> None:
     juju.remove_relation(f"{APP_NAME}:client-certificates", f"{TLS_NAME}:certificates")
     juju.wait(
         lambda status: are_agents_idle(status, APP_NAME, idle_period=30, unit_count=NUM_UNITS),
-        timeout=100,
+        timeout=600,
     )
 
     logger.info("Adjust CA and certificate validity on TLS provider")
@@ -274,6 +274,10 @@ async def test_ca_rotation_by_expiration(juju: jubilant.Juju) -> None:
 
     logger.info("Waiting for CA certificate to expire")
     sleep(CA_EXPIRY_TIME)
+    juju.wait(
+        lambda status: are_agents_idle(status, APP_NAME, idle_period=10, unit_count=NUM_UNITS),
+        timeout=600,
+    )
 
     logger.info("Check access with previous certificate fails after expiration")
     with pytest.raises(Exception) as exc_info: