Manage Juju controllers¶

Who: JIMM controller admin

See also: Controller

Add a Juju controller¶

JIMM gives a centralised view of all models in the system. However the work of managing the models is delegated to a set of Juju controllers deployed in various clouds and regions.

These Juju controllers must be deployed with some specific options to ensure they work correctly in the JAAS system. This document discusses how to bootstrap a Juju controller such that it will work correctly in a JAAS system.

In this how-to we will show how to add Juju controllers deployed in both MicroK8s and LXD to a JIMM controller.

Prerequisites¶

For this how-to you will need the following:

Basic knowledge of Juju
A JIMM controller deployed in MicroK8s, see the tutorial.

Prelude¶

There are 2 ways to add controllers to JAAS/JIMM:

Use the traditional juju bootstrap command and then register the controller with JAAS.
Use the jaas CLI tool to have JIMM bootstrap a controller. Your client does not need to access the cloud provider (AWS, Openstack, etc.) only JIMM requires access to the provider.

In order for a Juju controller to trust a JIMM controller, the login-token-refresh-url config option must be set to a specific URL path that serves JIMM’s public key, which is used to verify signed requests when they reach the Juju controller.

This can be specified manually when bootstrapping the Juju controller directly or is set automatically when bootstrapping through JIMM.

The jaas tool broadly offers the same set of bootstrap-specific flags and configuration values available through the juju CLI. Take a look at the jaas CLI bootstrap command reference to see the full list of options.

MicroK8s Controller¶

The following section provides guidance on how to connect a controller bootstrapped on MicroK8s to your JIMM running in MicroK8s.

We will name this controller workload-microk8s as it will be running our workloads as opposed to our original controller which only deploys JAAS.

LXD Controller¶

The following section provides guidance on how to connect a controller bootstrapped on LXD to your JIMM running in MicroK8s.

Controller profiles¶

Controller profiles let JIMM administrators store reusable, non-secret bootstrap defaults on the server and apply them later with juju jaas bootstrap --profile ....

A profile can capture:

The cloud metadata and bootstrap region the profile was created for.
The Juju version the profile is intended to be used with.
Bootstrap settings such as bootstrap-base, constraints, model defaults, storage pool configuration, and bootstrap/controller/controller-model config maps.

Controller profiles can be created, viewed, updated, listed, and removed with the juju jaas commands including add-controller-profile, show-controller-profile, update-controller-profile, list-controller-profiles, and remove-controller-profile.

A typical profile looks like this:

description: Production AWS bootstrap defaults
juju-version: 3.6
cloud:
  name: aws
  region:
    name: eu-west-1
bootstrap-options:
  bootstrap-base: ubuntu@24.04
  bootstrap-constraints:
    mem: 8G
  model-constraints:
    arch: amd64
  model-default:
    logging-config: <root>=INFO
  storage-pool:
    name: controller-pool
    type: ebs
    attributes:
      volume-type: gp3
  bootstrap-config:
    controller-service-type: loadbalancer
  controller-config:
    audit-log-enabled: "true"

Create the profile by passing the profile name on the command line and the YAML definition via --file:

juju switch jimm
juju jaas add-controller-profile aws-production --file ./aws-production.yaml

Later, apply the saved profile during bootstrap:

juju switch jimm
juju jaas bootstrap aws/eu-west-1 mycontroller 3.6.8 --profile aws-production

Any bootstrap flags you pass alongside --profile are merged with and override the saved defaults. For example, you can keep a common profile but override a single setting for a controller:

juju jaas bootstrap aws/eu-west-1 mycontroller 3.6.8 --profile aws-production --config controller-service-type=loadbalancer

Use juju jaas list-controller-profiles --juju-version 3.6.8 to discover profiles intended for the Juju version you plan to bootstrap.

Control user access to a Juju controller¶

To grant a (collection of) user(s) access to a Juju controller, add a can_addmodel, audit_log_viewer, or administrator permission between the user(s) and the controller.

See more: Add a permission

Remove a Juju controller¶

As with bootstrap there are 2 ways to remove a Juju controller attached to JIMM.

These options include:

Use the jaas plugin to first unregister the controller then use the juju CLI to destroy it.
Use the jaas plugin destroy the controller via an API call to JIMM, allowing for greater automation.

Removing a controller can only be done once the controller is not hosting any models known to JIMM. Migrate or destroy these models before destroying the controller.