Lego should be deployed in the same model as NGINX.

[amandahla]

Bug Description

While trying to set Lego and Nginx in different models I got the error:

unit-nginx-ingress-integrator-0: 13:30:15 ERROR juju.worker.uniter.context cannot apply changes: granting secrets access: cannot change access to "secret://2ec95bda-e7c5-4c53-8c52-3ffa4b731d71/d04hb5nmp25c77qg40rg" for "application-lego": sharing consumer secrets across a cross model relation not supported

To Reproduce

juju add-model lego-model
juju deploy lego --channel 4/stable
juju offer lego:certificates
juju switch model2
juju relate nginx admin/model1.certificates

Environment

Juju 3.5

Relevant log output

unit-nginx-ingress-integrator-0: 13:30:15 ERROR juju.worker.uniter.context cannot apply changes: granting secrets access: cannot change access to "secret://2ec95bda-e7c5-4c53-8c52-3ffa4b731d71/d04hb5nmp25c77qg40rg" for "application-lego": sharing consumer secrets across a cross model relation not supported

Additional context

No response

[gruyaume]

Hello @amandahla , I am somewhat confused by this error. While the LEGO charm does use leverage secrets for users to provide cloud specific secrets (ex aws key), it does not grant that secret and share it with anything else. This feels to me like an issue with Juju.