From 213b505c99b7b4fe4c939d926d71cef7472ef015 Mon Sep 17 00:00:00 2001
From: Michael Thamm <mike.thamm@canonical.com>
Date: Sat, 25 Apr 2026 14:49:07 -0400
Subject: [PATCH 01/10] feat: squash commits

---
 terraform/cos-lite/README.md                  |  5 ++--
 terraform/cos-lite/applications.tf            |  3 ++-
 terraform/cos-lite/integrations.tf            | 23 +++++++++++++++----
 terraform/cos-lite/offers.tf                  |  4 ++++
 terraform/cos-lite/upgrades.tf                | 21 +++++++++++++++++
 terraform/cos-lite/variables.tf               |  2 +-
 terraform/cos/integrations.tf                 |  1 +
 terraform/cos/variables.tf                    |  2 +-
 .../test_upgrade_cos_tls_external.py          | 13 ++++-------
 .../integration/cos/tls_external/track-dev.tf |  2 +-
 .../cos/tls_full/test_upgrade_cos_tls_full.py | 13 ++++-------
 tests/integration/cos/tls_full/track-dev.tf   |  2 +-
 .../test_upgrade_cos_tls_internal.py          | 18 ++++-----------
 .../integration/cos/tls_internal/track-dev.tf |  2 +-
 .../cos/tls_none/test_upgrade_cos_tls_none.py | 18 ++++-----------
 tests/integration/cos/tls_none/track-dev.tf   |  2 +-
 .../test_upgrade_cos_lite_tls_external.py     | 17 +++++---------
 .../cos_lite/tls_external/track-dev.tf        |  2 +-
 .../test_upgrade_cos_lite_tls_full.py         | 15 ++++--------
 .../cos_lite/tls_full/track-dev.tf            |  2 +-
 .../test_upgrade_cos_lite_tls_internal.py     | 20 +++++-----------
 .../cos_lite/tls_internal/track-dev.tf        |  2 +-
 .../test_upgrade_cos_lite_tls_none.py         | 20 +++++-----------
 .../cos_lite/tls_none/track-dev.tf            |  4 ++--
 24 files changed, 102 insertions(+), 111 deletions(-)

diff --git a/terraform/cos-lite/README.md b/terraform/cos-lite/README.md
index 63f57131..ed54f6d1 100644
--- a/terraform/cos-lite/README.md
+++ b/terraform/cos-lite/README.md
@@ -8,6 +8,7 @@ This is a Terraform module facilitating the deployment of the COS Lite solution,
 | Name | Version |
 |------|---------|
 | <a name="provider_juju"></a> [juju](#provider\_juju) | ~> 1.0 |
+| <a name="provider_terraform"></a> [terraform](#provider\_terraform) | n/a |
 
 ## Modules
 
@@ -63,7 +64,7 @@ Otherwise, you can deploy from main (without `?ref`) which uses the Terraform Ju
 
 ### Basic usage
 
-To deploy the COS HA solution in a model named `cos`, create this root module:
+To deploy the COS Lite solution in a model named `cos`, create this root module:
 ```hcl
 terraform {
   required_version = ">= 1.5"
@@ -76,7 +77,7 @@ terraform {
 }
 
 resource "juju_model" "cos" {
-  name = "cos"
+  name = "cos-lite"
 }
 
 module "cos-lite" {
diff --git a/terraform/cos-lite/applications.tf b/terraform/cos-lite/applications.tf
index 72d34dd1..d2812316 100644
--- a/terraform/cos-lite/applications.tf
+++ b/terraform/cos-lite/applications.tf
@@ -23,7 +23,7 @@ module "catalogue" {
 }
 
 module "grafana" {
-  source             = "git::https://github.com/canonical/grafana-k8s-operator//terraform"
+  source             = "git::https://github.com/canonical/grafana-k8s-operator//terraform?ref=test/lifecycle-input"
   app_name           = var.grafana.app_name
   channel            = local.channels.grafana
   config             = var.grafana.config
@@ -32,6 +32,7 @@ module "grafana" {
   revision           = local.revisions.grafana
   storage_directives = var.grafana.storage_directives
   units              = var.grafana.units
+  replace_triggers   = [terraform_data.grafana_litestream_resource.id]
 }
 
 module "loki" {
diff --git a/terraform/cos-lite/integrations.tf b/terraform/cos-lite/integrations.tf
index 655d1fe5..86f5b5f2 100644
--- a/terraform/cos-lite/integrations.tf
+++ b/terraform/cos-lite/integrations.tf
@@ -217,10 +217,6 @@ resource "juju_integration" "ingress" {
         app_name = module.catalogue.app_name
         endpoint = module.catalogue.requires.ingress
       }
-      grafana = {
-        app_name = module.grafana.app_name
-        endpoint = module.grafana.requires.ingress
-      }
     } : k => v if var.ingress[k]
   }
 
@@ -237,6 +233,25 @@ resource "juju_integration" "ingress" {
   }
 }
 
+//TODO: Feature this in COS
+resource "juju_integration" "grafana_ingress" {
+  count = var.ingress["grafana"] ? 1 : 0
+
+  model_uuid = var.model_uuid
+
+  application {
+    name     = module.grafana.app_name
+    endpoint = module.grafana.requires.ingress
+  }
+
+  application {
+    name     = module.traefik.app_name
+    endpoint = module.traefik.endpoints.ingress
+  }
+
+  lifecycle { replace_triggered_by = [terraform_data.grafana_ingress_interface] }
+}
+
 resource "juju_integration" "ingress_per_unit" {
   for_each = {
     for k, v in {
diff --git a/terraform/cos-lite/offers.tf b/terraform/cos-lite/offers.tf
index 00baf380..66b67ca1 100644
--- a/terraform/cos-lite/offers.tf
+++ b/terraform/cos-lite/offers.tf
@@ -9,7 +9,11 @@ resource "juju_offer" "grafana_dashboards" {
   name             = "grafana-dashboards"
   model_uuid       = var.model_uuid
   application_name = module.grafana.app_name
+  # TODO: Replace these with module.grafana.requires.grafana_dashboard in a tandem PR?
+  # TODO: and module.grafana.endpoints.grafana_dashboard in track/2?
   endpoints        = ["grafana-dashboard"]
+
+  lifecycle { replace_triggered_by = [terraform_data.grafana_litestream_resource] }
 }
 
 resource "juju_offer" "loki_logging" {
diff --git a/terraform/cos-lite/upgrades.tf b/terraform/cos-lite/upgrades.tf
index dade7e62..4989ff93 100644
--- a/terraform/cos-lite/upgrades.tf
+++ b/terraform/cos-lite/upgrades.tf
@@ -1,3 +1,24 @@
+# -------------- # Application replace triggers -------------- #
+
+# Grafana removed the litestream-image resource
+#   The litestream-image resource was removed and given a Juju bug, we need to add a lifecycle to
+#   trigger application replacement, otherwise the upgrade will fail
+#   https://github.com/juju/juju/issues/21648
+#   https://github.com/juju/juju/issues/22071
+resource "terraform_data" "grafana_litestream_resource" {
+  triggers_replace = contains(keys(data.juju_charm.grafana_info.resources), "litestream-image")
+}
+
+# -------------- # Integration replace triggers -------------- #
+
+# Grafana ingress interface changed
+#   The ingress endpoint interface changes from traefik_route to ingress_per_app so we need a
+#   lifecycle to trigger integration replacement, otherwise the upgrade will fail
+#   https://github.com/canonical/observability-stack/issues/165
+resource "terraform_data" "grafana_ingress_interface" {
+  triggers_replace = data.juju_charm.grafana_info.requires["ingress"]
+}
+
 # -------------- # CharmHub API -------------- #
 
 data "juju_charm" "alertmanager_info" {
diff --git a/terraform/cos-lite/variables.tf b/terraform/cos-lite/variables.tf
index 0856498c..d04288b4 100644
--- a/terraform/cos-lite/variables.tf
+++ b/terraform/cos-lite/variables.tf
@@ -12,7 +12,7 @@ variable "risk" {
 }
 
 variable "base" {
-  description = "The operating system on which to deploy. E.g. ubuntu@22.04. Changing this value for machine charms will trigger a replace by terraform. Check Charmhub for per-charm base support."
+  description = "The operating system on which to deploy. E.g. ubuntu@24.04. Check Charmhub for per-charm base support."
   default     = "ubuntu@24.04"
   type        = string
 }
diff --git a/terraform/cos/integrations.tf b/terraform/cos/integrations.tf
index 6332e4aa..f7f8576b 100644
--- a/terraform/cos/integrations.tf
+++ b/terraform/cos/integrations.tf
@@ -294,6 +294,7 @@ resource "juju_integration" "ingress" {
       }
       grafana = {
         app_name = module.grafana.app_name
+        # TODO: move this out so I can add a lifecycle
         endpoint = module.grafana.requires.ingress
       }
     } : k => v if var.ingress[k]
diff --git a/terraform/cos/variables.tf b/terraform/cos/variables.tf
index 6e1d3ba9..26249365 100644
--- a/terraform/cos/variables.tf
+++ b/terraform/cos/variables.tf
@@ -12,7 +12,7 @@ variable "risk" {
 }
 
 variable "base" {
-  description = "The operating system on which to deploy. E.g. ubuntu@22.04. Changing this value for machine charms will trigger a replace by terraform. Check Charmhub for per-charm base support."
+  description = "The operating system on which to deploy. E.g. ubuntu@24.04. Check Charmhub for per-charm base support."
   default     = "ubuntu@24.04"
   type        = string
 }
diff --git a/tests/integration/cos/tls_external/test_upgrade_cos_tls_external.py b/tests/integration/cos/tls_external/test_upgrade_cos_tls_external.py
index 931fb5e2..1850376c 100644
--- a/tests/integration/cos/tls_external/test_upgrade_cos_tls_external.py
+++ b/tests/integration/cos/tls_external/test_upgrade_cos_tls_external.py
@@ -10,7 +10,6 @@
 from helpers import (
     catalogue_apps_are_reachable,
     get_tls_context,
-    refresh_o11y_apps,
     wait_for_active_idle_without_error,
 )
 
@@ -31,10 +30,10 @@ def test_envvars():
     )
 
 
-def test_deploy_from_track(
+def test_deploy_from_track_2(
     tmp_path, tf_manager, ca_model: jubilant.Juju, cos_model: jubilant.Juju
 ):
-    # GIVEN a module deployed from track n
+    # GIVEN a module deployed from track 2
     tf_manager.init(TRACK_2_TF_FILE)
     tf_manager.apply(ca_model=ca_model.model, cos_model=cos_model.model, **S3_ENDPOINT)
     wait_for_active_idle_without_error([cos_model], timeout=5400)
@@ -42,14 +41,10 @@ def test_deploy_from_track(
     catalogue_apps_are_reachable(cos_model, tls_ctx)
 
 
-def test_deploy_to_track(
+def test_deploy_to_track_dev(
     tmp_path, tf_manager, ca_model: jubilant.Juju, cos_model: jubilant.Juju
 ):
-    # WHEN upgraded to track n
-    cos_model.remove_relation("traefik:traefik-route", "grafana:ingress")
-    wait_for_active_idle_without_error([cos_model])
-    # FIXME: https://github.com/juju/terraform-provider-juju/issues/967
-    refresh_o11y_apps(cos_model, channel="dev/edge", base="ubuntu@24.04")
+    # WHEN upgraded to track dev
     tf_manager.init(TRACK_DEV_TF_FILE)
     tf_manager.apply(ca_model=ca_model.model, cos_model=cos_model.model, **S3_ENDPOINT)
 
diff --git a/tests/integration/cos/tls_external/track-dev.tf b/tests/integration/cos/tls_external/track-dev.tf
index 6b231f55..2bbce072 100644
--- a/tests/integration/cos/tls_external/track-dev.tf
+++ b/tests/integration/cos/tls_external/track-dev.tf
@@ -46,7 +46,7 @@ module "ssc" {
 module "cos" {
   source                          = "git::https://github.com/canonical/observability-stack//terraform/cos"
   model_uuid                      = data.juju_model.cos-model.uuid
-  channel                         = "dev/edge"
+  risk                            = "edge"
   internal_tls                    = false
   external_certificates_offer_url = "admin/${var.ca_model}.certificates"
   external_ca_cert_offer_url      = "admin/${var.ca_model}.send-ca-cert"
diff --git a/tests/integration/cos/tls_full/test_upgrade_cos_tls_full.py b/tests/integration/cos/tls_full/test_upgrade_cos_tls_full.py
index 7ffb87e5..6be5ccb1 100644
--- a/tests/integration/cos/tls_full/test_upgrade_cos_tls_full.py
+++ b/tests/integration/cos/tls_full/test_upgrade_cos_tls_full.py
@@ -10,7 +10,6 @@
 from helpers import (
     catalogue_apps_are_reachable,
     get_tls_context,
-    refresh_o11y_apps,
     wait_for_active_idle_without_error,
 )
 
@@ -31,10 +30,10 @@ def test_envvars():
     )
 
 
-def test_deploy_from_track(
+def test_deploy_from_track_2(
     tmp_path, tf_manager, ca_model: jubilant.Juju, cos_model: jubilant.Juju
 ):
-    # GIVEN a module deployed from track n
+    # GIVEN a module deployed from track 2
     tf_manager.init(TRACK_2_TF_FILE)
     tf_manager.apply(ca_model=ca_model.model, cos_model=cos_model.model, **S3_ENDPOINT)
     wait_for_active_idle_without_error([cos_model], timeout=5400)
@@ -42,14 +41,10 @@ def test_deploy_from_track(
     catalogue_apps_are_reachable(cos_model, tls_ctx)
 
 
-def test_deploy_to_track(
+def test_deploy_to_track_dev(
     tmp_path, tf_manager, ca_model: jubilant.Juju, cos_model: jubilant.Juju
 ):
-    # WHEN upgraded to track n
-    cos_model.remove_relation("traefik:traefik-route", "grafana:ingress")
-    wait_for_active_idle_without_error([cos_model])
-    # FIXME: https://github.com/juju/terraform-provider-juju/issues/967
-    refresh_o11y_apps(cos_model, channel="dev/edge", base="ubuntu@24.04")
+    # WHEN upgraded to track dev
     tf_manager.init(TRACK_DEV_TF_FILE)
     tf_manager.apply(ca_model=ca_model.model, cos_model=cos_model.model, **S3_ENDPOINT)
 
diff --git a/tests/integration/cos/tls_full/track-dev.tf b/tests/integration/cos/tls_full/track-dev.tf
index 45c0a2fa..c66f7bc8 100644
--- a/tests/integration/cos/tls_full/track-dev.tf
+++ b/tests/integration/cos/tls_full/track-dev.tf
@@ -46,7 +46,7 @@ module "ssc" {
 module "cos" {
   source                          = "git::https://github.com/canonical/observability-stack//terraform/cos"
   model_uuid                      = data.juju_model.cos-model.uuid
-  channel                         = "dev/edge"
+  risk                            = "edge"
   internal_tls                    = true
   external_certificates_offer_url = "admin/${var.ca_model}.certificates"
   external_ca_cert_offer_url      = "admin/${var.ca_model}.send-ca-cert"
diff --git a/tests/integration/cos/tls_internal/test_upgrade_cos_tls_internal.py b/tests/integration/cos/tls_internal/test_upgrade_cos_tls_internal.py
index d08e745d..54ab3ceb 100644
--- a/tests/integration/cos/tls_internal/test_upgrade_cos_tls_internal.py
+++ b/tests/integration/cos/tls_internal/test_upgrade_cos_tls_internal.py
@@ -7,11 +7,7 @@
 import os
 from pathlib import Path
 
-from helpers import (
-    catalogue_apps_are_reachable,
-    refresh_o11y_apps,
-    wait_for_active_idle_without_error,
-)
+from helpers import catalogue_apps_are_reachable, wait_for_active_idle_without_error
 
 import jubilant
 
@@ -30,20 +26,16 @@ def test_envvars():
     )
 
 
-def test_deploy_from_track(tmp_path, tf_manager, cos_model: jubilant.Juju):
-    # GIVEN a module deployed from track n
+def test_deploy_from_track_2(tf_manager, cos_model: jubilant.Juju):
+    # GIVEN a module deployed from track 2
     tf_manager.init(TRACK_2_TF_FILE)
     tf_manager.apply(model=cos_model.model, **S3_ENDPOINT)
     wait_for_active_idle_without_error([cos_model], timeout=5400)
     catalogue_apps_are_reachable(cos_model)
 
 
-def test_deploy_to_track(tmp_path, tf_manager, cos_model: jubilant.Juju):
-    # WHEN upgraded to track n
-    cos_model.remove_relation("traefik:traefik-route", "grafana:ingress")
-    wait_for_active_idle_without_error([cos_model])
-    # FIXME: https://github.com/juju/terraform-provider-juju/issues/967
-    refresh_o11y_apps(cos_model, channel="dev/edge", base="ubuntu@24.04")
+def test_deploy_to_track_dev(tf_manager, cos_model: jubilant.Juju):
+    # WHEN upgraded to track dev
     tf_manager.init(TRACK_DEV_TF_FILE)
     tf_manager.apply(model=cos_model.model, **S3_ENDPOINT)
 
diff --git a/tests/integration/cos/tls_internal/track-dev.tf b/tests/integration/cos/tls_internal/track-dev.tf
index 35265142..f1a756dd 100644
--- a/tests/integration/cos/tls_internal/track-dev.tf
+++ b/tests/integration/cos/tls_internal/track-dev.tf
@@ -32,7 +32,7 @@ variable "s3_access_key" {
 module "cos" {
   source       = "git::https://github.com/canonical/observability-stack//terraform/cos"
   model_uuid   = data.juju_model.model.uuid
-  channel      = "dev/edge"
+  risk         = "edge"
   internal_tls = true
 
   s3_endpoint   = var.s3_endpoint
diff --git a/tests/integration/cos/tls_none/test_upgrade_cos_tls_none.py b/tests/integration/cos/tls_none/test_upgrade_cos_tls_none.py
index 419dfaf1..15f64b44 100644
--- a/tests/integration/cos/tls_none/test_upgrade_cos_tls_none.py
+++ b/tests/integration/cos/tls_none/test_upgrade_cos_tls_none.py
@@ -7,11 +7,7 @@
 import os
 from pathlib import Path
 
-from helpers import (
-    catalogue_apps_are_reachable,
-    refresh_o11y_apps,
-    wait_for_active_idle_without_error,
-)
+from helpers import catalogue_apps_are_reachable, wait_for_active_idle_without_error
 
 import jubilant
 
@@ -30,20 +26,16 @@ def test_envvars():
     )
 
 
-def test_deploy_from_track(tf_manager, cos_model: jubilant.Juju):
-    # GIVEN a module deployed from track n
+def test_deploy_from_track_2(tf_manager, cos_model: jubilant.Juju):
+    # GIVEN a module deployed from track 2
     tf_manager.init(TRACK_2_TF_FILE)
     tf_manager.apply(model=cos_model.model, **S3_ENDPOINT)
     wait_for_active_idle_without_error([cos_model], timeout=5400)
     catalogue_apps_are_reachable(cos_model)
 
 
-def test_deploy_to_track(tmp_path, tf_manager, cos_model: jubilant.Juju):
-    # WHEN upgraded to track n
-    cos_model.remove_relation("traefik:traefik-route", "grafana:ingress")
-    wait_for_active_idle_without_error([cos_model])
-    # FIXME: https://github.com/juju/terraform-provider-juju/issues/967
-    refresh_o11y_apps(cos_model, channel="dev/edge", base="ubuntu@24.04")
+def test_deploy_to_track_dev(tf_manager, cos_model: jubilant.Juju):
+    # WHEN upgraded to track dev
     tf_manager.init(TRACK_DEV_TF_FILE)
     tf_manager.apply(model=cos_model.model, **S3_ENDPOINT)
 
diff --git a/tests/integration/cos/tls_none/track-dev.tf b/tests/integration/cos/tls_none/track-dev.tf
index 0c5e55d0..31e4ad06 100644
--- a/tests/integration/cos/tls_none/track-dev.tf
+++ b/tests/integration/cos/tls_none/track-dev.tf
@@ -32,7 +32,7 @@ variable "s3_access_key" {
 module "cos" {
   source       = "git::https://github.com/canonical/observability-stack//terraform/cos"
   model_uuid   = data.juju_model.model.uuid
-  channel      = "dev/edge"
+  risk         = "edge"
   internal_tls = false
 
   s3_endpoint   = var.s3_endpoint
diff --git a/tests/integration/cos_lite/tls_external/test_upgrade_cos_lite_tls_external.py b/tests/integration/cos_lite/tls_external/test_upgrade_cos_lite_tls_external.py
index 62a7555b..f8a2281b 100644
--- a/tests/integration/cos_lite/tls_external/test_upgrade_cos_lite_tls_external.py
+++ b/tests/integration/cos_lite/tls_external/test_upgrade_cos_lite_tls_external.py
@@ -9,7 +9,6 @@
 from helpers import (
     catalogue_apps_are_reachable,
     get_tls_context,
-    refresh_o11y_apps,
     wait_for_active_idle_without_error,
 )
 
@@ -19,28 +18,24 @@
 TRACK_DEV_TF_FILE = Path(__file__).parent.resolve() / "track-dev.tf"
 
 
-def test_deploy_from_track(
+def test_deploy_from_track_2(
     tmp_path, tf_manager, ca_model: jubilant.Juju, cos_model: jubilant.Juju
 ):
-    # GIVEN a module deployed from track n-1
+    # GIVEN a module deployed from track 2
     tf_manager.init(TRACK_2_TF_FILE)
     tf_manager.apply(ca_model=ca_model.model, cos_model=cos_model.model)
-    wait_for_active_idle_without_error([ca_model, cos_model], timeout=60*60)
+    wait_for_active_idle_without_error([ca_model, cos_model], timeout=60 * 60)
     tls_ctx = get_tls_context(tmp_path, ca_model, "self-signed-certificates")
     catalogue_apps_are_reachable(cos_model, tls_ctx)
 
 
-def test_deploy_to_track(
+def test_deploy_to_track_dev(
     tmp_path, tf_manager, ca_model: jubilant.Juju, cos_model: jubilant.Juju
 ):
-    # WHEN upgraded to track n
-    cos_model.remove_relation("traefik:traefik-route", "grafana:ingress")
-    wait_for_active_idle_without_error([cos_model])
-    # FIXME: https://github.com/juju/terraform-provider-juju/issues/967
-    refresh_o11y_apps(cos_model, channel="dev/edge", base="ubuntu@24.04")
+    # WHEN upgraded to track dev
     tf_manager.init(TRACK_DEV_TF_FILE)
     tf_manager.apply(ca_model=ca_model.model, cos_model=cos_model.model)
-    
+
     # THEN the model is upgraded and is healthy
     wait_for_active_idle_without_error([ca_model, cos_model])
     tls_ctx = get_tls_context(tmp_path, ca_model, "self-signed-certificates")
diff --git a/tests/integration/cos_lite/tls_external/track-dev.tf b/tests/integration/cos_lite/tls_external/track-dev.tf
index 3a63372a..9552819f 100644
--- a/tests/integration/cos_lite/tls_external/track-dev.tf
+++ b/tests/integration/cos_lite/tls_external/track-dev.tf
@@ -34,7 +34,7 @@ module "ssc" {
 module "cos-lite" {
   source                          = "git::https://github.com/canonical/observability-stack//terraform/cos-lite"
   model_uuid                      = data.juju_model.cos-model.uuid
-  channel                         = "dev/edge"
+  risk                            = "edge"
   internal_tls                    = false
   external_certificates_offer_url = "admin/${var.ca_model}.certificates"
   external_ca_cert_offer_url      = "admin/${var.ca_model}.send-ca-cert"
diff --git a/tests/integration/cos_lite/tls_full/test_upgrade_cos_lite_tls_full.py b/tests/integration/cos_lite/tls_full/test_upgrade_cos_lite_tls_full.py
index d73b8bc2..38225452 100644
--- a/tests/integration/cos_lite/tls_full/test_upgrade_cos_lite_tls_full.py
+++ b/tests/integration/cos_lite/tls_full/test_upgrade_cos_lite_tls_full.py
@@ -9,7 +9,6 @@
 from helpers import (
     catalogue_apps_are_reachable,
     get_tls_context,
-    refresh_o11y_apps,
     wait_for_active_idle_without_error,
 )
 
@@ -19,25 +18,21 @@
 TRACK_DEV_TF_FILE = Path(__file__).parent.resolve() / "track-dev.tf"
 
 
-def test_deploy_from_track(
+def test_deploy_from_track_2(
     tmp_path, tf_manager, ca_model: jubilant.Juju, cos_model: jubilant.Juju
 ):
-    # GIVEN a module deployed from track n-1
+    # GIVEN a module deployed from track 2
     tf_manager.init(TRACK_2_TF_FILE)
     tf_manager.apply(ca_model=ca_model.model, cos_model=cos_model.model)
-    wait_for_active_idle_without_error([ca_model, cos_model], timeout=60*60)
+    wait_for_active_idle_without_error([ca_model, cos_model], timeout=60 * 60)
     tls_ctx = get_tls_context(tmp_path, ca_model, "self-signed-certificates")
     catalogue_apps_are_reachable(cos_model, tls_ctx)
 
 
-def test_deploy_to_track(
+def test_deploy_to_track_dev(
     tmp_path, tf_manager, ca_model: jubilant.Juju, cos_model: jubilant.Juju
 ):
-    # WHEN upgraded to track n
-    cos_model.remove_relation("traefik:traefik-route", "grafana:ingress")
-    wait_for_active_idle_without_error([cos_model])
-    # FIXME: https://github.com/juju/terraform-provider-juju/issues/967
-    refresh_o11y_apps(cos_model, channel="dev/edge", base="ubuntu@24.04")
+    # WHEN upgraded to track dev
     tf_manager.init(TRACK_DEV_TF_FILE)
     tf_manager.apply(ca_model=ca_model.model, cos_model=cos_model.model)
 
diff --git a/tests/integration/cos_lite/tls_full/track-dev.tf b/tests/integration/cos_lite/tls_full/track-dev.tf
index 64973b54..88f0f326 100644
--- a/tests/integration/cos_lite/tls_full/track-dev.tf
+++ b/tests/integration/cos_lite/tls_full/track-dev.tf
@@ -34,7 +34,7 @@ module "ssc" {
 module "cos-lite" {
   source                          = "git::https://github.com/canonical/observability-stack//terraform/cos-lite"
   model_uuid                      = data.juju_model.cos-model.uuid
-  channel                         = "dev/edge"
+  risk                            = "edge"
   internal_tls                    = true
   external_certificates_offer_url = "admin/${var.ca_model}.certificates"
   external_ca_cert_offer_url      = "admin/${var.ca_model}.send-ca-cert"
diff --git a/tests/integration/cos_lite/tls_internal/test_upgrade_cos_lite_tls_internal.py b/tests/integration/cos_lite/tls_internal/test_upgrade_cos_lite_tls_internal.py
index 125a8019..d8e800fb 100644
--- a/tests/integration/cos_lite/tls_internal/test_upgrade_cos_lite_tls_internal.py
+++ b/tests/integration/cos_lite/tls_internal/test_upgrade_cos_lite_tls_internal.py
@@ -6,11 +6,7 @@
 
 from pathlib import Path
 
-from helpers import (
-    catalogue_apps_are_reachable,
-    refresh_o11y_apps,
-    wait_for_active_idle_without_error,
-)
+from helpers import catalogue_apps_are_reachable, wait_for_active_idle_without_error
 
 import jubilant
 
@@ -18,20 +14,16 @@
 TRACK_DEV_TF_FILE = Path(__file__).parent.resolve() / "track-dev.tf"
 
 
-def test_deploy_from_track(tf_manager, cos_model: jubilant.Juju):
-    # GIVEN a module deployed from track n-1
+def test_deploy_from_track_2(tf_manager, cos_model: jubilant.Juju):
+    # GIVEN a module deployed from track 2
     tf_manager.init(TRACK_2_TF_FILE)
     tf_manager.apply(model=cos_model.model)
-    wait_for_active_idle_without_error([cos_model], timeout=60*60)
+    wait_for_active_idle_without_error([cos_model], timeout=60 * 60)
     catalogue_apps_are_reachable(cos_model)
 
 
-def test_deploy_to_track(tmp_path, tf_manager, cos_model: jubilant.Juju):
-    # WHEN upgraded to track n
-    cos_model.remove_relation("traefik:traefik-route", "grafana:ingress")
-    wait_for_active_idle_without_error([cos_model])
-    # FIXME: https://github.com/juju/terraform-provider-juju/issues/967
-    refresh_o11y_apps(cos_model, channel="dev/edge", base="ubuntu@24.04")
+def test_deploy_to_track_dev(tf_manager, cos_model: jubilant.Juju):
+    # WHEN upgraded to track dev
     tf_manager.init(TRACK_DEV_TF_FILE)
     tf_manager.apply(model=cos_model.model)
 
diff --git a/tests/integration/cos_lite/tls_internal/track-dev.tf b/tests/integration/cos_lite/tls_internal/track-dev.tf
index 04e3439a..d18f5419 100644
--- a/tests/integration/cos_lite/tls_internal/track-dev.tf
+++ b/tests/integration/cos_lite/tls_internal/track-dev.tf
@@ -20,6 +20,6 @@ data "juju_model" "model" {
 module "cos-lite" {
   source       = "git::https://github.com/canonical/observability-stack//terraform/cos-lite"
   model_uuid   = data.juju_model.model.uuid
-  channel      = "dev/edge"
+  risk         = "edge"
   internal_tls = true
 }
diff --git a/tests/integration/cos_lite/tls_none/test_upgrade_cos_lite_tls_none.py b/tests/integration/cos_lite/tls_none/test_upgrade_cos_lite_tls_none.py
index 3150c1d3..505f9f01 100644
--- a/tests/integration/cos_lite/tls_none/test_upgrade_cos_lite_tls_none.py
+++ b/tests/integration/cos_lite/tls_none/test_upgrade_cos_lite_tls_none.py
@@ -6,11 +6,7 @@
 
 from pathlib import Path
 
-from helpers import (
-    catalogue_apps_are_reachable,
-    refresh_o11y_apps,
-    wait_for_active_idle_without_error,
-)
+from helpers import catalogue_apps_are_reachable, wait_for_active_idle_without_error
 
 import jubilant
 
@@ -18,20 +14,16 @@
 TRACK_DEV_TF_FILE = Path(__file__).parent.resolve() / "track-dev.tf"
 
 
-def test_deploy_from_track(tf_manager, cos_model: jubilant.Juju):
-    # GIVEN a module deployed from track n-1
+def test_deploy_from_track_2(tf_manager, cos_model: jubilant.Juju):
+    # GIVEN a module deployed from track 2
     tf_manager.init(TRACK_2_TF_FILE)
     tf_manager.apply(model=cos_model.model)
-    wait_for_active_idle_without_error([cos_model], timeout=60*60)
+    wait_for_active_idle_without_error([cos_model], timeout=60 * 60)
     catalogue_apps_are_reachable(cos_model)
 
 
-def test_deploy_to_track(tmp_path, tf_manager, cos_model: jubilant.Juju):
-    # WHEN upgraded to track n
-    cos_model.remove_relation("traefik:traefik-route", "grafana:ingress")
-    wait_for_active_idle_without_error([cos_model])
-    # FIXME: https://github.com/juju/terraform-provider-juju/issues/967
-    refresh_o11y_apps(cos_model, channel="dev/edge", base="ubuntu@24.04")
+def test_deploy_to_track_dev(tf_manager, cos_model: jubilant.Juju):
+    # WHEN upgraded to track dev
     tf_manager.init(TRACK_DEV_TF_FILE)
     tf_manager.apply(model=cos_model.model)
 
diff --git a/tests/integration/cos_lite/tls_none/track-dev.tf b/tests/integration/cos_lite/tls_none/track-dev.tf
index 22352f12..6b79ffcc 100644
--- a/tests/integration/cos_lite/tls_none/track-dev.tf
+++ b/tests/integration/cos_lite/tls_none/track-dev.tf
@@ -18,8 +18,8 @@ data "juju_model" "model" {
 }
 
 module "cos-lite" {
-  source       = "git::https://github.com/canonical/observability-stack//terraform/cos-lite"
+  source       = "git::https://github.com/canonical/observability-stack//terraform/cos-lite?ref=feat/charmhub-module"
   model_uuid   = data.juju_model.model.uuid
-  channel      = "dev/edge"
+  risk         = "edge"
   internal_tls = false
 }

From 3125593e8b2a79ad3a7d0fb0413d677c6c3048f6 Mon Sep 17 00:00:00 2001
From: Michael Thamm <mike.thamm@canonical.com>
Date: Sat, 25 Apr 2026 17:26:37 -0400
Subject: [PATCH 02/10] chore

---
 terraform/cos-lite/README.md       |  6 +++---
 terraform/cos-lite/integrations.tf |  1 -
 terraform/cos-lite/upgrades.tf     | 17 ++++++++---------
 terraform/cos/README.md            |  2 +-
 terraform/cos/applications.tf      |  2 +-
 terraform/cos/integrations.tf      | 22 +++++++++++++++++-----
 terraform/cos/offers.tf            |  2 ++
 terraform/cos/upgrades.tf          | 20 ++++++++++++++++++++
 8 files changed, 52 insertions(+), 20 deletions(-)

diff --git a/terraform/cos-lite/README.md b/terraform/cos-lite/README.md
index ed54f6d1..43fcaa73 100644
--- a/terraform/cos-lite/README.md
+++ b/terraform/cos-lite/README.md
@@ -16,7 +16,7 @@ This is a Terraform module facilitating the deployment of the COS Lite solution,
 |------|--------|---------|
 | <a name="module_alertmanager"></a> [alertmanager](#module\_alertmanager) | git::https://github.com/canonical/alertmanager-k8s-operator//terraform | n/a |
 | <a name="module_catalogue"></a> [catalogue](#module\_catalogue) | git::https://github.com/canonical/catalogue-k8s-operator//terraform | n/a |
-| <a name="module_grafana"></a> [grafana](#module\_grafana) | git::https://github.com/canonical/grafana-k8s-operator//terraform | n/a |
+| <a name="module_grafana"></a> [grafana](#module\_grafana) | git::https://github.com/canonical/grafana-k8s-operator//terraform | test/lifecycle-input |
 | <a name="module_loki"></a> [loki](#module\_loki) | git::https://github.com/canonical/loki-k8s-operator//terraform | n/a |
 | <a name="module_prometheus"></a> [prometheus](#module\_prometheus) | git::https://github.com/canonical/prometheus-k8s-operator//terraform | n/a |
 | <a name="module_ssc"></a> [ssc](#module\_ssc) | git::https://github.com/canonical/self-signed-certificates-operator//terraform | n/a |
@@ -27,7 +27,7 @@ This is a Terraform module facilitating the deployment of the COS Lite solution,
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
 | <a name="input_alertmanager"></a> [alertmanager](#input\_alertmanager) | Application configuration for Alertmanager. For more details: https://registry.terraform.io/providers/juju/juju/latest/docs/resources/application | <pre>object({<br/>    app_name           = optional(string, "alertmanager")<br/>    config             = optional(map(string), {})<br/>    constraints        = optional(string, "arch=amd64")<br/>    revision           = optional(number, null)<br/>    storage_directives = optional(map(string), {})<br/>    units              = optional(number, 1)<br/>  })</pre> | `{}` | no |
-| <a name="input_base"></a> [base](#input\_base) | The operating system on which to deploy. E.g. ubuntu@22.04. Changing this value for machine charms will trigger a replace by terraform. Check Charmhub for per-charm base support. | `string` | `"ubuntu@24.04"` | no |
+| <a name="input_base"></a> [base](#input\_base) | The operating system on which to deploy. E.g. ubuntu@24.04. Check Charmhub for per-charm base support. | `string` | `"ubuntu@24.04"` | no |
 | <a name="input_catalogue"></a> [catalogue](#input\_catalogue) | Application configuration for Catalogue. For more details: https://registry.terraform.io/providers/juju/juju/latest/docs/resources/application | <pre>object({<br/>    app_name           = optional(string, "catalogue")<br/>    config             = optional(map(string), {})<br/>    constraints        = optional(string, "arch=amd64")<br/>    revision           = optional(number, null)<br/>    storage_directives = optional(map(string), {})<br/>    units              = optional(number, 1)<br/>  })</pre> | `{}` | no |
 | <a name="input_external_ca_cert_offer_url"></a> [external\_ca\_cert\_offer\_url](#input\_external\_ca\_cert\_offer\_url) | A Juju offer URL (e.g. admin/external-ca.send-ca-cert) of a CA providing the 'certificate\_transfer' integration for applications to trust ingress via Traefik. | `string` | `null` | no |
 | <a name="input_external_certificates_offer_url"></a> [external\_certificates\_offer\_url](#input\_external\_certificates\_offer\_url) | A Juju offer URL (e.g. admin/external-ca.certificates) of a CA providing the 'tls\_certificates' integration for Traefik to supply it with server certificates. | `string` | `null` | no |
@@ -77,7 +77,7 @@ terraform {
 }
 
 resource "juju_model" "cos" {
-  name = "cos-lite"
+  name = "cos"
 }
 
 module "cos-lite" {
diff --git a/terraform/cos-lite/integrations.tf b/terraform/cos-lite/integrations.tf
index 86f5b5f2..60fd5b07 100644
--- a/terraform/cos-lite/integrations.tf
+++ b/terraform/cos-lite/integrations.tf
@@ -233,7 +233,6 @@ resource "juju_integration" "ingress" {
   }
 }
 
-//TODO: Feature this in COS
 resource "juju_integration" "grafana_ingress" {
   count = var.ingress["grafana"] ? 1 : 0
 
diff --git a/terraform/cos-lite/upgrades.tf b/terraform/cos-lite/upgrades.tf
index 4989ff93..f9601e3c 100644
--- a/terraform/cos-lite/upgrades.tf
+++ b/terraform/cos-lite/upgrades.tf
@@ -1,19 +1,18 @@
-# -------------- # Application replace triggers -------------- #
+# -------------- # Replace triggers -------------- #
 
-# Grafana removed the litestream-image resource
-#   The litestream-image resource was removed and given a Juju bug, we need to add a lifecycle to
-#   trigger application replacement, otherwise the upgrade will fail
+# -- Grafana -- #
+
+# [application] Removed the litestream-image resource
+#   Given a Juju bug, we need to trigger application replacement, otherwise the upgrade will fail
 #   https://github.com/juju/juju/issues/21648
 #   https://github.com/juju/juju/issues/22071
 resource "terraform_data" "grafana_litestream_resource" {
   triggers_replace = contains(keys(data.juju_charm.grafana_info.resources), "litestream-image")
 }
 
-# -------------- # Integration replace triggers -------------- #
-
-# Grafana ingress interface changed
-#   The ingress endpoint interface changes from traefik_route to ingress_per_app so we need a
-#   lifecycle to trigger integration replacement, otherwise the upgrade will fail
+# [integration] Ingress interface changed
+#   The ingress endpoint interface changes from traefik_route to ingress_per_app so we need to
+#   trigger integration replacement, otherwise the upgrade will fail
 #   https://github.com/canonical/observability-stack/issues/165
 resource "terraform_data" "grafana_ingress_interface" {
   triggers_replace = data.juju_charm.grafana_info.requires["ingress"]
diff --git a/terraform/cos/README.md b/terraform/cos/README.md
index 68e2330d..de97ef34 100644
--- a/terraform/cos/README.md
+++ b/terraform/cos/README.md
@@ -32,7 +32,7 @@ This is a Terraform module facilitating the deployment of the COS solution, usin
 |------|-------------|------|---------|:--------:|
 | <a name="input_alertmanager"></a> [alertmanager](#input\_alertmanager) | Application configuration for Alertmanager. For more details: https://registry.terraform.io/providers/juju/juju/latest/docs/resources/application | <pre>object({<br/>    app_name           = optional(string, "alertmanager")<br/>    config             = optional(map(string), {})<br/>    constraints        = optional(string, "arch=amd64")<br/>    revision           = optional(number, null)<br/>    storage_directives = optional(map(string), {})<br/>    units              = optional(number, 1)<br/>  })</pre> | `{}` | no |
 | <a name="input_anti_affinity"></a> [anti\_affinity](#input\_anti\_affinity) | Enable anti-affinity constraints across all HA modules (Mimir, Loki, Tempo) | `bool` | `true` | no |
-| <a name="input_base"></a> [base](#input\_base) | The operating system on which to deploy. E.g. ubuntu@22.04. Changing this value for machine charms will trigger a replace by terraform. Check Charmhub for per-charm base support. | `string` | `"ubuntu@24.04"` | no |
+| <a name="input_base"></a> [base](#input\_base) | The operating system on which to deploy. E.g. ubuntu@24.04. Check Charmhub for per-charm base support. | `string` | `"ubuntu@24.04"` | no |
 | <a name="input_catalogue"></a> [catalogue](#input\_catalogue) | Application configuration for Catalogue. For more details: https://registry.terraform.io/providers/juju/juju/latest/docs/resources/application | <pre>object({<br/>    app_name           = optional(string, "catalogue")<br/>    config             = optional(map(string), {})<br/>    constraints        = optional(string, "arch=amd64")<br/>    revision           = optional(number, null)<br/>    storage_directives = optional(map(string), {})<br/>    units              = optional(number, 1)<br/>  })</pre> | `{}` | no |
 | <a name="input_cloud"></a> [cloud](#input\_cloud) | Kubernetes cloud or environment where this COS module will be deployed (e.g self-managed, aws) | `string` | `"self-managed"` | no |
 | <a name="input_external_ca_cert_offer_url"></a> [external\_ca\_cert\_offer\_url](#input\_external\_ca\_cert\_offer\_url) | A Juju offer URL (e.g. admin/external-ca.send-ca-cert) of a CA providing the 'certificate\_transfer' integration for applications to trust ingress via Traefik. | `string` | `null` | no |
diff --git a/terraform/cos/applications.tf b/terraform/cos/applications.tf
index deaec9aa..4dd990d5 100644
--- a/terraform/cos/applications.tf
+++ b/terraform/cos/applications.tf
@@ -23,7 +23,7 @@ module "catalogue" {
 }
 
 module "grafana" {
-  source             = "git::https://github.com/canonical/grafana-k8s-operator//terraform"
+  source             = "git::https://github.com/canonical/grafana-k8s-operator//terraform?ref=test/lifecycle-input"
   app_name           = var.grafana.app_name
   channel            = local.channels.grafana
   config             = var.grafana.config
diff --git a/terraform/cos/integrations.tf b/terraform/cos/integrations.tf
index f7f8576b..fed3efbf 100644
--- a/terraform/cos/integrations.tf
+++ b/terraform/cos/integrations.tf
@@ -292,11 +292,6 @@ resource "juju_integration" "ingress" {
         app_name = module.loki.app_names.loki_coordinator
         endpoint = module.loki.requires.ingress
       }
-      grafana = {
-        app_name = module.grafana.app_name
-        # TODO: move this out so I can add a lifecycle
-        endpoint = module.grafana.requires.ingress
-      }
     } : k => v if var.ingress[k]
   }
   model_uuid = var.model_uuid
@@ -312,6 +307,23 @@ resource "juju_integration" "ingress" {
   }
 }
 
+resource "juju_integration" "grafana_ingress" {
+  count = var.ingress["grafana"] ? 1 : 0
+
+  model_uuid = var.model_uuid
+
+  application {
+    name     = module.grafana.app_name
+    endpoint = module.grafana.requires.ingress
+  }
+
+  application {
+    name     = module.traefik.app_name
+    endpoint = module.traefik.endpoints.ingress
+  }
+
+  lifecycle { replace_triggered_by = [terraform_data.grafana_ingress_interface] }
+}
 
 resource "juju_integration" "traefik_route" {
   for_each = {
diff --git a/terraform/cos/offers.tf b/terraform/cos/offers.tf
index 5bb492ae..4aa51577 100644
--- a/terraform/cos/offers.tf
+++ b/terraform/cos/offers.tf
@@ -10,6 +10,8 @@ resource "juju_offer" "grafana_dashboards" {
   model_uuid       = var.model_uuid
   application_name = module.grafana.app_name
   endpoints        = ["grafana-dashboard"]
+
+  lifecycle { replace_triggered_by = [terraform_data.grafana_litestream_resource] }
 }
 
 resource "juju_offer" "loki_logging" {
diff --git a/terraform/cos/upgrades.tf b/terraform/cos/upgrades.tf
index df3d2028..274182d0 100644
--- a/terraform/cos/upgrades.tf
+++ b/terraform/cos/upgrades.tf
@@ -1,3 +1,23 @@
+# -------------- # Replace triggers -------------- #
+
+# -- Grafana -- #
+
+# [application] Removed the litestream-image resource
+#   Given a Juju bug, we need to trigger application replacement, otherwise the upgrade will fail
+#   https://github.com/juju/juju/issues/21648
+#   https://github.com/juju/juju/issues/22071
+resource "terraform_data" "grafana_litestream_resource" {
+  triggers_replace = contains(keys(data.juju_charm.grafana_info.resources), "litestream-image")
+}
+
+# [integration] Ingress interface changed
+#   The ingress endpoint interface changes from traefik_route to ingress_per_app so we need to
+#   trigger integration replacement, otherwise the upgrade will fail
+#   https://github.com/canonical/observability-stack/issues/165
+resource "terraform_data" "grafana_ingress_interface" {
+  triggers_replace = data.juju_charm.grafana_info.requires["ingress"]
+}
+
 # -------------- # CharmHub API -------------- #
 
 data "juju_charm" "alertmanager_info" {

From 16005168efcc5447a218d16b59d8675bf3d4da7e Mon Sep 17 00:00:00 2001
From: Michael Thamm <mike.thamm@canonical.com>
Date: Sat, 25 Apr 2026 23:52:05 -0400
Subject: [PATCH 03/10] chore

---
 tests/integration/cos/tls_external/track-2.tf |  2 +-
 .../integration/cos/tls_external/track-dev.tf |  2 +-
 tests/integration/cos/tls_full/track-2.tf     |  2 +-
 tests/integration/cos/tls_full/track-dev.tf   |  2 +-
 tests/integration/cos/tls_internal/track-2.tf |  2 +-
 .../integration/cos/tls_internal/track-dev.tf |  2 +-
 tests/integration/cos/tls_none/track-2.tf     |  2 +-
 tests/integration/cos/tls_none/track-dev.tf   |  2 +-
 .../cos_lite/tls_external/track-2.tf          |  2 +-
 .../cos_lite/tls_external/track-dev.tf        |  2 +-
 .../integration/cos_lite/tls_full/track-2.tf  |  2 +-
 .../cos_lite/tls_full/track-dev.tf            |  2 +-
 .../cos_lite/tls_internal/track-2.tf          |  2 +-
 .../cos_lite/tls_internal/track-dev.tf        |  2 +-
 .../test_upgrade_cos_lite_tls_none.py         | 32 -------------------
 .../integration/cos_lite/tls_none/track-2.tf  |  2 +-
 .../cos_lite/tls_none/track-dev.tf            |  2 +-
 17 files changed, 16 insertions(+), 48 deletions(-)
 delete mode 100644 tests/integration/cos_lite/tls_none/test_upgrade_cos_lite_tls_none.py

diff --git a/tests/integration/cos/tls_external/track-2.tf b/tests/integration/cos/tls_external/track-2.tf
index be32fe8f..39b05133 100644
--- a/tests/integration/cos/tls_external/track-2.tf
+++ b/tests/integration/cos/tls_external/track-2.tf
@@ -44,7 +44,7 @@ module "ssc" {
 }
 
 module "cos" {
-  source                          = "git::https://github.com/canonical/observability-stack//terraform/cos?ref=track/2"
+  source                          = "git::https://github.com/canonical/observability-stack//terraform/cos?ref=test/lifecycle-input-track-2"
   model_uuid                      = data.juju_model.cos-model.uuid
   channel                         = "2/stable"
   internal_tls                    = false
diff --git a/tests/integration/cos/tls_external/track-dev.tf b/tests/integration/cos/tls_external/track-dev.tf
index 2bbce072..8a58721f 100644
--- a/tests/integration/cos/tls_external/track-dev.tf
+++ b/tests/integration/cos/tls_external/track-dev.tf
@@ -44,7 +44,7 @@ module "ssc" {
 }
 
 module "cos" {
-  source                          = "git::https://github.com/canonical/observability-stack//terraform/cos"
+  source                          = "git::https://github.com/canonical/observability-stack//terraform/cos?ref=test/lifecycle-input"
   model_uuid                      = data.juju_model.cos-model.uuid
   risk                            = "edge"
   internal_tls                    = false
diff --git a/tests/integration/cos/tls_full/track-2.tf b/tests/integration/cos/tls_full/track-2.tf
index e1d350c0..11e02997 100644
--- a/tests/integration/cos/tls_full/track-2.tf
+++ b/tests/integration/cos/tls_full/track-2.tf
@@ -44,7 +44,7 @@ module "ssc" {
 }
 
 module "cos" {
-  source                          = "git::https://github.com/canonical/observability-stack//terraform/cos?ref=track/2"
+  source                          = "git::https://github.com/canonical/observability-stack//terraform/cos?ref=test/lifecycle-input-track-2"
   model_uuid                      = data.juju_model.cos-model.uuid
   channel                         = "2/stable"
   internal_tls                    = true
diff --git a/tests/integration/cos/tls_full/track-dev.tf b/tests/integration/cos/tls_full/track-dev.tf
index c66f7bc8..3cc03cb0 100644
--- a/tests/integration/cos/tls_full/track-dev.tf
+++ b/tests/integration/cos/tls_full/track-dev.tf
@@ -44,7 +44,7 @@ module "ssc" {
 }
 
 module "cos" {
-  source                          = "git::https://github.com/canonical/observability-stack//terraform/cos"
+  source                          = "git::https://github.com/canonical/observability-stack//terraform/cos?ref=test/lifecycle-input"
   model_uuid                      = data.juju_model.cos-model.uuid
   risk                            = "edge"
   internal_tls                    = true
diff --git a/tests/integration/cos/tls_internal/track-2.tf b/tests/integration/cos/tls_internal/track-2.tf
index b812dc55..473ff7a8 100644
--- a/tests/integration/cos/tls_internal/track-2.tf
+++ b/tests/integration/cos/tls_internal/track-2.tf
@@ -30,7 +30,7 @@ variable "s3_access_key" {
 }
 
 module "cos" {
-  source       = "git::https://github.com/canonical/observability-stack//terraform/cos?ref=track/2"
+  source       = "git::https://github.com/canonical/observability-stack//terraform/cos?ref=test/lifecycle-input-track-2"
   model_uuid   = data.juju_model.model.uuid
   channel      = "2/stable"
   internal_tls = true
diff --git a/tests/integration/cos/tls_internal/track-dev.tf b/tests/integration/cos/tls_internal/track-dev.tf
index f1a756dd..98b35c87 100644
--- a/tests/integration/cos/tls_internal/track-dev.tf
+++ b/tests/integration/cos/tls_internal/track-dev.tf
@@ -30,7 +30,7 @@ variable "s3_access_key" {
 }
 
 module "cos" {
-  source       = "git::https://github.com/canonical/observability-stack//terraform/cos"
+  source       = "git::https://github.com/canonical/observability-stack//terraform/cos?ref=test/lifecycle-input"
   model_uuid   = data.juju_model.model.uuid
   risk         = "edge"
   internal_tls = true
diff --git a/tests/integration/cos/tls_none/track-2.tf b/tests/integration/cos/tls_none/track-2.tf
index f7f4b42f..3a8dabf7 100644
--- a/tests/integration/cos/tls_none/track-2.tf
+++ b/tests/integration/cos/tls_none/track-2.tf
@@ -30,7 +30,7 @@ variable "s3_access_key" {
 }
 
 module "cos" {
-  source       = "git::https://github.com/canonical/observability-stack//terraform/cos?ref=track/2"
+  source       = "git::https://github.com/canonical/observability-stack//terraform/cos?ref=test/lifecycle-input-track-2"
   model_uuid   = data.juju_model.model.uuid
   channel      = "2/stable"
   internal_tls = false
diff --git a/tests/integration/cos/tls_none/track-dev.tf b/tests/integration/cos/tls_none/track-dev.tf
index 31e4ad06..12762804 100644
--- a/tests/integration/cos/tls_none/track-dev.tf
+++ b/tests/integration/cos/tls_none/track-dev.tf
@@ -30,7 +30,7 @@ variable "s3_access_key" {
 }
 
 module "cos" {
-  source       = "git::https://github.com/canonical/observability-stack//terraform/cos"
+  source       = "git::https://github.com/canonical/observability-stack//terraform/cos?ref=test/lifecycle-input"
   model_uuid   = data.juju_model.model.uuid
   risk         = "edge"
   internal_tls = false
diff --git a/tests/integration/cos_lite/tls_external/track-2.tf b/tests/integration/cos_lite/tls_external/track-2.tf
index 5e4f9bd6..7b482b3d 100644
--- a/tests/integration/cos_lite/tls_external/track-2.tf
+++ b/tests/integration/cos_lite/tls_external/track-2.tf
@@ -32,7 +32,7 @@ module "ssc" {
 }
 
 module "cos-lite" {
-  source                          = "git::https://github.com/canonical/observability-stack//terraform/cos-lite?ref=track/2"
+  source                          = "git::https://github.com/canonical/observability-stack//terraform/cos-lite?ref=test/lifecycle-input-track-2"
   model_uuid                      = data.juju_model.cos-model.uuid
   channel                         = "2/stable"
   internal_tls                    = false
diff --git a/tests/integration/cos_lite/tls_external/track-dev.tf b/tests/integration/cos_lite/tls_external/track-dev.tf
index 9552819f..19fca40c 100644
--- a/tests/integration/cos_lite/tls_external/track-dev.tf
+++ b/tests/integration/cos_lite/tls_external/track-dev.tf
@@ -32,7 +32,7 @@ module "ssc" {
 }
 
 module "cos-lite" {
-  source                          = "git::https://github.com/canonical/observability-stack//terraform/cos-lite"
+  source                          = "git::https://github.com/canonical/observability-stack//terraform/cos-lite?ref=test/lifecycle-input"
   model_uuid                      = data.juju_model.cos-model.uuid
   risk                            = "edge"
   internal_tls                    = false
diff --git a/tests/integration/cos_lite/tls_full/track-2.tf b/tests/integration/cos_lite/tls_full/track-2.tf
index e6efcbd4..8f0753e7 100644
--- a/tests/integration/cos_lite/tls_full/track-2.tf
+++ b/tests/integration/cos_lite/tls_full/track-2.tf
@@ -32,7 +32,7 @@ module "ssc" {
 }
 
 module "cos-lite" {
-  source                          = "git::https://github.com/canonical/observability-stack//terraform/cos-lite?ref=track/2"
+  source                          = "git::https://github.com/canonical/observability-stack//terraform/cos-lite?ref=test/lifecycle-input-track-2"
   model_uuid                      = data.juju_model.cos-model.uuid
   channel                         = "2/stable"
   internal_tls                    = true
diff --git a/tests/integration/cos_lite/tls_full/track-dev.tf b/tests/integration/cos_lite/tls_full/track-dev.tf
index 88f0f326..3152a530 100644
--- a/tests/integration/cos_lite/tls_full/track-dev.tf
+++ b/tests/integration/cos_lite/tls_full/track-dev.tf
@@ -32,7 +32,7 @@ module "ssc" {
 }
 
 module "cos-lite" {
-  source                          = "git::https://github.com/canonical/observability-stack//terraform/cos-lite"
+  source                          = "git::https://github.com/canonical/observability-stack//terraform/cos-lite?ref=test/lifecycle-input"
   model_uuid                      = data.juju_model.cos-model.uuid
   risk                            = "edge"
   internal_tls                    = true
diff --git a/tests/integration/cos_lite/tls_internal/track-2.tf b/tests/integration/cos_lite/tls_internal/track-2.tf
index d47fb0f7..fff40fa7 100644
--- a/tests/integration/cos_lite/tls_internal/track-2.tf
+++ b/tests/integration/cos_lite/tls_internal/track-2.tf
@@ -18,7 +18,7 @@ data "juju_model" "model" {
 }
 
 module "cos-lite" {
-  source       = "git::https://github.com/canonical/observability-stack//terraform/cos-lite?ref=track/2"
+  source       = "git::https://github.com/canonical/observability-stack//terraform/cos-lite?ref=test/lifecycle-input-track-2"
   model_uuid   = data.juju_model.model.uuid
   channel      = "2/stable"
   internal_tls = true
diff --git a/tests/integration/cos_lite/tls_internal/track-dev.tf b/tests/integration/cos_lite/tls_internal/track-dev.tf
index d18f5419..2909d490 100644
--- a/tests/integration/cos_lite/tls_internal/track-dev.tf
+++ b/tests/integration/cos_lite/tls_internal/track-dev.tf
@@ -18,7 +18,7 @@ data "juju_model" "model" {
 }
 
 module "cos-lite" {
-  source       = "git::https://github.com/canonical/observability-stack//terraform/cos-lite"
+  source       = "git::https://github.com/canonical/observability-stack//terraform/cos-lite?ref=test/lifecycle-input"
   model_uuid   = data.juju_model.model.uuid
   risk         = "edge"
   internal_tls = true
diff --git a/tests/integration/cos_lite/tls_none/test_upgrade_cos_lite_tls_none.py b/tests/integration/cos_lite/tls_none/test_upgrade_cos_lite_tls_none.py
deleted file mode 100644
index 505f9f01..00000000
--- a/tests/integration/cos_lite/tls_none/test_upgrade_cos_lite_tls_none.py
+++ /dev/null
@@ -1,32 +0,0 @@
-"""There are 2 sections of the COS deployment (internal and external) which can implement TLS
-communication. This python test file deploys COS without external and internal TLS.
-
-For more further TLS configuration details, refer to our documentation:
-https://documentation.ubuntu.com/observability/latest/how-to/configure-tls-encryption/"""
-
-from pathlib import Path
-
-from helpers import catalogue_apps_are_reachable, wait_for_active_idle_without_error
-
-import jubilant
-
-TRACK_2_TF_FILE = Path(__file__).parent.resolve() / "track-2.tf"
-TRACK_DEV_TF_FILE = Path(__file__).parent.resolve() / "track-dev.tf"
-
-
-def test_deploy_from_track_2(tf_manager, cos_model: jubilant.Juju):
-    # GIVEN a module deployed from track 2
-    tf_manager.init(TRACK_2_TF_FILE)
-    tf_manager.apply(model=cos_model.model)
-    wait_for_active_idle_without_error([cos_model], timeout=60 * 60)
-    catalogue_apps_are_reachable(cos_model)
-
-
-def test_deploy_to_track_dev(tf_manager, cos_model: jubilant.Juju):
-    # WHEN upgraded to track dev
-    tf_manager.init(TRACK_DEV_TF_FILE)
-    tf_manager.apply(model=cos_model.model)
-
-    # THEN the model is upgraded and is healthy
-    wait_for_active_idle_without_error([cos_model])
-    catalogue_apps_are_reachable(cos_model)
diff --git a/tests/integration/cos_lite/tls_none/track-2.tf b/tests/integration/cos_lite/tls_none/track-2.tf
index 6646e166..21a3435e 100644
--- a/tests/integration/cos_lite/tls_none/track-2.tf
+++ b/tests/integration/cos_lite/tls_none/track-2.tf
@@ -18,7 +18,7 @@ data "juju_model" "model" {
 }
 
 module "cos-lite" {
-  source       = "git::https://github.com/canonical/observability-stack//terraform/cos-lite?ref=track/2"
+  source       = "git::https://github.com/canonical/observability-stack//terraform/cos-lite?ref=test/lifecycle-input-track-2"
   model_uuid   = data.juju_model.model.uuid
   channel      = "2/stable"
   internal_tls = false
diff --git a/tests/integration/cos_lite/tls_none/track-dev.tf b/tests/integration/cos_lite/tls_none/track-dev.tf
index 6b79ffcc..0188d2cf 100644
--- a/tests/integration/cos_lite/tls_none/track-dev.tf
+++ b/tests/integration/cos_lite/tls_none/track-dev.tf
@@ -18,7 +18,7 @@ data "juju_model" "model" {
 }
 
 module "cos-lite" {
-  source       = "git::https://github.com/canonical/observability-stack//terraform/cos-lite?ref=feat/charmhub-module"
+  source       = "git::https://github.com/canonical/observability-stack//terraform/cos-lite?ref=test/lifecycle-input"
   model_uuid   = data.juju_model.model.uuid
   risk         = "edge"
   internal_tls = false

From fd6b120f40c8f74ffd7234abf7311bd0af3c1902 Mon Sep 17 00:00:00 2001
From: Michael Thamm <mike.thamm@canonical.com>
Date: Sun, 26 Apr 2026 00:34:45 -0400
Subject: [PATCH 04/10] chore

---
 terraform/cos-lite/offers.tf   | 2 --
 terraform/cos-lite/upgrades.tf | 2 +-
 terraform/cos/integrations.tf  | 6 +++++-
 terraform/cos/upgrades.tf      | 2 +-
 4 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/terraform/cos-lite/offers.tf b/terraform/cos-lite/offers.tf
index 66b67ca1..ca2456ca 100644
--- a/terraform/cos-lite/offers.tf
+++ b/terraform/cos-lite/offers.tf
@@ -9,8 +9,6 @@ resource "juju_offer" "grafana_dashboards" {
   name             = "grafana-dashboards"
   model_uuid       = var.model_uuid
   application_name = module.grafana.app_name
-  # TODO: Replace these with module.grafana.requires.grafana_dashboard in a tandem PR?
-  # TODO: and module.grafana.endpoints.grafana_dashboard in track/2?
   endpoints        = ["grafana-dashboard"]
 
   lifecycle { replace_triggered_by = [terraform_data.grafana_litestream_resource] }
diff --git a/terraform/cos-lite/upgrades.tf b/terraform/cos-lite/upgrades.tf
index f9601e3c..5e982ca6 100644
--- a/terraform/cos-lite/upgrades.tf
+++ b/terraform/cos-lite/upgrades.tf
@@ -15,7 +15,7 @@ resource "terraform_data" "grafana_litestream_resource" {
 #   trigger integration replacement, otherwise the upgrade will fail
 #   https://github.com/canonical/observability-stack/issues/165
 resource "terraform_data" "grafana_ingress_interface" {
-  triggers_replace = data.juju_charm.grafana_info.requires["ingress"]
+  triggers_replace = lookup(data.juju_charm.grafana_info.requires, "ingress", "")
 }
 
 # -------------- # CharmHub API -------------- #
diff --git a/terraform/cos/integrations.tf b/terraform/cos/integrations.tf
index fed3efbf..d4994558 100644
--- a/terraform/cos/integrations.tf
+++ b/terraform/cos/integrations.tf
@@ -31,6 +31,8 @@ resource "juju_integration" "grafana_dashboards" {
     name     = module.grafana.app_name
     endpoint = module.grafana.requires.grafana_dashboard
   }
+
+  lifecycle { replace_triggered_by = [terraform_data.grafana_litestream_resource] }
 }
 # -------------- # Charm Tracing ------------------------
 
@@ -128,6 +130,8 @@ resource "juju_integration" "grafana_sources" {
     name     = module.grafana.app_name
     endpoint = module.grafana.requires.grafana_source
   }
+
+  lifecycle { replace_triggered_by = [terraform_data.grafana_litestream_resource] }
 }
 
 # -------------- # Receive Loki Logs ---------------------
@@ -322,7 +326,7 @@ resource "juju_integration" "grafana_ingress" {
     endpoint = module.traefik.endpoints.ingress
   }
 
-  lifecycle { replace_triggered_by = [terraform_data.grafana_ingress_interface] }
+  lifecycle { replace_triggered_by = [terraform_data.grafana_ingress_interface, terraform_data.grafana_litestream_resource] }
 }
 
 resource "juju_integration" "traefik_route" {
diff --git a/terraform/cos/upgrades.tf b/terraform/cos/upgrades.tf
index 274182d0..41b79750 100644
--- a/terraform/cos/upgrades.tf
+++ b/terraform/cos/upgrades.tf
@@ -15,7 +15,7 @@ resource "terraform_data" "grafana_litestream_resource" {
 #   trigger integration replacement, otherwise the upgrade will fail
 #   https://github.com/canonical/observability-stack/issues/165
 resource "terraform_data" "grafana_ingress_interface" {
-  triggers_replace = data.juju_charm.grafana_info.requires["ingress"]
+  triggers_replace = lookup(data.juju_charm.grafana_info.requires, "ingress", "")
 }
 
 # -------------- # CharmHub API -------------- #

From 445486877a7a7adc14588dbd71f7d76af57574b3 Mon Sep 17 00:00:00 2001
From: Michael Thamm <mike.thamm@canonical.com>
Date: Sun, 26 Apr 2026 01:10:29 -0400
Subject: [PATCH 05/10] chore

---
 terraform/cos/integrations.tf | 39 ++++++++++++++++++++++++++++-------
 1 file changed, 31 insertions(+), 8 deletions(-)

diff --git a/terraform/cos/integrations.tf b/terraform/cos/integrations.tf
index d4994558..c68ac26f 100644
--- a/terraform/cos/integrations.tf
+++ b/terraform/cos/integrations.tf
@@ -46,10 +46,6 @@ resource "juju_integration" "charm_tracing" {
       app_name = module.loki.app_names.loki_coordinator
       endpoint = module.loki.requires.charm_tracing
     }
-    grafana = {
-      app_name = module.grafana.app_name
-      endpoint = module.grafana.requires.charm_tracing
-    }
   }
   model_uuid = var.model_uuid
 
@@ -64,6 +60,22 @@ resource "juju_integration" "charm_tracing" {
   }
 }
 
+resource "juju_integration" "charm_tracing_grafana" {
+  model_uuid = var.model_uuid
+
+  application {
+    name = module.grafana.app_name
+    endpoint = module.grafana.requires.charm_tracing
+  }
+
+  application {
+    name     = module.opentelemetry_collector.app_name
+    endpoint = module.opentelemetry_collector.provides.receive_traces
+  }
+
+  lifecycle { replace_triggered_by = [terraform_data.grafana_litestream_resource] }
+}
+
 # -------------- # Metrics Endpoint ----------------------
 resource "juju_integration" "otelcol_metrics_endpoint" {
   for_each = {
@@ -246,10 +258,6 @@ resource "juju_integration" "catalogue_integrations" {
       app_name = module.alertmanager.app_name
       endpoint = module.alertmanager.requires.catalogue
     }
-    grafana = {
-      app_name = module.grafana.app_name
-      endpoint = module.grafana.requires.catalogue
-    }
     tempo = {
       app_name = module.tempo.app_names.tempo_coordinator
       endpoint = module.tempo.requires.catalogue
@@ -273,6 +281,21 @@ resource "juju_integration" "catalogue_integrations" {
   }
 }
 
+resource "juju_integration" "catalogue_integration_grafana" {
+  model_uuid = var.model_uuid
+
+  application {
+    name     = module.catalogue.app_name
+    endpoint = module.catalogue.provides.catalogue
+  }
+
+  application {
+    name     = module.grafana.app_name
+    endpoint = module.grafana.requires.catalogue
+  }
+
+  lifecycle { replace_triggered_by = [terraform_data.grafana_litestream_resource] }
+}
 
 # -------------- # Provided by Traefik --------------
 

From 480f3cdde352a0ab584208d4a4ff6cbcecde6efa Mon Sep 17 00:00:00 2001
From: Michael Thamm <mike.thamm@canonical.com>
Date: Sun, 26 Apr 2026 19:47:17 -0400
Subject: [PATCH 06/10] chore

---
 .../tests/conditional_ingress.tftest.hcl      | 32 ++++++++++++++-----
 terraform/cos/README.md                       |  3 +-
 terraform/cos/integrations.tf                 |  2 +-
 .../cos/tests/conditional_ingress.tftest.hcl  | 32 ++++++++++++++-----
 4 files changed, 51 insertions(+), 18 deletions(-)

diff --git a/terraform/cos-lite/tests/conditional_ingress.tftest.hcl b/terraform/cos-lite/tests/conditional_ingress.tftest.hcl
index 64b1a7d4..29720b6d 100644
--- a/terraform/cos-lite/tests/conditional_ingress.tftest.hcl
+++ b/terraform/cos-lite/tests/conditional_ingress.tftest.hcl
@@ -8,8 +8,14 @@ run "default_ingress_all_enabled" {
   command = plan
 
   assert {
-    condition     = length(juju_integration.ingress) == 3
-    error_message = "Expected 3 ingress integrations (alertmanager, catalogue, grafana), got ${length(juju_integration.ingress)}"
+    condition     = length(juju_integration.ingress) == 2
+    error_message = "Expected 2 ingress integrations (alertmanager, catalogue), got ${length(juju_integration.ingress)}"
+  }
+
+  # Grafana uses a separate count-based resource due to lifecycle replace_triggered_by
+  assert {
+    condition     = length(juju_integration.grafana_ingress) == 1
+    error_message = "Expected 1 grafana_ingress integration, got ${length(juju_integration.grafana_ingress)}"
   }
 
   assert {
@@ -38,6 +44,11 @@ run "ingress_all_disabled" {
     error_message = "Expected 0 ingress integrations, got ${length(juju_integration.ingress)}"
   }
 
+  assert {
+    condition     = length(juju_integration.grafana_ingress) == 0
+    error_message = "Expected 0 grafana_ingress integrations, got ${length(juju_integration.grafana_ingress)}"
+  }
+
   assert {
     condition     = length(juju_integration.ingress_per_unit) == 0
     error_message = "Expected 0 ingress_per_unit integrations, got ${length(juju_integration.ingress_per_unit)}"
@@ -60,13 +71,13 @@ run "ingress_only_grafana" {
   }
 
   assert {
-    condition     = length(juju_integration.ingress) == 1
-    error_message = "Expected 1 ingress integration (grafana only), got ${length(juju_integration.ingress)}"
+    condition     = length(juju_integration.ingress) == 0
+    error_message = "Expected 0 ingress integrations, got ${length(juju_integration.ingress)}"
   }
 
   assert {
-    condition     = contains(keys(juju_integration.ingress), "grafana")
-    error_message = "Expected ingress to contain 'grafana' key"
+    condition     = length(juju_integration.grafana_ingress) == 1
+    error_message = "Expected 1 grafana_ingress integration, got ${length(juju_integration.grafana_ingress)}"
   }
 
   assert {
@@ -124,8 +135,8 @@ run "ingress_partial_override" {
   }
 
   assert {
-    condition     = length(juju_integration.ingress) == 2
-    error_message = "Expected 2 ingress integrations (catalogue, grafana), got ${length(juju_integration.ingress)}"
+    condition     = length(juju_integration.ingress) == 1
+    error_message = "Expected 1 ingress integration (catalogue), got ${length(juju_integration.ingress)}"
   }
 
   assert {
@@ -133,6 +144,11 @@ run "ingress_partial_override" {
     error_message = "Expected ingress to NOT contain 'alertmanager' key"
   }
 
+  assert {
+    condition     = length(juju_integration.grafana_ingress) == 1
+    error_message = "Expected 1 grafana_ingress integration, got ${length(juju_integration.grafana_ingress)}"
+  }
+
   assert {
     condition     = length(juju_integration.ingress_per_unit) == 1
     error_message = "Expected 1 ingress_per_unit integration (loki only), got ${length(juju_integration.ingress_per_unit)}"
diff --git a/terraform/cos/README.md b/terraform/cos/README.md
index de97ef34..65e7922d 100644
--- a/terraform/cos/README.md
+++ b/terraform/cos/README.md
@@ -11,6 +11,7 @@ This is a Terraform module facilitating the deployment of the COS solution, usin
 | Name | Version |
 |------|---------|
 | <a name="provider_juju"></a> [juju](#provider\_juju) | ~> 1.0 |
+| <a name="provider_terraform"></a> [terraform](#provider\_terraform) | n/a |
 
 ## Modules
 
@@ -18,7 +19,7 @@ This is a Terraform module facilitating the deployment of the COS solution, usin
 |------|--------|---------|
 | <a name="module_alertmanager"></a> [alertmanager](#module\_alertmanager) | git::https://github.com/canonical/alertmanager-k8s-operator//terraform | n/a |
 | <a name="module_catalogue"></a> [catalogue](#module\_catalogue) | git::https://github.com/canonical/catalogue-k8s-operator//terraform | n/a |
-| <a name="module_grafana"></a> [grafana](#module\_grafana) | git::https://github.com/canonical/grafana-k8s-operator//terraform | n/a |
+| <a name="module_grafana"></a> [grafana](#module\_grafana) | git::https://github.com/canonical/grafana-k8s-operator//terraform | test/lifecycle-input |
 | <a name="module_loki"></a> [loki](#module\_loki) | git::https://github.com/canonical/loki-operators//terraform | n/a |
 | <a name="module_mimir"></a> [mimir](#module\_mimir) | git::https://github.com/canonical/mimir-operators//terraform | n/a |
 | <a name="module_opentelemetry_collector"></a> [opentelemetry\_collector](#module\_opentelemetry\_collector) | git::https://github.com/canonical/opentelemetry-collector-k8s-operator//terraform | n/a |
diff --git a/terraform/cos/integrations.tf b/terraform/cos/integrations.tf
index c68ac26f..8d04181d 100644
--- a/terraform/cos/integrations.tf
+++ b/terraform/cos/integrations.tf
@@ -64,7 +64,7 @@ resource "juju_integration" "charm_tracing_grafana" {
   model_uuid = var.model_uuid
 
   application {
-    name = module.grafana.app_name
+    name     = module.grafana.app_name
     endpoint = module.grafana.requires.charm_tracing
   }
 
diff --git a/terraform/cos/tests/conditional_ingress.tftest.hcl b/terraform/cos/tests/conditional_ingress.tftest.hcl
index b4ff77a5..9faa57cd 100644
--- a/terraform/cos/tests/conditional_ingress.tftest.hcl
+++ b/terraform/cos/tests/conditional_ingress.tftest.hcl
@@ -13,8 +13,14 @@ run "default_ingress_all_enabled" {
   command = plan
 
   assert {
-    condition     = length(juju_integration.ingress) == 5
-    error_message = "Expected 5 ingress integrations (alertmanager, catalogue, grafana, loki, mimir), got ${length(juju_integration.ingress)}"
+    condition     = length(juju_integration.ingress) == 4
+    error_message = "Expected 4 ingress integrations (alertmanager, catalogue, loki, mimir), got ${length(juju_integration.ingress)}"
+  }
+
+  # Grafana uses a separate count-based resource due to lifecycle replace_triggered_by
+  assert {
+    condition     = length(juju_integration.grafana_ingress) == 1
+    error_message = "Expected 1 grafana_ingress integration, got ${length(juju_integration.grafana_ingress)}"
   }
 
   assert {
@@ -44,6 +50,11 @@ run "ingress_all_disabled" {
     error_message = "Expected 0 ingress integrations, got ${length(juju_integration.ingress)}"
   }
 
+  assert {
+    condition     = length(juju_integration.grafana_ingress) == 0
+    error_message = "Expected 0 grafana_ingress integrations, got ${length(juju_integration.grafana_ingress)}"
+  }
+
   assert {
     condition     = length(juju_integration.traefik_route) == 0
     error_message = "Expected 0 traefik_route integrations, got ${length(juju_integration.traefik_route)}"
@@ -67,13 +78,13 @@ run "ingress_only_grafana" {
   }
 
   assert {
-    condition     = length(juju_integration.ingress) == 1
-    error_message = "Expected 1 ingress integration (grafana only), got ${length(juju_integration.ingress)}"
+    condition     = length(juju_integration.ingress) == 0
+    error_message = "Expected 0 ingress integrations, got ${length(juju_integration.ingress)}"
   }
 
   assert {
-    condition     = contains(keys(juju_integration.ingress), "grafana")
-    error_message = "Expected ingress to contain 'grafana' key"
+    condition     = length(juju_integration.grafana_ingress) == 1
+    error_message = "Expected 1 grafana_ingress integration, got ${length(juju_integration.grafana_ingress)}"
   }
 
   assert {
@@ -127,8 +138,8 @@ run "ingress_partial_override" {
   }
 
   assert {
-    condition     = length(juju_integration.ingress) == 4
-    error_message = "Expected 4 ingress integrations (catalogue, grafana, loki, mimir), got ${length(juju_integration.ingress)}"
+    condition     = length(juju_integration.ingress) == 3
+    error_message = "Expected 3 ingress integrations (catalogue, loki, mimir), got ${length(juju_integration.ingress)}"
   }
 
   assert {
@@ -136,6 +147,11 @@ run "ingress_partial_override" {
     error_message = "Expected ingress to NOT contain 'alertmanager' key"
   }
 
+  assert {
+    condition     = length(juju_integration.grafana_ingress) == 1
+    error_message = "Expected 1 grafana_ingress integration, got ${length(juju_integration.grafana_ingress)}"
+  }
+
   assert {
     condition     = length(juju_integration.traefik_route) == 0
     error_message = "Expected 0 traefik_route integrations, got ${length(juju_integration.traefik_route)}"

From a8b56b51e7225330b87eb146cdbea5792cd4f834 Mon Sep 17 00:00:00 2001
From: Michael Thamm <mike.thamm@canonical.com>
Date: Mon, 27 Apr 2026 11:21:01 -0400
Subject: [PATCH 07/10] chore

---
 .../test_upgrade_cos_lite_tls_internal.py     | 32 +++++++++++++++++++
 1 file changed, 32 insertions(+)
 create mode 100644 tests/integration/cos_lite/tls_none/test_upgrade_cos_lite_tls_internal.py

diff --git a/tests/integration/cos_lite/tls_none/test_upgrade_cos_lite_tls_internal.py b/tests/integration/cos_lite/tls_none/test_upgrade_cos_lite_tls_internal.py
new file mode 100644
index 00000000..505f9f01
--- /dev/null
+++ b/tests/integration/cos_lite/tls_none/test_upgrade_cos_lite_tls_internal.py
@@ -0,0 +1,32 @@
+"""There are 2 sections of the COS deployment (internal and external) which can implement TLS
+communication. This python test file deploys COS without external and internal TLS.
+
+For more further TLS configuration details, refer to our documentation:
+https://documentation.ubuntu.com/observability/latest/how-to/configure-tls-encryption/"""
+
+from pathlib import Path
+
+from helpers import catalogue_apps_are_reachable, wait_for_active_idle_without_error
+
+import jubilant
+
+TRACK_2_TF_FILE = Path(__file__).parent.resolve() / "track-2.tf"
+TRACK_DEV_TF_FILE = Path(__file__).parent.resolve() / "track-dev.tf"
+
+
+def test_deploy_from_track_2(tf_manager, cos_model: jubilant.Juju):
+    # GIVEN a module deployed from track 2
+    tf_manager.init(TRACK_2_TF_FILE)
+    tf_manager.apply(model=cos_model.model)
+    wait_for_active_idle_without_error([cos_model], timeout=60 * 60)
+    catalogue_apps_are_reachable(cos_model)
+
+
+def test_deploy_to_track_dev(tf_manager, cos_model: jubilant.Juju):
+    # WHEN upgraded to track dev
+    tf_manager.init(TRACK_DEV_TF_FILE)
+    tf_manager.apply(model=cos_model.model)
+
+    # THEN the model is upgraded and is healthy
+    wait_for_active_idle_without_error([cos_model])
+    catalogue_apps_are_reachable(cos_model)

From eb4224b889727139e759cfff0bce04f3760aee0b Mon Sep 17 00:00:00 2001
From: Michael Thamm <mike.thamm@canonical.com>
Date: Mon, 27 Apr 2026 11:21:57 -0400
Subject: [PATCH 08/10] chore

---
 ...cos_lite_tls_internal.py => test_upgrade_cos_lite_tls_none.py} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename tests/integration/cos_lite/tls_none/{test_upgrade_cos_lite_tls_internal.py => test_upgrade_cos_lite_tls_none.py} (100%)

diff --git a/tests/integration/cos_lite/tls_none/test_upgrade_cos_lite_tls_internal.py b/tests/integration/cos_lite/tls_none/test_upgrade_cos_lite_tls_none.py
similarity index 100%
rename from tests/integration/cos_lite/tls_none/test_upgrade_cos_lite_tls_internal.py
rename to tests/integration/cos_lite/tls_none/test_upgrade_cos_lite_tls_none.py

From e9644c9c12c410eb5bd42d794d21c53b11ac67f2 Mon Sep 17 00:00:00 2001
From: Michael Thamm <mike.thamm@canonical.com>
Date: Mon, 27 Apr 2026 17:12:31 -0400
Subject: [PATCH 09/10] chore

---
 terraform/cos-lite/README.md       | 2 +-
 terraform/cos-lite/applications.tf | 2 +-
 terraform/cos/README.md            | 2 +-
 terraform/cos/applications.tf      | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/terraform/cos-lite/README.md b/terraform/cos-lite/README.md
index 43fcaa73..a36fdbd3 100644
--- a/terraform/cos-lite/README.md
+++ b/terraform/cos-lite/README.md
@@ -16,7 +16,7 @@ This is a Terraform module facilitating the deployment of the COS Lite solution,
 |------|--------|---------|
 | <a name="module_alertmanager"></a> [alertmanager](#module\_alertmanager) | git::https://github.com/canonical/alertmanager-k8s-operator//terraform | n/a |
 | <a name="module_catalogue"></a> [catalogue](#module\_catalogue) | git::https://github.com/canonical/catalogue-k8s-operator//terraform | n/a |
-| <a name="module_grafana"></a> [grafana](#module\_grafana) | git::https://github.com/canonical/grafana-k8s-operator//terraform | test/lifecycle-input |
+| <a name="module_grafana"></a> [grafana](#module\_grafana) | git::https://github.com/canonical/grafana-k8s-operator//terraform | n/a |
 | <a name="module_loki"></a> [loki](#module\_loki) | git::https://github.com/canonical/loki-k8s-operator//terraform | n/a |
 | <a name="module_prometheus"></a> [prometheus](#module\_prometheus) | git::https://github.com/canonical/prometheus-k8s-operator//terraform | n/a |
 | <a name="module_ssc"></a> [ssc](#module\_ssc) | git::https://github.com/canonical/self-signed-certificates-operator//terraform | n/a |
diff --git a/terraform/cos-lite/applications.tf b/terraform/cos-lite/applications.tf
index d2812316..d82b2f1b 100644
--- a/terraform/cos-lite/applications.tf
+++ b/terraform/cos-lite/applications.tf
@@ -23,7 +23,7 @@ module "catalogue" {
 }
 
 module "grafana" {
-  source             = "git::https://github.com/canonical/grafana-k8s-operator//terraform?ref=test/lifecycle-input"
+  source             = "git::https://github.com/canonical/grafana-k8s-operator//terraform"
   app_name           = var.grafana.app_name
   channel            = local.channels.grafana
   config             = var.grafana.config
diff --git a/terraform/cos/README.md b/terraform/cos/README.md
index 65e7922d..5722d857 100644
--- a/terraform/cos/README.md
+++ b/terraform/cos/README.md
@@ -19,7 +19,7 @@ This is a Terraform module facilitating the deployment of the COS solution, usin
 |------|--------|---------|
 | <a name="module_alertmanager"></a> [alertmanager](#module\_alertmanager) | git::https://github.com/canonical/alertmanager-k8s-operator//terraform | n/a |
 | <a name="module_catalogue"></a> [catalogue](#module\_catalogue) | git::https://github.com/canonical/catalogue-k8s-operator//terraform | n/a |
-| <a name="module_grafana"></a> [grafana](#module\_grafana) | git::https://github.com/canonical/grafana-k8s-operator//terraform | test/lifecycle-input |
+| <a name="module_grafana"></a> [grafana](#module\_grafana) | git::https://github.com/canonical/grafana-k8s-operator//terraform | n/a |
 | <a name="module_loki"></a> [loki](#module\_loki) | git::https://github.com/canonical/loki-operators//terraform | n/a |
 | <a name="module_mimir"></a> [mimir](#module\_mimir) | git::https://github.com/canonical/mimir-operators//terraform | n/a |
 | <a name="module_opentelemetry_collector"></a> [opentelemetry\_collector](#module\_opentelemetry\_collector) | git::https://github.com/canonical/opentelemetry-collector-k8s-operator//terraform | n/a |
diff --git a/terraform/cos/applications.tf b/terraform/cos/applications.tf
index 4dd990d5..deaec9aa 100644
--- a/terraform/cos/applications.tf
+++ b/terraform/cos/applications.tf
@@ -23,7 +23,7 @@ module "catalogue" {
 }
 
 module "grafana" {
-  source             = "git::https://github.com/canonical/grafana-k8s-operator//terraform?ref=test/lifecycle-input"
+  source             = "git::https://github.com/canonical/grafana-k8s-operator//terraform"
   app_name           = var.grafana.app_name
   channel            = local.channels.grafana
   config             = var.grafana.config

From 71d13b2be3544da2d4aa9226b2a75b41becc5eed Mon Sep 17 00:00:00 2001
From: Michael Thamm <mike.thamm@canonical.com>
Date: Mon, 27 Apr 2026 17:13:48 -0400
Subject: [PATCH 10/10] chore

---
 terraform/cos/applications.tf | 1 +
 1 file changed, 1 insertion(+)

diff --git a/terraform/cos/applications.tf b/terraform/cos/applications.tf
index deaec9aa..cc3c9460 100644
--- a/terraform/cos/applications.tf
+++ b/terraform/cos/applications.tf
@@ -32,6 +32,7 @@ module "grafana" {
   revision           = local.revisions.grafana
   storage_directives = var.grafana.storage_directives
   units              = var.grafana.units
+  replace_triggers   = [terraform_data.grafana_litestream_resource.id]
 }
 
 module "loki" {