refactor(tls): reload on tls_files_pushed instead of certificate_available#1864
Closed
marceloneppel wants to merge 14 commits into
Closed
refactor(tls): reload on tls_files_pushed instead of certificate_available#1864marceloneppel wants to merge 14 commits into
marceloneppel wants to merge 14 commits into
Conversation
Consume the single-kernel library's operator-certificate TLS handler (events.tls.TLS) and TLSManager instead of the charm-side src/relations/tls.py, stacked on the DPE-10062 Patroni/cluster port (#1788). The TLS events handler owns the two certificate requirers and is constructor-injected into TLSManager, whose live-fetch getters read cert/key from them. A charm-side reload bridge (_reload_tls_after_push) reloads PostgreSQL after the lib handler stores+pushes certs; it also fires on relation_broken so detaching the TLS operator re-renders Patroni with TLS disabled. Removes src/relations/tls.py and push_tls_files_to_workload (now owned by the lib), routes internal-cert regeneration through _regenerate_internal_cert, redirects the operator-cert getters to tls_manager, and pins the library to the TLS stack tip via archive URL (16.3.2 is not yet released). Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com>
The TLS lib stack was rebased onto current 16/edge and re-bumped to 16.3.3 because 16/edge had meanwhile shipped its own 16.3.2, and the rebase dropped the dead workload parameter from the TLS events handler constructor, so the pin and the construction call move together. Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com>
The relation_broken bridge registrations reference only self.on[...], so an __init__ reorder above the lib handler's construction would silently run the reload before the lib clears state and pushes files; the prior test asserted membership without order. The bridge's except-and-defer branch also had no coverage, so a refactor could drop the broad guard without failing CI. Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com>
Absorb the single remaining 16/edge commit (ca93296: renovate bump to published single-kernel 16.3.2) since the branch last merged 16/edge. #1788 (Patroni-port) and the 5a9fa05 lib pin / 2-arg TLS migration are already on this branch. Keep the branch's unreleased-lib archive-URL pin (5a9fa05) over 16/edge's published-16.3.2 dep, since this branch tests the unreleased TLS handler. Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com> # Conflicts: # poetry.lock # pyproject.toml
Absorb 16/edge deps bumps (946cb61: Python deps, 24a7609: lock maintenance) landed since the last merge. Keep the branch's unreleased-lib archive-URL pin (5a9fa05) over 16/edge's published-16.3.2 dep, since this branch tests the unreleased TLS handler. Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com> # Conflicts: # poetry.lock
Re-pin the unreleased single-kernel library from 5a9fa05 to a1d2178, the rebased TLS-stack tip. a1d2178 includes the operator-cert manager/ events handler (the migration payload) plus the docstring/comment cleanup that dropped stale operator-repo file-path references and #168/V3-V4 idiom mentions from the lib. The 5a9fa05→a1d2178 diff is docstring/comment-only, so no charm-side code changes are required. Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com>
Remove _platform_machine, _observers_for, and the three reload-bridge observer-ordering tests that exercised charm-side __init__ wiring now that the bridge itself is transitional and scheduled to leave the charm when update_config ports to the lib. _platform_machine was redundant: refresh_versions.toml keys both x86_64 and aarch64, so the platform.machine() snap-revision lookup succeeds natively on either arch without the monkeypatch (proven by the suite passing on aarch64 after removal). Its harness dependency and the now-unused TLS_CLIENT/TLS_PEER_RELATION imports go with it. Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com>
The TLS flip branch pinned postgresql-charms-single-kernel to a GitHub archive URL (commit a1d2178) to test unreleased lib changes. 16.3.3 is now published to PyPI carrying the same TLS state + manager/events content, so restore the published-version pin form and regenerate poetry.lock against the PyPI wheel/tarball. Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com>
Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com> # Conflicts: # poetry.lock
Point the charm at the lib PR-stack tip (08f5993) via its GitHub archive tarball so the migrated update_config subsystem can be exercised by the charm's own unit suite before the lib is released. The pin is provisional and swaps to a released version once the lib stack lands. Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com>
The single-kernel library now owns update_config end to end: parameter building, worker-process calculation, Patroni API patching, restart-need handling, and Patroni template rendering. Keeping the charm's copy of that logic would mean maintaining two implementations of the same behaviour, so the charm delegates to the lib's ConfigManager and its own copies (worker-calc helpers, _api_update_config, _handle_postgresql_restart_need, get_available_memory, generate_config_hash, is_restart_pending, and the charm-local Patroni template) are removed. Tests for the deleted methods are dropped rather than re-pointed at the lib, since the lib is a faithful behaviour-preserving port and their coverage now lives there; re-asserting the same behaviour charm-side would just be duplicated coverage. The three new bridge methods (request_restart, refresh_endpoints, restart_services) that the lib calls back into, plus the update_config delegation itself, get their own tests since this is new charm-side wiring with no prior coverage. Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com>
The lib's update_config stack was rebased to add the ported regression tests (resource-introspection edges + the enable_tls render assertion), orphaning the old tip 08f5993. Point the archive pin at the new #180 tip; the installed lib source is unchanged from 08f5993 — only lib test files were added. Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com>
Reconcile the update_config adoption with 16/edge (now carrying the merged VM TLS migration): keep the seven-arg lib ConfigManager delegation after the TLS manager, and re-pin the single-kernel lib to 912b1a4 -- the update_config stack's head after the tests split (the previous 40752dd pin was orphaned by that rewrite). Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com>
…lable The lib TLS handler now emits tls_files_pushed after a successful cert push. Observe that single event instead of certificate_available/relation_broken on both requirers, and drop the two guards (internal-ca present, cert files on disk) the bridge duplicated from the handler: the event fires only once the push has landed, so a deferred push no longer lets the bridge reload against stale files. Re-pin the lib to the commit that adds the event. Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com>
github-actions
Bot
added
the
Libraries: Out of sync
marceloneppel
force-pushed
the
skl-01-adopt-update-config
branch
from
July 20, 2026 19:13
2abf30d to
8d2f8c8
Compare
Member
Author
|
Folded into #1849: the TLS |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue
The lib TLS handler pushes cert files to the workload on
certificate_available, and this charm reloads PostgreSQL in a separate observer of the same event.deferis per-observer, so a push that defers (e.g. a Pebble write fails during a cert renewal) while the reload observer completes leaves the retried push writing the new cert with nothing reloading — the reload ran against the stale on-disk files and won't run again. The bridge also duplicated the handler's two readiness guards and relied on ops observer ordering. Raised in review on the TLS migration.Solution
The lib now emits a
tls_files_pushedevent after a successful push (canonical/postgresql-single-kernel-library#189). Observe that single event instead of the fourcertificate_available/relation_brokenobservers, and drop the two guards (internal-capresent,client_tls_files_on_disk()): the event fires only once the files are on disk, so a deferred push no longer triggers a reload against files that were never written, and the observer-order dependency is gone. Re-pin the lib to the commit that adds the event.Stacked on the update_config adoption.
Checklist