mongo-charms-single-kernel 1.8.6__py3-none-any.whl → 1.8.7__py3-none-any.whl

single_kernel_mongo/core/vm_workload.py

@@ -9,18 +9,18 @@ from collections.abc import Mapping
 from itertools import chain
 from logging import getLogger
 from pathlib import Path
+from platform import machine
 from shutil import copyfile
 
 from ops import Container
-from tenacity import retry, retry_if_result, stop_after_attempt, wait_fixed
+from tenacity import retry, retry_if_exception_type, retry_if_result, stop_after_attempt, wait_fixed
 from typing_extensions import override
 
 from single_kernel_mongo.config.literals import (
     CRON_FILE,
-    SNAP,
     VmUser,
 )
-from single_kernel_mongo.config.models import CharmSpec
+from single_kernel_mongo.config.models import SNAP_NAME, CharmSpec
 from single_kernel_mongo.core.workload import WorkloadBase
 from single_kernel_mongo.exceptions import (
     WorkloadExecError,
@@ -41,8 +41,7 @@ class VMWorkload(WorkloadBase):
 
     def __init__(self, role: CharmSpec, container: Container | None) -> None:
         super().__init__(role, container)
-        self.snap = SNAP
-        self.mongod_snap = snap.SnapCache()[self.snap.name]
+        self.mongod_snap = snap.SnapCache()[SNAP_NAME]
 
     @property
     @override
@@ -186,23 +185,41 @@ class VMWorkload(WorkloadBase):
         stop=stop_after_attempt(20),
         wait=wait_fixed(1),
         reraise=True,
+        retry=retry_if_exception_type(WorkloadServiceError),
     )
-    def install(self) -> None:
-        """Loads the MongoDB snap from LP.
+    def install(self, revision: str | None = None, retry_and_raise: bool = True) -> bool:
+        """Install the charmed-mongodb snap from the snap store.
+
+        Args:
+            revision (str | None): the snap revision to install. Will be loaded from the
+                `refresh_versions.toml` file if None.
+            retry_and_raise (bool): whether to retry in case of errors. Will raise if the error
+                persists.
 
         Returns:
-            True if successfully installed. False otherwise.
+            True if successfully installed, False if errors occur and `retry_and_raise` is False.
         """
         try:
+            if not revision:
+                versions = self.load_toml_file(Path("refresh_versions.toml"))
+                revision = versions["snap"]["revisions"][machine()]
+
             self.mongod_snap.ensure(
-                snap.SnapState.Latest,
-                channel=self.snap.channel,
-                revision=self.snap.revision,
+                snap.SnapState.Present,
+                revision=revision,
             )
             self.mongod_snap.hold()
+            return True
         except snap.SnapError as err:
-            logger.error(f"Failed to install {self.snap.name}. Reason: {err}.")
-            raise WorkloadNotReadyError("Failed to install mongodb")
+            logger.error(f"Failed to install {SNAP_NAME}. Reason: {err}.")
+            if retry_and_raise:
+                raise WorkloadNotReadyError("Failed to install mongodb")
+            return False
+
+    @override
+    def snap_revision(self) -> str:
+        """The currently installed snap_revision."""
+        return self.mongod_snap.revision
 
     @override
     def setup_cron(self, lines: list[str]) -> None:  # pragma: nocover

single_kernel_mongo/core/workload.py

@@ -9,12 +9,13 @@ import string
 from abc import ABC, abstractmethod
 from itertools import chain
 from pathlib import Path
-from typing import ClassVar
+from typing import Any, ClassVar
 
+import tomllib
 from ops import Container
 from ops.pebble import Layer
 
-from single_kernel_mongo.config.literals import WorkloadUser
+from single_kernel_mongo.config.literals import VERSIONS_FILE, WorkloadUser
 from single_kernel_mongo.config.models import CharmSpec
 
 
@@ -149,7 +150,7 @@ class WorkloadBase(ABC):  # pragma: nocover
         self.role = role
 
     @abstractmethod
-    def install(self) -> None:
+    def install(self, revision: str | None = None, retry_and_raise: bool = True) -> bool:
         """Installs the workload snap or raises an error.
 
         VM-only: on k8s, just returns None.
@@ -283,6 +284,17 @@ class WorkloadBase(ABC):  # pragma: nocover
         """
         ...
 
+    def snap_revision(self) -> str:
+        """The currently installed snap_revision."""
+        return ""
+
+    def load_toml_file(self, file: Path) -> dict[str, Any]:
+        """Loads a TOML file to a dictionary."""
+        if not file.exists():
+            return {}
+
+        return tomllib.loads(file.read_text())
+
     def get_version(self) -> str:
         """Get the workload version.
 
@@ -295,21 +307,6 @@ class WorkloadBase(ABC):  # pragma: nocover
             version = ""
         return version
 
-    def get_internal_revision(self) -> str:
-        """Get the internal revision.
-
-        Note: This should be removed soon because we're moving away from `charm
-        version` + `internal revision` to `charm_version+git hash`.
-
-        Returns:
-            String of charm internal revision
-        """
-        try:
-            version = Path("charm_version").read_text().strip()
-        except:  # noqa: E722
-            version = ""
-        return version
-
     def get_charm_revision(self) -> str:
         """Get the charm revision.
 
@@ -317,7 +314,8 @@ class WorkloadBase(ABC):  # pragma: nocover
             String of charm revision
         """
         try:
-            version = Path("charm_version").read_text().strip()
+            versions = self.load_toml_file(VERSIONS_FILE)
+            version = versions["charm"]
         except:  # noqa: E722
             version = ""
         return version

single_kernel_mongo/events/backups.py

@@ -79,7 +79,7 @@ class BackupEventsHandler(Object):
 
     def _on_s3_relation_joined(self, event: RelationJoinedEvent) -> None:
         """Checks for valid integration for s3-integrations."""
-        if self.dependent.state.upgrade_in_progress:
+        if self.dependent.refresh_in_progress:
             logger.warning(
                 "Adding s3-relations is not supported during an upgrade. The charm may be in a broken, unrecoverable state."
             )
@@ -97,7 +97,7 @@ class BackupEventsHandler(Object):
 
     def _on_s3_credential_changed(self, event: CredentialsChangedEvent) -> None:  # noqa: C901
         action = "configure-pbm"
-        if self.dependent.state.upgrade_in_progress:
+        if self.dependent.refresh_in_progress:
             logger.warning(
                 "Changing s3-credentials is not supported during an upgrade. The charm may be in a broken, unrecoverable state."
             )
@@ -285,7 +285,7 @@ class BackupEventsHandler(Object):
             )
             return
 
-        if self.dependent.state.upgrade_in_progress:
+        if self.dependent.refresh_in_progress:
             fail_action_with_error_log(
                 logger,
                 event,

single_kernel_mongo/events/cluster.py

@@ -72,7 +72,7 @@ class ClusterConfigServerEventHandler(Object):
         Calls the manager to share the secrets with mongos charm.
         """
         try:
-            self.manager.share_secret_to_mongos(event.relation)
+            self.manager.share_secret_to_mongos(event.relation, initial_event=True)
         except DeferrableFailedHookChecksError as e:
             logger.info("Skipping database requested event: hook checks did not pass.")
             defer_event_with_info_log(logger, event, str(type(event)), str(e))

single_kernel_mongo/events/database.py

@@ -138,7 +138,7 @@ class DatabaseEventsHandler(Object):
         if not self.charm.unit.is_leader():
             return False
 
-        if self.dependent.state.upgrade_in_progress:
+        if self.dependent.refresh_in_progress:
             logger.warning(
                 "Adding relations is not supported during an upgrade. The charm may be in a broken, unrecoverable state."
             )

single_kernel_mongo/events/lifecycle.py

@@ -130,9 +130,10 @@ class LifecycleEventsHandler(Object):
         """Start event."""
         try:
             self.dependent.prepare_for_startup()
-        except (ContainerNotReadyError, WorkloadServiceError):
-            logger.info("Not ready to start.")
-            event.defer()
+        except (ContainerNotReadyError, WorkloadServiceError) as e:
+            defer_event_with_info_log(
+                logger, event, "start", f"Not ready to start: {e.__class__.__name__}({e})"
+            )
             return
         except InvalidConfigRoleError:
             logger.info("Missing a valid role.")
@@ -222,7 +223,7 @@ class LifecycleEventsHandler(Object):
                 secret_id=event.secret.id or "",
             )
         except (WorkloadServiceError, ChangeError) as err:
-            logger.info("Failed to restart services", err, exc_info=True)
+            logger.info("Failed to restart services: %s", err, exc_info=True)
             self.dependent.state.statuses.add(
                 CharmStatuses.FAILED_SERVICES_START.value,
                 scope="unit",

single_kernel_mongo/events/tls.py

@@ -77,7 +77,7 @@ class TLSEventsHandler(Object):
             )
             event.fail("Mongos cannot set TLS keys until integrated to config-server.")
             return
-        if self.manager.state.upgrade_in_progress:
+        if self.dependent.refresh_in_progress:
             fail_action_with_error_log(
                 logger,
                 event,
@@ -106,7 +106,8 @@ class TLSEventsHandler(Object):
             )
             event.defer()
             return
-        if self.manager.state.upgrade_in_progress:
+
+        if self.dependent.refresh_in_progress:
             logger.warning(
                 "Enabling TLS is not supported during an upgrade. The charm may be in a broken, unrecoverable state."
             )
@@ -131,7 +132,7 @@ class TLSEventsHandler(Object):
             event.defer()
             return
 
-        if self.manager.state.upgrade_in_progress:
+        if self.dependent.refresh_in_progress:
             logger.warning(
                 "Disabling TLS is not supported during an upgrade. The charm may be in a broken, unrecoverable state."
             )
@@ -162,7 +163,9 @@ class TLSEventsHandler(Object):
             logger.info(f"Deferring {str(type(event))}: db is not initialised")
             event.defer()
             return
-        if self.manager.state.upgrade_in_progress:
+        # Check if refresh is in progress and this is the initial integration, delay.
+        # Otherwise it's a rotation and we're safe to continue.
+        if self.dependent.refresh_in_progress and self.manager.initial_integration():
             logger.warning(
                 "Enabling TLS is not supported during an upgrade. The charm may be in a broken, unrecoverable state."
             )

single_kernel_mongo/exceptions.py

@@ -4,10 +4,6 @@
 
 """All general exceptions."""
 
-from data_platform_helpers.advanced_statuses.models import StatusObject
-
-from single_kernel_mongo.config.statuses import UpgradeStatuses
-
 
 class InvalidCharmKindError(Exception):
     """Raised when calling a function on the wrong charm kind."""
@@ -122,6 +118,10 @@ class UpgradeInProgressError(Exception):
     """Raised when an upgrade is in progress."""
 
 
+class MongoDBUpgradeError(Exception):
+    """Raised when the snap upgrade fails."""
+
+
 class OpenPortFailedError(Exception):
     """Raised when we fail to open ports."""
 
@@ -209,22 +209,6 @@ class EarlyRemovalOfConfigServerError(Exception):
     """Raised when we try to remove config server while it still has shards."""
 
 
-class StatusError(Exception):
-    """Exception with ops status."""
-
-    def __init__(self, status: StatusObject) -> None:
-        super().__init__(status.message)
-        self.status = status
-
-
-class PrecheckFailedError(StatusError):
-    """App is not ready to upgrade."""
-
-    def __init__(self, message: str):
-        self.message = message
-        super().__init__(UpgradeStatuses.REFRESH_IN_PROGRESS.value)
-
-
 class FailedToElectNewPrimaryError(Exception):
     """Raised when a new primary isn't elected after stepping down."""
 
@@ -249,10 +233,6 @@ class ActionFailedError(Exception):
     """Raised when we failed an action."""
 
 
-class UnhealthyUpgradeError(Exception):
-    """Raised when the upgrade is unhealthy during an post upgrade check."""
-
-
 class WaitingForLdapDataError(DeferrableError):
     """Raised when the charm hasn't received data from ldap yet."""
 

single_kernel_mongo/managers/cluster.py

@@ -59,7 +59,7 @@ class ClusterProvider(Object):
         self.relation_name = relation_name
         self.data_interface = self.state.cluster_provider_data_interface
 
-    def assert_pass_hook_checks(self) -> None:
+    def assert_pass_hook_checks(self, initial_event: bool = False) -> None:
         """Runs the pre hook checks, raises if it fails."""
         if not self.state.db_initialised:
             raise DeferrableFailedHookChecksError("DB is not initialised")
@@ -77,7 +77,7 @@ class ClusterProvider(Object):
         if not self.charm.unit.is_leader():
             raise NonDeferrableFailedHookChecksError("Not leader")
 
-        if self.state.upgrade_in_progress:
+        if self.dependent.refresh_in_progress and initial_event:
             raise DeferrableFailedHookChecksError(
                 "Processing mongos applications is not supported during an upgrade. The charm may be in a broken, unrecoverable state."
             )
@@ -88,12 +88,12 @@ class ClusterProvider(Object):
         # we don't have any cluster relation.
         return self.state.is_role(MongoDBRoles.CONFIG_SERVER) or not self.state.cluster_relations
 
-    def share_secret_to_mongos(self, relation: Relation) -> None:
+    def share_secret_to_mongos(self, relation: Relation, initial_event: bool = False) -> None:
         """Handles the database requested event.
 
         The first time secrets are written to relations should be on this event.
         """
-        self.assert_pass_hook_checks()
+        self.assert_pass_hook_checks(initial_event=initial_event)
 
         config_server_db = self.state.generate_config_server_db()
         self.dependent.mongo_manager.reconcile_mongo_users_and_dbs(relation)
@@ -133,7 +133,7 @@ class ClusterProvider(Object):
         If it has departed, we run some checks and if we are a VM charm, we
         proceed to reconcile the users and DB and cleanup mongoDB.
         """
-        if self.state.upgrade_in_progress:
+        if self.dependent.refresh_in_progress:
             logger.warning(
                 "Removing integration to mongos is not supported during an upgrade. The charm may be in a broken, unrecoverable state."
             )
@@ -269,8 +269,8 @@ class ClusterRequirer(Object):
             raise DeferrableFailedHookChecksError(
                 "Mongos was waiting for config-server to enable TLS. Wait for TLS to be enabled until starting mongos."
             )
-        if self.state.upgrade_in_progress:
-            raise DeferrableFailedHookChecksError(
+        if self.dependent.refresh_in_progress:
+            logger.warning(
                 "Processing client applications is not supported during an upgrade. The charm may be in a broken, unrecoverable state."
             )
 
@@ -290,7 +290,7 @@ class ClusterRequirer(Object):
         """
         if not username or not password:
             raise WaitingForSecretsError
-        if self.state.upgrade_in_progress:
+        if self.dependent.refresh_in_progress:
             logger.warning(
                 "Processing client applications is not supported during an upgrade. The charm may be in a broken, unrecoverable state."
             )

single_kernel_mongo/managers/config.py

@@ -18,7 +18,6 @@ from typing_extensions import override
 from yaml import safe_dump, safe_load
 
 from single_kernel_mongo.config.literals import (
-    LOCALHOST,
     PBM_RESTART_DELAY,
     CharmKind,
     MongoPorts,
@@ -343,6 +342,9 @@ class MongoConfigManager(FileBasedConfigManager, ABC):
                             "allowInvalidCertificates": True,
                             "clusterCAFile": f"{self.workload.paths.int_ca_file}",
                             "clusterFile": f"{self.workload.paths.int_pem_file}",
+                            "clusterAuthX509": {
+                                "attributes": f"O={self.state.get_subject_name()}",
+                            },
                         }
                     },
                 },
@@ -366,7 +368,7 @@ class MongoConfigManager(FileBasedConfigManager, ABC):
                     "tls": {
                         "CAFile": f"{self.workload.paths.ext_ca_file}",
                         "certificateKeyFile": f"{self.workload.paths.ext_pem_file}",
-                        "mode": "preferTLS",
+                        "mode": "requireTLS",
                         "disabledProtocols": "TLS1_0,TLS1_1",
                     }
                 },
@@ -494,7 +496,7 @@ class MongosConfigManager(MongoConfigManager):
             return {"sharding": {"configDB": uri}}
         return {
             "sharding": {
-                "configDB": f"{self.state.app_peer_data.replica_set}/{LOCALHOST}:{MongoPorts.MONGODB_PORT.value}"
+                "configDB": f"{self.state.app_peer_data.replica_set}/{self.state.unit_peer_data.internal_address}:{MongoPorts.MONGODB_PORT.value}"
             }
         }
 

single_kernel_mongo/managers/ldap.py

@@ -76,7 +76,8 @@ class LDAPManager(Object, ManagerStatusProtocol):
             raise DeferrableFailedHookChecksError("DB is not initialised")
         if self.state.is_role(MongoDBRoles.SHARD):
             raise InvalidLdapWithShardError("Cannot integrate LDAP with shard.")
-        if self.state.upgrade_in_progress:
+        # Defer upon regular integration, but let's continue on an update.
+        if self.dependent.refresh_in_progress and not self.state.ldap.is_ready():
             raise DeferrableFailedHookChecksError(
                 "Adding LDAP is not supported during an upgrade. The charm may be in a broken, unrecoverable state."
             )

single_kernel_mongo/managers/mongo.py

@@ -14,6 +14,7 @@ from __future__ import annotations
 import json
 import logging
 from typing import TYPE_CHECKING
+from urllib.parse import urlencode
 
 from dacite import from_dict
 from data_platform_helpers.advanced_statuses.models import StatusObject
@@ -27,6 +28,7 @@ from pymongo.errors import (
     PyMongoError,
     ServerSelectionTimeoutError,
 )
+from tenacity import Retrying, stop_after_attempt, wait_fixed
 
 from single_kernel_mongo.config.literals import MongoPorts, Substrates
 from single_kernel_mongo.config.statuses import CharmStatuses, MongodStatuses
@@ -34,6 +36,7 @@ from single_kernel_mongo.core.structured_config import MongoDBRoles
 from single_kernel_mongo.exceptions import (
     DatabaseRequestedHasNotRunYetError,
     DeployedWithoutTrustError,
+    FailedToElectNewPrimaryError,
     MissingCredentialsError,
     SetPasswordError,
 )
@@ -97,9 +100,15 @@ class MongoManager(Object, ManagerStatusProtocol):
         Pass direct=True, when checking if a *single replica* is ready.
         Pass direct=False, when checking if the entire replica set is ready
         """
-        if not uri and self.state.is_role(MongoDBRoles.MONGOS):
-            uri = f"localhost:{MongoPorts.MONGOS_PORT.value}"
-        actual_uri = uri or "localhost"
+        port = (
+            MongoPorts.MONGOS_PORT.value
+            if self.state.is_role(MongoDBRoles.MONGOS)
+            else MongoPorts.MONGODB_PORT.value
+        )
+        params = self.state.operator_config.tls_config
+
+        actual_uri = uri or f"mongodb://localhost:{port}"
+        actual_uri = f"{actual_uri}/?{urlencode(params)}"
         with MongoConnection(EMPTY_CONFIGURATION, actual_uri, direct=direct) as direct_mongo:
             return direct_mongo.is_ready
 
@@ -265,7 +274,7 @@ class MongoManager(Object, ManagerStatusProtocol):
                 return
 
             data_interface.set_endpoints(relation.id, ",".join(sorted(config.hosts)))
-            data_interface.set_uris(relation.id, config.uri)
+            data_interface.set_uris(relation.id, config.uri_without_tls)
 
             if not self.state.is_role(MongoDBRoles.MONGOS):
                 data_interface.set_replset(
@@ -390,10 +399,10 @@ class MongoManager(Object, ManagerStatusProtocol):
                 relation.id,
                 ",".join(sorted(config.hosts)),
             )
-        if config.uri != uris:
+        if config.uri_without_tls != uris:
             data_interface.set_uris(
                 relation.id,
-                config.uri,
+                config.uri_without_tls,
             )
         if config.database != database:
             data_interface.set_database(
@@ -421,8 +430,7 @@ class MongoManager(Object, ManagerStatusProtocol):
             "password": password,
             "hosts": self.state.app_hosts,
             "roles": set(roles.split(",")),
-            "tls_external": False,
-            "tls_internal": False,
+            "tls_enabled": False,
             "port": self.state.host_port,
         }
         if not self.state.is_role(MongoDBRoles.MONGOS):
@@ -466,7 +474,7 @@ class MongoManager(Object, ManagerStatusProtocol):
 
             for member in config_hosts - replset_members:
                 logger.debug("Adding %s to replica set", member)
-                if not self.mongod_ready(uri=member):
+                if not self.mongod_ready(uri=f"mongodb://{member}"):
                     logger.debug("not reconfiguring: %s is not ready yet.", member)
                     raise NotReadyError
                 mongo.add_replset_member(member)
@@ -555,3 +563,34 @@ class MongoManager(Object, ManagerStatusProtocol):
             return [MongodStatuses.WAITING_RECONFIG.value]
 
         return charm_statuses
+
+    def set_feature_compatibility_version(self, feature_version: str) -> None:
+        """Sets the mongos feature compatibility version."""
+        if self.state.is_role(MongoDBRoles.REPLICATION):
+            config = self.state.mongo_config
+        elif self.state.is_role(MongoDBRoles.CONFIG_SERVER):
+            config = self.state.mongos_config
+        else:
+            return
+        with MongoConnection(config) as mongos:
+            mongos.client.admin.command(
+                "setFeatureCompatibilityVersion", value=feature_version, confirm=True
+            )
+
+    def step_down_primary_and_wait_reelection(self):
+        """Steps down the current primary and waits for a new one to be elected."""
+        if len(self.state.internal_hosts) < 2:
+            logger.warning(
+                "No secondaries to become primary - upgrading primary without electing a new one, expect downtime."
+            )
+            return
+
+        old_primary = self.dependent.primary_unit_name  # type: ignore
+        with MongoConnection(self.state.mongo_config) as mongod:
+            mongod.step_down_primary()
+
+        for attempt in Retrying(stop=stop_after_attempt(30), wait=wait_fixed(1), reraise=True):
+            with attempt:
+                new_primary = self.dependent.primary_unit_name  # type: ignore
+                if new_primary == old_primary:
+                    raise FailedToElectNewPrimaryError()