postgresql-charms-single-kernel 16.3.10__tar.gz → 16.3.11__tar.gz

{postgresql_charms_single_kernel-16.3.10 → postgresql_charms_single_kernel-16.3.11}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: postgresql-charms-single-kernel
-Version: 16.3.10
+Version: 16.3.11
 Summary: Shared and reusable code for PostgreSQL-related charms
 Author: Canonical Data Platform
 Author-email: Canonical Data Platform <data-platform@lists.launchpad.net>

{postgresql_charms_single_kernel-16.3.10 → postgresql_charms_single_kernel-16.3.11}/pyproject.toml

@@ -1,7 +1,7 @@
 [project]
 name = "postgresql-charms-single-kernel"
 description = "Shared and reusable code for PostgreSQL-related charms"
-version = "16.3.10"
+version = "16.3.11"
 readme = "README.md"
 classifiers = [
     "Development Status :: 3 - Alpha",
@@ -157,12 +157,12 @@ exclude = [
 ]
 
 [dependency-groups]
-format = ["ruff==0.16.8"]
+format = ["ruff==0.16.10"]
 lint = [
     "codespell==2.4.3",
-    "ty==0.0.82",
+    "ty==0.0.84",
 ]
 unit = [
-    "coverage[toml]==7.16.1",
+    "coverage[toml]==7.16.2",
     "pytest==9.1.1",
 ]

{postgresql_charms_single_kernel-16.3.10 → postgresql_charms_single_kernel-16.3.11}/pyproject.toml.orig

@@ -4,7 +4,7 @@
 [project]
 name = "postgresql-charms-single-kernel"
 description = "Shared and reusable code for PostgreSQL-related charms"
-version = "16.3.10"
+version = "16.3.11"
 readme = "README.md"
 license = {file = "LICENSE"}
 authors = [
@@ -63,14 +63,14 @@ module-root = ""
 
 [dependency-groups]
 format = [
-    "ruff==0.16.8"
+    "ruff==0.16.10"
 ]
 lint = [
     "codespell==2.4.3",
-    "ty==0.0.82"
+    "ty==0.0.84"
 ]
 unit = [
-    "coverage[toml]==7.16.1",
+    "coverage[toml]==7.16.2",
     "pytest==9.1.1"
 ]
 

{postgresql_charms_single_kernel-16.3.10 → postgresql_charms_single_kernel-16.3.11}/single_kernel_postgresql/charms/abstract_charm.py

@@ -13,6 +13,7 @@ from single_kernel_postgresql.events.database import DatabaseEventsHandler
 from single_kernel_postgresql.events.ldap import LDAP
 from single_kernel_postgresql.events.postgresql import PostgreSQLEventsHandler
 from single_kernel_postgresql.events.tls import TLS
+from single_kernel_postgresql.events.watcher import WatcherEventsHandler
 from single_kernel_postgresql.lib.charms.data_platform_libs.v0.data_interfaces import (
     DatabaseProvides,
 )
@@ -94,6 +95,7 @@ class AbstractPostgreSQLCharm(CharmBase, ABC):
             self.config_manager,
             self.patroni_manager,
         )
+        self.watcher_handler = WatcherEventsHandler(self, self.workload, self.state)
 
         # Status Handler
         self.status_handler = StatusHandler(

{postgresql_charms_single_kernel-16.3.10 → postgresql_charms_single_kernel-16.3.11}/single_kernel_postgresql/config/literals.py

@@ -207,3 +207,7 @@ K8S_PGBACKREST_LOGS_SYMLINK_PATH = "var/log/pgbackrest"
 VM_PATRONICTL_EXECUTABLE = "charmed-postgresql.patronictl"
 PATRONICTL_REMOVE_CONFIRMATION = "Yes I am aware"
 RESTORE_REPEAT_CAUSE = "restore-backup"
+
+# Watcher relation
+RAFT_PORT = 2222
+RAFT_PARTNER_PREFIX = "partner_node_status_server_"

postgresql_charms_single_kernel-16.3.11/single_kernel_postgresql/events/watcher.py

@@ -0,0 +1,524 @@
+# Copyright 2026 Canonical Ltd.
+# See LICENSE file for licensing details.
+
+"""PostgreSQL Watcher Relation implementation.
+
+This module handles the relation between the PostgreSQL charm and a watcher/witness charm
+that participates in the Raft consensus for stereo mode (2-node PostgreSQL clusters).
+
+The watcher provides quorum without storing data, enabling automatic failover
+when one of the two PostgreSQL nodes becomes unavailable.
+"""
+
+import contextlib
+import json
+import logging
+import os
+from functools import cached_property
+from typing import TYPE_CHECKING
+
+from ops import (
+    Object,
+    Relation,
+    RelationBrokenEvent,
+    RelationChangedEvent,
+    RelationJoinedEvent,
+    Secret,
+    SecretNotFoundError,
+)
+
+with contextlib.suppress(ImportError):
+    from pysyncobj.utility import TcpUtility
+
+from single_kernel_postgresql.config.enums import Substrates
+from single_kernel_postgresql.config.literals import (
+    RAFT_PARTNER_PREFIX,
+    RAFT_PASSWORD_KEY,
+    RAFT_PORT,
+    REPLICATION_CONSUMER_RELATION,
+    REPLICATION_OFFER_RELATION,
+    WATCHER_OFFER_RELATION,
+    WATCHER_PASSWORD_KEY,
+    WATCHER_SECRET_LABEL,
+    WATCHER_USER,
+)
+from single_kernel_postgresql.utils import new_password
+
+if TYPE_CHECKING:
+    from single_kernel_postgresql.core.state import CharmState
+    from single_kernel_postgresql.workload.base import BaseWorkload
+
+
+logger = logging.getLogger(__name__)
+
+
+class WatcherEventsHandler(Object):
+    """Handles the watcher relation for stereo mode support."""
+
+    def __init__(self, charm, workload: "BaseWorkload", state: "CharmState"):
+        """Initialize the watcher relation handler."""
+        super().__init__(charm, WATCHER_OFFER_RELATION)
+        self.charm = charm
+        self.state = state
+        self.workload = workload
+
+        if self.state.substrate == Substrates.VM:
+            self.framework.observe(
+                self.charm.on[WATCHER_OFFER_RELATION].relation_joined,
+                self._on_watcher_relation_joined,
+            )
+            self.framework.observe(
+                self.charm.on[WATCHER_OFFER_RELATION].relation_changed,
+                self._on_watcher_relation_changed,
+            )
+            self.framework.observe(
+                self.charm.on[WATCHER_OFFER_RELATION].relation_broken,
+                self._on_watcher_relation_broken,
+            )
+
+    @cached_property
+    def _relation(self) -> Relation | None:
+        """Return the watcher relation if it exists."""
+        return self.model.get_relation(WATCHER_OFFER_RELATION)
+
+    @property
+    def is_watcher_connected(self) -> bool:
+        """Check if a watcher is connected to this cluster.
+
+        Returns:
+            True if a watcher is connected, False otherwise.
+        """
+        if self.state.substrate == Substrates.K8S:
+            return True
+
+        try:
+            syncobj_util = TcpUtility(password=self.state.application.raft_password, timeout=3)
+            raft_status = syncobj_util.executeCommand(f"127.0.0.1:{RAFT_PORT}", ["status"])
+            if raft_status:
+                # Check if watcher is in the partner_node_status entries
+                member_key = f"{RAFT_PARTNER_PREFIX}{self.watcher_raft_address}"
+                return member_key in raft_status
+        except Exception as e:
+            logger.debug(f"Error checking Raft membership: {e}")
+        return False
+
+    def enable_watcher(self) -> None:
+        """Clear up disable flag."""
+        if (
+            self.state.substrate == Substrates.K8S
+            or not self._relation
+            or not self.state.peer.is_app_leader
+        ):
+            return None
+
+        self._relation.data[self.state.peer.unit.app].pop("disable-watcher", None)
+        self.update_watcher_secret()
+
+    def disable_watcher(self) -> None:
+        """Inform watcher to stop service."""
+        if (
+            self.state.substrate == Substrates.K8S
+            or not self._relation
+            or not self.state.peer.is_app_leader
+        ):
+            return None
+
+        self._relation.data[self.state.peer.unit.app].update({"disable-watcher": "True"})
+        try:
+            if self.watcher_raft_address:
+                self.charm._patroni.remove_raft_member(self.watcher_raft_address)
+        except Exception as e:
+            logger.warning(f"Error remove Raft watcher: {e}")
+
+    @cached_property
+    def is_active(self) -> bool:
+        """Check if the watcher should be added to peers."""
+        if self.state.substrate == Substrates.K8S or not self._relation:
+            return False
+
+        return self._relation.data[self._relation.app].get("raft-status") == "connected"
+
+    @cached_property
+    def watcher_raft_address(self) -> str | None:
+        """Return the watcher's Raft address for inclusion in partner_addrs.
+
+        Returns:
+            The watcher's Raft address (ip:port), or None if not available.
+        """
+        if self.state.substrate == Substrates.K8S or not self._relation:
+            return None
+
+        unit_address = None
+        port = None
+        # Get the watcher unit address from the relation data
+        for unit in self._relation.units:
+            if unit_address := self._relation.data[unit].get("unit-address"):
+                break
+        port_str = self._relation.data[self._relation.app].get("watcher-raft-port")
+        if port_str:
+            try:
+                port = int(port_str)
+            except ValueError:
+                logger.warning(f"Invalid watcher-raft-port value: {port_str}")
+
+        if unit_address and port is not None:
+            return f"{unit_address}:{port}"
+        return None
+
+    def _on_watcher_relation_joined(self, event: RelationJoinedEvent) -> None:
+        """Handle a new watcher joining the relation.
+
+        Shares cluster information including Raft password and PostgreSQL endpoints
+        with the watcher charm.
+
+        Args:
+            event: The relation joined event.
+        """
+        if self.state.substrate == Substrates.K8S:
+            return
+
+        # Every unit should publish its own per-unit data.
+        self.update_unit_address(event.relation)
+
+        if not self.state.peer.is_app_leader:
+            return
+
+        logger.info("Watcher relation joined, sharing cluster information")
+
+        # Ensure watcher user exists before creating the secret,
+        # so both raft-password and watcher-password are included from the start
+        watcher_pw = self._ensure_watcher_user()
+
+        # Create or get the watcher secret containing Raft password and watcher password
+        secret = self._get_or_create_watcher_secret(watcher_password=watcher_pw)
+        if secret is None:
+            logger.warning("Failed to create watcher secret, deferring event")
+            event.defer()
+            return
+
+        # Grant the secret to the watcher application
+        try:
+            secret.grant(event.relation)
+        except Exception as e:
+            logger.warning(f"Failed to grant secret to watcher: {e}")
+
+        # Update relation data with cluster information
+        self._update_relation_data(event.relation)
+
+    def _on_watcher_relation_changed(self, event: RelationChangedEvent) -> None:
+        """Handle watcher relation data changes.
+
+        Updates Patroni configuration to include the watcher in the Raft cluster.
+
+        Args:
+            event: The relation changed event.
+        """
+        # Keep this unit's relation data current on every relation-changed hook.
+        self.update_unit_address(event.relation)
+
+        if not self.charm.is_cluster_initialised:
+            logger.debug("Cluster not initialized, deferring watcher relation changed")
+            event.defer()
+            return
+
+        watcher_address = None
+        for unit in event.relation.units:
+            if unit_address := event.relation.data[unit].get("unit-address"):
+                watcher_address = unit_address
+                break
+
+        if watcher_address:
+            logger.info(f"Watcher address updated: {watcher_address}")
+            # Only the leader handles Raft membership changes and user management
+            # to avoid race conditions between multiple PostgreSQL units
+            if self.state.peer.is_app_leader:
+                self.charm._patroni.cleanup_raft_cluster()
+                self._ensure_watcher_user()
+            # Update Patroni configuration to include watcher in Raft
+            self.charm.update_config()
+
+        # Update relation data for the watcher
+        if self.state.peer.is_app_leader:
+            self._update_relation_data(event.relation)
+
+    def _on_watcher_relation_broken(self, event: RelationBrokenEvent) -> None:
+        """Handle watcher relation being broken.
+
+         Updates Patroni configuration to remove the watcher from the Raft cluster.
+
+        Args:
+            event: The relation broken event.
+        """
+        if not self.charm.is_cluster_initialised:
+            return
+
+        logger.info("Watcher relation broken, updating Patroni configuration")
+        self.watcher_raft_address = None
+        if self.state.peer.is_app_leader:
+            self.charm._patroni.cleanup_raft_cluster()
+        # Update Patroni configuration without the watcher
+        self.charm.update_config()
+
+    def _ensure_watcher_user(self) -> str | None:
+        """Ensure the watcher PostgreSQL user exists for health checks.
+
+        Creates the watcher user if it doesn't exist, and updates the watcher
+        secret with the password so the watcher charm can authenticate.
+
+        Returns:
+            The watcher password, or None if user creation failed.
+        """
+        if not self.charm.is_cluster_initialised:
+            logger.debug("Cluster not initialized, cannot create watcher user")
+            return None
+
+        try:
+            users = self.charm.postgresql.list_users()
+            if WATCHER_USER in users:
+                logger.debug(f"User {WATCHER_USER} already exists")
+                # Get existing password from secret if available
+                try:
+                    secret = self.model.get_secret(label=WATCHER_SECRET_LABEL)
+                    content = secret.get_content(refresh=True)
+                    existing_pw = content.get(WATCHER_PASSWORD_KEY)
+                    if existing_pw:
+                        return existing_pw
+                    # Password not in secret — fall through to regenerate
+                except SecretNotFoundError:
+                    # Secret doesn't exist yet, will be created below with new password
+                    pass
+
+            # Generate a password for the watcher user
+            watcher_password = new_password()
+
+            # Create the watcher user (minimal privileges - only needs to connect and run SELECT 1)
+            if WATCHER_USER not in users:
+                logger.info(f"Creating PostgreSQL user: {WATCHER_USER}")
+                self.charm.postgresql.create_user(WATCHER_USER, watcher_password)
+            else:
+                # User exists but we don't have the password, update it
+                logger.info(f"Updating password for PostgreSQL user: {WATCHER_USER}")
+                self.charm.postgresql.update_user_password(WATCHER_USER, watcher_password)
+
+            # Grant connect privilege on postgres database (for health checks)
+            self.charm.postgresql.grant_database_privileges_to_user(
+                WATCHER_USER, "postgres", ["connect"]
+            )
+
+            # Update the secret to include the watcher password
+            self._update_watcher_secret_with_password(watcher_password)
+
+            return watcher_password
+
+        except Exception as e:
+            logger.error(f"Failed to ensure watcher user: {e}")
+            return None
+
+    def _update_watcher_secret_with_password(self, watcher_password: str) -> None:
+        """Update the watcher secret to include the watcher password.
+
+        Args:
+            watcher_password: The password for the watcher PostgreSQL user.
+        """
+        try:
+            secret = self.model.get_secret(label=WATCHER_SECRET_LABEL)
+            content = secret.get_content(refresh=True)
+            content[WATCHER_PASSWORD_KEY] = watcher_password
+            secret.set_content(content)
+            logger.info("Updated watcher secret with watcher password")
+        except SecretNotFoundError:
+            logger.warning(
+                "Watcher secret not found, password change cannot be propagated to watcher. "
+                "It will be synced on next relation-changed event."
+            )
+        except Exception as e:
+            logger.error(f"Failed to update watcher secret with password: {e}")
+
+    def _get_existing_watcher_password(self) -> str | None:
+        """Get the watcher password from an existing secret if available."""
+        try:
+            secret = self.model.get_secret(label=WATCHER_SECRET_LABEL)
+            content = secret.get_content(refresh=True)
+            return content.get(WATCHER_PASSWORD_KEY)
+        except SecretNotFoundError:
+            return None
+        except Exception as e:
+            logger.debug(f"Failed to get existing watcher password: {e}")
+            return None
+
+    def _get_or_create_watcher_secret(self, watcher_password: str | None = None) -> Secret | None:
+        """Get or create the secret for sharing Raft credentials with the watcher.
+
+        Args:
+            watcher_password: Optional watcher password to include in the secret.
+
+        Returns:
+            The Juju secret containing Raft password, or None if creation failed.
+        """
+        try:
+            secret = self.model.get_secret(label=WATCHER_SECRET_LABEL)
+            logger.debug("Found existing watcher secret")
+            return secret
+        except SecretNotFoundError:
+            logger.debug("No existing watcher secret found, creating new one")
+
+        # Get the Raft password from the internal secret
+        try:
+            raft_password = self.state.application.raft_password
+        except Exception as e:
+            logger.warning(f"Error getting raft_password: {e}")
+            raft_password = None
+
+        if not raft_password:
+            logger.warning("Raft password not available, cannot create secret")
+            return None
+
+        # Create a new secret with the Raft password (and watcher password if available)
+        try:
+            content = {RAFT_PASSWORD_KEY: raft_password}
+            # Include watcher password if provided, or look it up from existing secret
+            watcher_pw = watcher_password or self._get_existing_watcher_password()
+            if watcher_pw:
+                content[WATCHER_PASSWORD_KEY] = watcher_pw
+            secret = self.model.app.add_secret(
+                content=content,
+                label=WATCHER_SECRET_LABEL,
+            )
+            logger.info("Created watcher secret")
+            return secret
+        except Exception as e:
+            logger.error(f"Failed to create watcher secret: {e}")
+            return None
+
+    def _update_relation_data(self, relation: Relation) -> None:
+        """Update the relation data with cluster information.
+
+        Args:
+            relation: The watcher relation.
+        """
+        if not self.state.peer.is_app_leader:
+            return
+
+        # Get the secret ID for sharing
+        try:
+            secret = self.model.get_secret(label=WATCHER_SECRET_LABEL)
+            secret_id = secret.id
+            if not secret_id:
+                # When a secret is retrieved by label, the ops library may lazily load the ID.
+                # Calling get_info() forces it to resolve.
+                secret_id = secret.get_info().id
+            if secret_id is None:
+                logger.warning("Watcher secret has no ID")
+                return
+            # Ensure the secret is granted to the watcher relation (handles
+            # cases where the secret was recreated after initial relation_joined)
+            with contextlib.suppress(Exception):
+                secret.grant(relation)
+        except SecretNotFoundError:
+            logger.warning("Watcher secret not found")
+            return
+        except Exception as e:
+            logger.error(f"Error getting secret: {e}")
+            return
+
+        # Collect PostgreSQL unit endpoints using fresh IPs from unit relation data.
+        # _units_ips reads directly from unit relation data (always fresh), while
+        # _peer_members_ips reads from app peer data (may be stale after network disruptions).
+        pg_endpoints: list[str] = sorted(self.charm._units_ips)
+        if not pg_endpoints:
+            logger.warning("No PostgreSQL endpoints available")
+            return
+
+        # Update relation data
+        relation.data[self.state.peer.unit.app].update({
+            "cluster-name": self.state.cluster_name,
+            "raft-secret-id": secret_id,
+            "raft-partner-addrs": json.dumps(pg_endpoints),
+            "raft-port": str(RAFT_PORT),
+            "patroni-cas": self.charm.tls_manager.get_peer_ca_bundle(),
+            "standby-clusters": json.dumps(self._get_standby_clusters()),
+            "tls-enabled": "true" if self.charm.is_tls_enabled else "false",
+        })
+        self.update_watcher_secret()
+
+        # Also share this unit's per-unit data.
+        self.update_unit_address(relation)
+
+    def update_unit_address(self, relation: Relation | None = None) -> None:
+        """Update this unit's address in the watcher relation.
+
+        Called when the unit's IP changes (e.g., after network isolation).
+        This updates unit-specific data in the relation, not application data.
+        Can be called by any unit, not just the leader.
+        """
+        if relation is None:
+            relation = self._relation
+
+        if not relation:
+            return
+
+        if not (unit_ip := self.state.unit_ip):
+            return
+
+        relation.data[self.state.peer.unit]["version"] = self.workload.get_postgresql_version()
+        if self.charm.refresh:
+            relation.data[self.state.peer.unit]["snap"] = self.charm.refresh.pinned_snap_revision
+        current_address = relation.data[self.state.peer.unit].get("unit-address")
+        if current_address != unit_ip:
+            logger.info(
+                f"Updating unit-address in watcher relation from {current_address} to {unit_ip}"
+            )
+            relation.data[self.state.peer.unit]["unit-address"] = unit_ip
+
+        unit_az = os.environ.get("JUJU_AVAILABILITY_ZONE")
+        current_az = relation.data[self.state.peer.unit].get("unit-az")
+        if unit_az and current_az != unit_az:
+            relation.data[self.state.peer.unit]["unit-az"] = unit_az
+
+    def update_endpoints(self) -> None:
+        """Update the watcher with current cluster endpoints.
+
+        Called when cluster membership changes (peer joins/departs).
+        Also dynamically adds new PostgreSQL peers to the running Raft cluster.
+        """
+        if self.state.substrate == Substrates.K8S:
+            return
+
+        if relation := self._relation:
+            if self.state.peer.is_app_leader:
+                self._update_relation_data(relation)
+            self.update_unit_address(relation)
+
+    def _get_standby_clusters(self) -> list[str]:
+        """Return the names of related standby clusters."""
+        standby_clusters = []
+        for relation in [
+            self.model.get_relation(REPLICATION_OFFER_RELATION),
+            self.model.get_relation(REPLICATION_CONSUMER_RELATION),
+        ]:
+            if relation is None:
+                continue
+            # We are interested in the other side's application name
+            if relation.app and self.charm.async_replication.is_primary_cluster():
+                standby_clusters.append(relation.app.name)
+        return sorted(set(standby_clusters))
+
+    def update_watcher_secret(self) -> None:
+        """Update the watcher secret with current Raft password.
+
+        Called when credentials are rotated. Preserves existing secret content
+        (e.g., watcher-password) while updating the Raft password.
+        """
+        if not self.state.peer.is_app_leader:
+            return
+
+        try:
+            if raft_password := self.state.application.raft_password:
+                secret = self.model.get_secret(label=WATCHER_SECRET_LABEL)
+                content = secret.get_content(refresh=True)
+                if content.get(RAFT_PASSWORD_KEY) != raft_password:
+                    content[RAFT_PASSWORD_KEY] = raft_password
+                    secret.set_content(content)
+                    logger.info("Updated watcher secret with new Raft password")
+        except SecretNotFoundError:
+            logger.debug("Watcher secret not found, nothing to update")

postgresql_charms_single_kernel-16.3.11/single_kernel_postgresql/scripts/authorisation_rules_observer.py

@@ -0,0 +1,145 @@
+# Copyright 2025 Canonical Ltd.
+# See LICENSE file for licensing details.
+
+"""Authorisation rules changes observer."""
+
+import subprocess
+import sys
+from asyncio import as_completed, create_task, run, wait
+from contextlib import suppress
+from ssl import create_default_context
+from time import sleep
+from urllib.parse import urljoin
+
+import psycopg2
+import yaml
+from httpx import AsyncClient
+
+API_REQUEST_TIMEOUT = 5
+PATRONI_CLUSTER_STATUS_ENDPOINT = "cluster"
+PATRONI_CONFIG_STATUS_ENDPOINT = "config"
+TLS_CA_BUNDLE_FILE = "peer_ca_bundle.pem"
+PATRONI_CONF_FILE_PATH = "/var/lib/pg/data/patroni.yaml"
+
+# File path for the spawned cluster topology observer process to write logs.
+LOG_FILE_PATH = "/var/log/authorisation_rules_observer.log"
+
+
+class UnreachableUnitsError(Exception):
+    """Cannot reach any known cluster member."""
+
+
+async def _httpx_get_request(url: str):
+    ssl_ctx = create_default_context()
+    with suppress(FileNotFoundError):
+        # Certificate bundle is not secret
+        ssl_ctx.load_verify_locations(cafile=f"/tmp/{TLS_CA_BUNDLE_FILE}")  # noqa: S108
+    async with AsyncClient(timeout=API_REQUEST_TIMEOUT, verify=ssl_ctx) as client:
+        try:
+            return (await client.get(url)).json()
+        except Exception as e:
+            print(f"Failed to contact {url} with {e}")
+            return None
+
+
+def dispatch(run_cmd, unit, charm_dir, custom_event):
+    """Use the input juju-run command to dispatch a custom event."""
+    dispatch_sub_cmd = "JUJU_DISPATCH_PATH=hooks/{} {}/dispatch"
+    # Input is generated by the charm
+    subprocess.run([run_cmd, "-u", unit, dispatch_sub_cmd.format(custom_event, charm_dir)])  # noqa: S603
+
+
+def check_for_database_changes(run_cmd, unit, charm_dir, previous_databases):
+    """Check for changes in the databases.
+
+    If changes are detected, dispatch an event to handle them.
+    """
+    with open(PATRONI_CONF_FILE_PATH) as conf_file:
+        conf_file_contents = yaml.safe_load(conf_file)
+        password = conf_file_contents["postgresql"]["authentication"]["superuser"]["password"]
+    connection = None
+    try:
+        # Input is generated by the charm
+        with (
+            psycopg2.connect(
+                "dbname='postgres' user='operator' host='localhost' "
+                f"password='{password}' connect_timeout=1"
+            ) as connection,
+            connection.cursor() as cursor,
+        ):
+            cursor.execute("SELECT datname, datacl FROM pg_database;")
+            current_databases = cursor.fetchall()
+            cursor.execute(
+                "SELECT oid, rolname FROM pg_roles WHERE pg_has_role(oid, 'relation_access', 'member');"
+            )
+            current_databases.append(cursor.fetchall())
+    except psycopg2.Error as e:
+        with open(LOG_FILE_PATH, "a") as log_file:
+            log_file.write(f"Failed to retrieve databases: {e}\n")
+        return previous_databases
+    else:
+        # If it's the first time the databases were retrieved, then store it and use
+        # it for subsequent checks.
+        if not previous_databases:
+            previous_databases = current_databases
+        # If the databases changed, dispatch a charm event to handle this change.
+        elif current_databases != previous_databases:
+            previous_databases = current_databases
+            dispatch(run_cmd, unit, charm_dir, "databases_change")
+        return previous_databases
+    finally:
+        if connection:
+            connection.close()
+
+
+async def main():
+    """Main watch and dispatch loop.
+
+    Watch the Patroni API cluster info. When changes are detected, dispatch the change event.
+    """
+    patroni_urls, run_cmd, unit, charm_dir = sys.argv[1:]
+
+    previous_databases = None
+    urls = [urljoin(url, PATRONI_CLUSTER_STATUS_ENDPOINT) for url in patroni_urls.split(",")]
+    member_name = unit.replace("/", "-")
+    while True:
+        # Disable TLS chain verification
+        context = create_default_context()
+        with suppress(FileNotFoundError):
+            # Certificate bundle is not secret
+            context.load_verify_locations(cafile=f"/tmp/{TLS_CA_BUNDLE_FILE}")  # noqa: S108
+
+        cluster_status = None
+        tasks = [create_task(_httpx_get_request(url)) for url in urls]
+        for task in as_completed(tasks):
+            if result := await task:
+                for task in tasks:
+                    task.cancel()
+                await wait(tasks)
+                cluster_status = result
+                break
+        if not cluster_status:
+            raise UnreachableUnitsError("Unable to reach cluster members")
+        is_primary = False
+        for member in cluster_status["members"]:
+            member_url = urljoin(member["api_url"], PATRONI_CLUSTER_STATUS_ENDPOINT)
+            # Call the current unit first
+            if member["name"] == member_name:
+                urls.insert(0, member_url)
+                # Check if the current member is the primary.
+                if member["role"] == "leader":
+                    is_primary = True
+            else:
+                urls.append(member_url)
+
+        if is_primary:
+            previous_databases = check_for_database_changes(
+                run_cmd, unit, charm_dir, previous_databases
+            )
+
+        # Wait some time before checking again for a authorisation rules change.
+        sleep(30)
+
+
+if __name__ == "__main__":
+    run(main())

postgresql_charms_single_kernel-16.3.11/single_kernel_postgresql/scripts/cluster_topology_observer.py

@@ -0,0 +1,177 @@
+# Copyright 2023 Canonical Ltd.
+# See LICENSE file for licensing details.
+
+"""Cluster topology changes observer."""
+
+import subprocess
+import sys
+from asyncio import as_completed, create_task, run, wait
+from contextlib import suppress
+from ssl import create_default_context
+from time import sleep
+from urllib.parse import urljoin
+
+import psycopg2
+import yaml
+from httpx import AsyncClient
+
+API_REQUEST_TIMEOUT = 5
+PATRONI_CLUSTER_STATUS_ENDPOINT = "cluster"
+TLS_CA_BUNDLE_FILE = "peer_ca_bundle.pem"
+SNAP_CURRENT_PATH = "/var/snap/charmed-postgresql/current"
+SNAP_CONF_PATH = f"{SNAP_CURRENT_PATH}/etc"
+PATRONI_CONF_PATH = f"{SNAP_CONF_PATH}/patroni"
+PATRONI_CONF_FILE_PATH = f"{PATRONI_CONF_PATH}/patroni.yaml"
+
+# File path for the spawned cluster topology observer process to write logs.
+LOG_FILE_PATH = "/var/log/cluster_topology_observer.log"
+
+
+class UnreachableUnitsError(Exception):
+    """Cannot reach any known cluster member."""
+
+
+async def _httpx_get_request(url: str):
+    ssl_ctx = create_default_context()
+    with suppress(FileNotFoundError):
+        ssl_ctx.load_verify_locations(cafile=f"{PATRONI_CONF_PATH}/{TLS_CA_BUNDLE_FILE}")
+    async with AsyncClient(timeout=API_REQUEST_TIMEOUT, verify=ssl_ctx) as client:
+        try:
+            return (await client.get(url)).json()
+        except Exception as e:
+            print(f"Failed to contact {url} with {e}")
+            return None
+
+
+def check_for_cluster_topology_changes(
+    run_cmd, unit, charm_dir, previous_cluster_topology, current_cluster_topology
+):
+    """Check for changes in the cluster topology.
+
+    If changes are detected, dispatch an event to handle them.
+    """
+    # If it's the first time the cluster topology was retrieved, then store it and use
+    # it for subsequent checks.
+    if not previous_cluster_topology:
+        previous_cluster_topology = current_cluster_topology
+    # If the cluster topology changed, dispatch a charm event to handle this change.
+    elif current_cluster_topology != previous_cluster_topology:
+        previous_cluster_topology = current_cluster_topology
+        dispatch(run_cmd, unit, charm_dir, "cluster_topology_change")
+    return previous_cluster_topology
+
+
+def check_for_database_changes(run_cmd, unit, charm_dir, previous_databases):
+    """Check for changes in the databases.
+
+    If changes are detected, dispatch an event to handle them.
+    """
+    with open(PATRONI_CONF_FILE_PATH) as conf_file:
+        conf_file_contents = yaml.safe_load(conf_file)
+        password = conf_file_contents["postgresql"]["authentication"]["superuser"]["password"]
+        listen_addr = conf_file_contents["postgresql"]["listen"]
+        if not listen_addr or ":" not in listen_addr:
+            with open(LOG_FILE_PATH, "a") as log_file:
+                log_file.write("Failed to retrieve databases: Host not set yet.\n")
+            return previous_databases
+
+    connection = None
+    try:
+        # Input is generated by the charm
+        with (
+            psycopg2.connect(
+                f"dbname='postgres' user='operator' host='/tmp/snap-private-tmp/snap.charmed-postgresql/tmp/' "
+                f"password='{password}' connect_timeout=1"
+            ) as connection,
+            connection.cursor() as cursor,
+        ):
+            cursor.execute("SELECT datname, datacl FROM pg_database;")
+            current_databases = cursor.fetchall()
+            cursor.execute(
+                "SELECT oid, rolname FROM pg_roles WHERE pg_has_role(oid, 'relation_access', 'member');"
+            )
+            current_databases.append(cursor.fetchall())
+    except psycopg2.Error as e:
+        with open(LOG_FILE_PATH, "a") as log_file:
+            log_file.write(f"Failed to retrieve databases: {e}\n")
+        return previous_databases
+    else:
+        # If it's the first time the databases were retrieved, then store it and use
+        # it for subsequent checks.
+        if not previous_databases:
+            previous_databases = current_databases
+        # If the databases changed, dispatch a charm event to handle this change.
+        elif current_databases != previous_databases:
+            previous_databases = current_databases
+            dispatch(run_cmd, unit, charm_dir, "databases_change")
+        return previous_databases
+    finally:
+        if connection:
+            connection.close()
+
+
+def dispatch(run_cmd, unit, charm_dir, custom_event):
+    """Use the input juju-run command to dispatch a custom event."""
+    dispatch_sub_cmd = "JUJU_DISPATCH_PATH=hooks/{} {}/dispatch"
+    # Input is generated by the charm
+    subprocess.run([run_cmd, "-u", unit, dispatch_sub_cmd.format(custom_event, charm_dir)])  # noqa: S603
+
+
+async def main():
+    """Main watch and dispatch loop.
+
+    Watch the Patroni API cluster info. When changes are detected, dispatch the change event.
+    """
+    patroni_urls, run_cmd, unit, charm_dir = sys.argv[1:]
+
+    previous_cluster_topology = {}
+    previous_databases = None
+    urls = [urljoin(url, PATRONI_CLUSTER_STATUS_ENDPOINT) for url in patroni_urls.split(",")]
+    member_name = unit.replace("/", "-")
+    while True:
+        # Disable TLS chain verification
+        context = create_default_context()
+        with suppress(FileNotFoundError):
+            context.load_verify_locations(cafile=f"{PATRONI_CONF_PATH}/{TLS_CA_BUNDLE_FILE}")
+
+        cluster_status = None
+        tasks = [create_task(_httpx_get_request(url)) for url in urls]
+        for task in as_completed(tasks):
+            if result := await task:
+                for task in tasks:
+                    task.cancel()
+                await wait(tasks)
+                cluster_status = result
+                break
+        if not cluster_status:
+            raise UnreachableUnitsError("Unable to reach cluster members")
+        current_cluster_topology = {}
+        urls = []
+        is_primary = False
+        for member in cluster_status["members"]:
+            current_cluster_topology[member["name"]] = member["role"]
+            member_url = urljoin(member["api_url"], PATRONI_CLUSTER_STATUS_ENDPOINT)
+            # Call the current unit first
+            if member["name"] == member_name:
+                urls.insert(0, member_url)
+                # Check if the current member is the primary.
+                if member["role"] == "leader":
+                    is_primary = True
+            else:
+                urls.append(member_url)
+
+        previous_cluster_topology = check_for_cluster_topology_changes(
+            run_cmd, unit, charm_dir, previous_cluster_topology, current_cluster_topology
+        )
+
+        if is_primary:
+            previous_databases = check_for_database_changes(
+                run_cmd, unit, charm_dir, previous_databases
+            )
+
+        # Wait some time before checking again for a cluster topology change.
+        sleep(10)
+
+
+if __name__ == "__main__":
+    run(main())

postgresql_charms_single_kernel-16.3.11/single_kernel_postgresql/scripts/raft_observer.py

@@ -0,0 +1,85 @@
+# Copyright 2026 Canonical Ltd.
+# See LICENSE file for licensing details.
+
+"""Raft connectivity observer."""
+
+from os import environ
+from subprocess import run
+
+from charmlibs.snap import SnapCache
+from pysyncobj.utility import TcpUtility
+from yaml import safe_load
+
+from single_kernel_postgresql.config.literals import (
+    PATRONI_CONF_PATH,
+    RAFT_PARTNER_PREFIX,
+    RAFT_PORT,
+)
+
+PATRONI_CONF_FILE_PATH = f"{PATRONI_CONF_PATH}/patroni.yaml"
+
+
+def dispatch(custom_event):
+    """Use the input juju-run command to dispatch a custom event."""
+    dispatch_sub_cmd = "JUJU_DISPATCH_PATH=hooks/{} {}/dispatch"
+    # Input is generated by the charm
+    run([  # noqa: S603
+        "/usr/bin/juju-exec",
+        "-u",
+        environ["JUJU_UNIT_NAME"],
+        dispatch_sub_cmd.format(custom_event, environ["JUJU_CHARM_DIR"]),
+    ])
+
+
+def get_raft_password() -> str | None:
+    """Get the raft password from the patroni config file."""
+    try:
+        with open(PATRONI_CONF_FILE_PATH) as conf_file:
+            conf_file_contents = safe_load(conf_file)
+            return conf_file_contents["raft"]["password"]
+    except Exception as e:
+        print(f"Unable to get password: {e}")
+
+
+def check_raft_connection(password: str) -> None:
+    """Verify that the watcher has joined the Raft cluster."""
+    # Get the status of the raft cluster.
+    syncobj_util = TcpUtility(password=password, timeout=3)
+
+    try:
+        raft_status = syncobj_util.executeCommand(f"127.0.0.1:{RAFT_PORT}", ["status"])
+    except Exception:
+        print("Cannot connect to local Raft")
+        return
+    if not raft_status:
+        print("No Raft status")
+        return
+    print(f"Local raft: {raft_status}")
+    if not raft_status["leader"] or not raft_status["has_quorum"]:
+        print("No leader or quorum")
+        return
+    for key in raft_status:
+        if key.startswith(RAFT_PARTNER_PREFIX) and raft_status[key] != 2:
+            addr = key.split(RAFT_PARTNER_PREFIX)[-1]
+            try:
+                print(f"{addr} Raft: {syncobj_util.executeCommand(addr, ['status'])}")
+            except Exception:
+                print(f"Unable to connect to {addr}")
+                continue
+            print(f"Potentially stuck connection with {addr}")
+            dispatch("raft_reconnect")
+            return
+
+
+def main() -> None:
+    """Main watch and dispatch."""
+    if not SnapCache()["charmed-postgresql"].services["patroni"]["active"]:
+        print("Patroni is not running")
+        return
+    if not (password := get_raft_password()):
+        return
+    check_raft_connection(password)
+
+
+if __name__ == "__main__":
+    main()