postgresql-charms-single-kernel 16.3.2__tar.gz → 16.3.4__tar.gz

{postgresql_charms_single_kernel-16.3.2 → postgresql_charms_single_kernel-16.3.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: postgresql-charms-single-kernel
-Version: 16.3.2
+Version: 16.3.4
 Summary: Shared and reusable code for PostgreSQL-related charms
 Author: Canonical Data Platform
 Author-email: Canonical Data Platform <data-platform@lists.launchpad.net>

{postgresql_charms_single_kernel-16.3.2 → postgresql_charms_single_kernel-16.3.4}/pyproject.toml

@@ -4,7 +4,7 @@
 [project]
 name = "postgresql-charms-single-kernel"
 description = "Shared and reusable code for PostgreSQL-related charms"
-version = "16.3.2"
+version = "16.3.4"
 readme = "README.md"
 license = {file = "LICENSE"}
 authors = [
@@ -48,20 +48,23 @@ db-driver = [
 requires = ["uv_build>=0.11.0,<0.12.0"]
 build-backend = "uv_build"
 
+[tool.uv]
+exclude-newer = "1 day"
+
 [tool.uv.build-backend]
 module-name = "single_kernel_postgresql"
 module-root = ""
 
 [dependency-groups]
 format = [
-    "ruff==0.15.20"
+    "ruff==0.15.21"
 ]
 lint = [
     "codespell==2.4.2",
-    "ty==0.0.55"
+    "ty==0.0.59"
 ]
 unit = [
-    "coverage[toml]==7.14.3",
+    "coverage[toml]==7.15.1",
     "pytest==9.1.1"
 ]
 

{postgresql_charms_single_kernel-16.3.2 → postgresql_charms_single_kernel-16.3.4}/single_kernel_postgresql/charms/abstract_charm.py

@@ -9,6 +9,7 @@ from ops.charm import CharmBase
 
 from single_kernel_postgresql.core.state import CharmState
 from single_kernel_postgresql.events.postgresql import PostgreSQLEventsHandler
+from single_kernel_postgresql.events.tls import TLS
 from single_kernel_postgresql.managers.cluster import ClusterManager
 from single_kernel_postgresql.managers.config import ConfigManager
 from single_kernel_postgresql.managers.patroni import PatroniManager
@@ -28,8 +29,17 @@ class AbstractPostgreSQLCharm(CharmBase, ABC):
         # State
         self.state = CharmState(charm=self, substrate=self.substrate)
 
+        # TLS events handler owns the two certificate requirers; build it before the
+        # TLS manager so the manager can constructor-inject them for its live-fetch getters.
+        self.tls = TLS(self, self.state)
+
         # Managers
-        self.tls_manager = TLSManager(state=self.state, workload=self.workload)
+        self.tls_manager = TLSManager(
+            state=self.state,
+            workload=self.workload,
+            client_certificate=self.tls.client_certificate,
+            peer_certificate=self.tls.peer_certificate,
+        )
         self.patroni_manager = PatroniManager(state=self.state, workload=self.workload)
         self.cluster_manager = ClusterManager(state=self.state, workload=self.workload)
         self.config_manager = ConfigManager(state=self.state, workload=self.workload)

{postgresql_charms_single_kernel-16.3.2 → postgresql_charms_single_kernel-16.3.4}/single_kernel_postgresql/config/literals.py

@@ -52,6 +52,10 @@ PGBACKREST_CONF_FILE = "pgbackrest.conf"
 ## TLS Paths
 TLS_CA_BUNDLE_FILE = "peer_ca_bundle.pem"
 
+# TLS relation names
+TLS_CLIENT_RELATION = "client-certificates"
+TLS_PEER_RELATION = "peer-certificates"
+
 # Scopes
 SCOPES = Literal["app", "unit"]
 APP_SCOPE = "app"

{postgresql_charms_single_kernel-16.3.2 → postgresql_charms_single_kernel-16.3.4}/single_kernel_postgresql/core/peer_relation.py

@@ -100,6 +100,24 @@ class PostgreSQLPeer(RelationState):
         """Set internal private key in the peer relation."""
         self.set_secret("internal-key", value)
 
+    @property
+    def current_ca(self) -> str | None:
+        """Current peer CA (unit secret); part of the peer CA bundle."""
+        return self.get_secret("current-ca")
+
+    @current_ca.setter
+    def current_ca(self, value: str) -> None:
+        self.set_secret("current-ca", value)
+
+    @property
+    def old_ca(self) -> str | None:
+        """Previous peer CA (unit secret); retained for the rotation window."""
+        return self.get_secret("old-ca")
+
+    @old_ca.setter
+    def old_ca(self, value: str) -> None:
+        self.set_secret("old-ca", value)
+
     @property
     def ip(self) -> str | None:
         """Get the unit's IP address from the peer relation data."""
@@ -144,6 +162,13 @@ class PostgreSQLPeer(RelationState):
             return None
         return self.relation.data[self.unit].get("database-peers-address", None)
 
+    @property
+    def database_address(self) -> str | None:
+        """Get the client-facing database endpoint address."""
+        if not self.relation:
+            return None
+        return self.relation.data[self.unit].get("database-address", None)
+
     @property
     def replication_address(self) -> str | None:
         """Get the address to be used for replication communication."""
@@ -207,6 +232,27 @@ class PostgreSQLPeer(RelationState):
             return {}
         return self.relation.data[self.unit]
 
+    @property
+    def peer_addresses_no_ip(self) -> set[str]:
+        """Peer addresses excluding the ``ip`` databag key (original K8s charm behavior).
+
+        The K8s charm never wrote ``ip`` into the operator peer-cert SANs; it relied on
+        ``database-peers-address`` + ``replication-address`` + ``replication-offer-address``
+        + ``private-address``. The VM charm additionally included ``ip``. This property
+        exposes the K8s-shaped set so :class:`CharmState` can pick the right one per
+        substrate without the peer object needing to know the substrate.
+        """
+        peer_addrs: set[str] = set()
+        if addr := self.database_peers_address:
+            peer_addrs.add(addr)
+        if addr := self.replication_address:
+            peer_addrs.add(addr)
+        if addr := self.replication_offer_address:
+            peer_addrs.add(addr)
+        if addr := self.private_address:
+            peer_addrs.add(addr)
+        return peer_addrs
+
 
 class PostgreSQLApplication(RelationState):
     """An PostgreSQL Application is the peer application state.

{postgresql_charms_single_kernel-16.3.2 → postgresql_charms_single_kernel-16.3.4}/single_kernel_postgresql/core/state.py

@@ -8,11 +8,12 @@ import re
 import socket
 from contextlib import suppress
 from functools import cached_property
-from typing import TYPE_CHECKING, Any, get_args
+from typing import Any, get_args
 
 from data_platform_helpers.advanced_statuses import StatusesState, StatusObject
 from data_platform_helpers.advanced_statuses.types import Scope as AdvancedStatusesScope
 from ops import (
+    CharmBase,
     ConfigData,
     JujuVersion,
     ModelError,
@@ -43,16 +44,13 @@ from single_kernel_postgresql.utils import unit_name_to_pod_name
 from single_kernel_postgresql.utils.secret import translate_field_to_secret_key
 from single_kernel_postgresql.utils.status import format_status
 
-if TYPE_CHECKING:
-    from single_kernel_postgresql.charms.abstract_charm import AbstractPostgreSQLCharm
-
 
 class CharmState(Object):
     """The global PostgreSQL Charm State."""
 
     def __init__(
         self,
-        charm: "AbstractPostgreSQLCharm",
+        charm: CharmBase,
         substrate: Substrates,
     ) -> None:
         """Initialize the CharmState object."""
@@ -245,13 +243,62 @@ class CharmState(Object):
     @property
     def common_hosts(self) -> set[str]:
         """Common hosts to be used in TLS certificate SANs."""
-        return {self.host, self.fqdn} if self.fqdn else {self.host}
+        hosts = {self.host, self.fqdn} if self.fqdn else {self.host}
+        if self.substrate == Substrates.K8S:
+            namespace = self.model.name
+            hosts |= {
+                f"{self.model.app.name}-primary.{namespace}.svc.cluster.local",
+                f"{self.model.app.name}-replicas.{namespace}.svc.cluster.local",
+                # the original K8s charm also included the resolved per-pod FQDN.
+                socket.getfqdn(),
+            }
+        return hosts
 
     @property
     def peer_common_name(self) -> str:
         """Return the common name for the internally generated peer certificate."""
+        if self.substrate == Substrates.K8S:
+            return self._k8s_cert_common_name
         return self.peer.database_peers_address or self.host
 
+    @property
+    def client_addresses(self) -> set[str]:
+        """Client-facing addresses for the operator client certificate SANs."""
+        addrs: set[str] = set()
+        if addr := self.peer.database_address:
+            addrs.add(addr)
+        return addrs
+
+    @property
+    def client_common_name(self) -> str:
+        """Common name for the operator client certificate."""
+        if self.substrate == Substrates.K8S:
+            return self._k8s_cert_common_name
+        return self.peer.database_address or self.host
+
+    @property
+    def _k8s_cert_common_name(self) -> str:
+        """K8s operator-cert CN: the unit endpoints FQDN, wildcarded if too long.
+
+        Matches the original K8s charm: ``<app>-<unit_id>.<app>-endpoints``, collapsing to
+        ``*.<app>-endpoints`` when the full FQDN exceeds the 64-char CN limit.
+        """
+        full = self._get_hostname_from_unit(unit_name_to_pod_name(self.model.unit.name))
+        if len(full) > 64:
+            return f"*.{self.model.app.name}-endpoints"
+        return full
+
+    @property
+    def peer_addresses(self) -> set[str]:
+        """Peer addresses for the operator peer certificate SANs (substrate-aware).
+
+        K8s excludes the ``ip`` databag key (original K8s charm never added an ``ip`` SAN);
+        VM keeps it (unchanged from pre-migration behavior).
+        """
+        if self.substrate == Substrates.K8S:
+            return self.peer.peer_addresses_no_ip
+        return self.peer.peer_addresses
+
     @property
     def listen_ips(self) -> list[str]:
         """Return the IPs to listen on.

postgresql_charms_single_kernel-16.3.4/single_kernel_postgresql/events/tls.py

@@ -0,0 +1,151 @@
+# Copyright 2026 Canonical Ltd.
+# See LICENSE file for licensing details.
+"""TLS events handler — owns the operator-certificate requirers, delegates to TLSManager."""
+
+import logging
+
+from charmlibs.interfaces.tls_certificates import (
+    CertificateRequestAttributes,
+    TLSCertificatesRequiresV4,
+)
+from ops import EventSource
+from ops.framework import EventBase, Object
+
+from single_kernel_postgresql.config.exceptions import PostgreSQLFileOperationError
+from single_kernel_postgresql.config.literals import (
+    PEER_RELATION,
+    TLS_CLIENT_RELATION,
+    TLS_PEER_RELATION,
+)
+
+logger = logging.getLogger(__name__)
+
+
+class RefreshTLSCertificatesEvent(EventBase):
+    """Event emitted to trigger a re-request of TLS certificates with updated SANs."""
+
+
+class TLS(Object):
+    """Owns the client/peer certificate requirers and pushes assigned certs to the workload.
+
+    Operator-certificate handler: observes certificate_available and triggers a
+    file-push via TLSManager. Also owns the refresh_tls_certificates_event that
+    re-requests certificates whenever SANs change (emitted on peer relation_changed).
+
+    Design notes
+    ------------
+    1. **Live-fetch model.** Operator cert/key are read live from the requirers
+       (TLSManager.get_*_tls_files call get_assigned_certificates() on demand) and are
+       never persisted — matching the pre-port charm. Only the peer CA is tracked in
+       state (``current-ca`` / ``old-ca``) so the CA bundle can include the previous CA
+       across a rotation; the requirer holds only the current cert. The manager is
+       constructor-injected with these requirers and reads from them at call time.
+
+    2. **CA bundle terminology.** The ``current_ca`` term used in state mirrors the
+       charm's live operator-CA term. It refers to the most recent peer CA from the TLS
+       operator, not the internal self-signed CA.
+
+    3. **SANs and the relation_changed trigger.** The ``relation_changed``-driven
+       ``refresh_tls_certificates_event`` is a stand-in for the charm's IP-change
+       trigger.  The client/peer SANs in the certificate requests remain inert until
+       the cluster (address-writer) code migrates and starts writing
+       ``database-address`` / ``database-peers-address`` keys into the peer databag.
+    """
+
+    refresh_tls_certificates_event = EventSource(RefreshTLSCertificatesEvent)
+
+    def __init__(self, charm, state):
+        super().__init__(charm, key="tls")
+        self.charm = charm
+        self.state = state
+
+        client_addresses = self.state.client_addresses
+        peer_addresses = self.state.peer_addresses
+
+        self.client_certificate = TLSCertificatesRequiresV4(
+            self.charm,
+            TLS_CLIENT_RELATION,
+            certificate_requests=[
+                CertificateRequestAttributes(
+                    common_name=self.state.client_common_name,
+                    sans_ip=frozenset(client_addresses),
+                    sans_dns=frozenset({*self.state.common_hosts, *client_addresses}),
+                ),
+            ],
+            refresh_events=[self.refresh_tls_certificates_event],
+        )
+        self.peer_certificate = TLSCertificatesRequiresV4(
+            self.charm,
+            TLS_PEER_RELATION,
+            certificate_requests=[
+                CertificateRequestAttributes(
+                    common_name=self.state.peer_common_name,
+                    sans_ip=frozenset(peer_addresses),
+                    sans_dns=frozenset({*self.state.common_hosts, *peer_addresses}),
+                ),
+            ],
+            refresh_events=[self.refresh_tls_certificates_event],
+        )
+
+        # The TLS manager is constructor-injected with these requirers (built in
+        # AbstractPostgreSQLCharm right after this handler); its live-fetch getters
+        # read cert/key from them. This handler reaches the manager via self.charm.
+
+        self.framework.observe(
+            self.client_certificate.on.certificate_available, self._on_certificate_available
+        )
+        self.framework.observe(
+            self.peer_certificate.on.certificate_available, self._on_peer_certificate_available
+        )
+        self.framework.observe(
+            self.charm.on[TLS_CLIENT_RELATION].relation_broken, self._on_certificate_available
+        )
+        self.framework.observe(
+            self.charm.on[TLS_PEER_RELATION].relation_broken, self._on_peer_certificate_available
+        )
+        self.framework.observe(
+            self.charm.on[PEER_RELATION].relation_changed, self._on_peer_relation_changed
+        )
+
+    def _on_peer_relation_changed(self, event) -> None:
+        """Re-request certificates when peer addresses change.
+
+        Fires on any peer-databag change: the address keys this should key on
+        (``database-address`` / ``database-peers-address``) are only written once
+        the cluster address-writer code migrates (see design note 3 above), and
+        the requirer no-ops when the resulting SANs are unchanged.
+        """
+        self.refresh_tls_certificates_event.emit()
+
+    def _push_tls_files(self, event) -> None:
+        """Guard-then-push helper: defer if the workload is not yet ready.
+
+        Two conditions must hold before files can be written:
+        1. The internal CA secret must exist — it is written by the leader on
+           leader-elected, so non-leaders and early hooks may see it absent.
+        2. The workload must accept file writes — on K8s the Pebble container
+           may not be ready yet, causing PostgreSQLFileOperationError.
+        """
+        if not self.state.application.internal_ca:
+            logger.debug("Internal CA not yet present; deferring TLS file push.")
+            event.defer()
+            return
+        try:
+            self.charm.tls_manager.push_tls_files()
+        except PostgreSQLFileOperationError:
+            logger.debug("Workload not ready for TLS file write; deferring.")
+            event.defer()
+
+    def _on_certificate_available(self, event) -> None:
+        """Push TLS files; the operator client cert/key is read live at push time."""
+        self._push_tls_files(event)
+
+    def _on_peer_certificate_available(self, event) -> None:
+        """Rotate the peer CA if it changed, then push (cert/key read live at push time)."""
+        certs, _ = self.peer_certificate.get_assigned_certificates()
+        new_ca = str(certs[0].ca) if certs else None
+        if new_ca is not None:
+            self.charm.tls_manager.rotate_peer_ca(new_ca)
+        else:
+            self.charm.tls_manager.clear_peer_ca()
+        self._push_tls_files(event)

{postgresql_charms_single_kernel-16.3.2 → postgresql_charms_single_kernel-16.3.4}/single_kernel_postgresql/managers/patroni.py

@@ -251,7 +251,11 @@ class PatroniManager(BaseManager):
                 couldn't be retrieved yet.
         """
         # Request info from cluster endpoint (which returns all members of the cluster).
-        cluster_status = self.cluster_status()
+        try:
+            cluster_status = self.cluster_status()
+        except RetryError:
+            logger.debug("Unable to get member status. Cluster status unreachable")
+            return ""
         if cluster_status:
             for member in cluster_status:
                 if member["name"] == member_name:

postgresql_charms_single_kernel-16.3.4/single_kernel_postgresql/managers/tls.py

@@ -0,0 +1,250 @@
+#!/usr/bin/env python3
+# Copyright 2025 Canonical Ltd.
+# See LICENSE file for licensing details.
+
+"""TLS Manager.
+
+Responsible for managing the TLS configuration of the PostgreSQL instance.
+"""
+
+import logging
+from datetime import timedelta
+
+from charmlibs.interfaces.tls_certificates import (
+    Certificate,
+    PrivateKey,
+    TLSCertificatesRequiresV4,
+    generate_ca,
+    generate_certificate,
+    generate_csr,
+    generate_private_key,
+)
+from data_platform_helpers.advanced_statuses import StatusObject
+from data_platform_helpers.advanced_statuses.types import Scope as AdvancedStatusesScope
+
+from single_kernel_postgresql.config.exceptions import PostgreSQLFileOperationError, TlsError
+from single_kernel_postgresql.config.literals import (
+    APP_SCOPE,
+    TLS_CA_BUNDLE_FILE,
+    TLS_CA_FILE,
+    TLS_CERT_FILE,
+    TLS_KEY_FILE,
+)
+from single_kernel_postgresql.config.statuses import GeneralStatuses
+from single_kernel_postgresql.core.state import CharmState
+from single_kernel_postgresql.managers.base import BaseManager
+from single_kernel_postgresql.workload.base import BaseWorkload
+
+logger = logging.getLogger(__name__)
+
+
+class TLSManager(BaseManager):
+    """PostgreSQL TLS Manager.
+
+    This manager is responsible for handling TLS configuration operations.
+    """
+
+    def __init__(
+        self,
+        state: CharmState,
+        workload: BaseWorkload,
+        client_certificate: TLSCertificatesRequiresV4,
+        peer_certificate: TLSCertificatesRequiresV4,
+    ) -> None:
+        super().__init__(state, workload, "tls_manager")
+        # Operator-certificate requirers, constructor-injected by events.tls.TLS.
+        # The getters below fetch cert/key LIVE from the durable relation databag — no
+        # operator cert/key is persisted to state (matches the pre-port charm). Only the
+        # peer CA is tracked in state (current-ca / old-ca), for rotation.
+        self.client_certificate = client_certificate
+        self.peer_certificate = peer_certificate
+
+    def configure_internal_peer_ca(self) -> None:
+        """Configure TLS internal peer CA."""
+        if not self.state.get_secret(APP_SCOPE, "internal-ca"):
+            self.generate_internal_peer_ca()
+
+    def configure_internal_peer_cert(self) -> None:
+        """Configure TLS internal peer certificate."""
+        if not self.state.peer.internal_cert:
+            self.generate_internal_peer_cert()
+
+    def generate_internal_peer_cert(self) -> None:
+        """Generate internal peer certificate using the tls lib."""
+        if not (ca_key_secret := self.state.application.internal_ca_key):
+            raise TlsError("No CA key content.")
+        ca_key = PrivateKey.from_string(ca_key_secret)
+        if not (ca_secret := self.state.application.internal_ca):
+            raise TlsError("No CA cert content.")
+        ca = Certificate.from_string(ca_secret)
+        private_key = generate_private_key()
+        csr = generate_csr(
+            private_key,
+            common_name=self.state.peer_common_name,
+            # substrate-aware: K8s excludes the ip SAN (matches the original charm).
+            sans_ip=frozenset(self.state.peer_addresses),
+            sans_dns=frozenset({
+                *self.state.common_hosts,
+                # IP address need to be part of the DNS SANs list due to
+                # https://github.com/pgbackrest/pgbackrest/issues/1977.
+                *self.state.peer_addresses,
+            }),
+        )
+        cert = generate_certificate(csr, ca, ca_key, validity=timedelta(days=7300))
+        self.state.peer.internal_cert = str(cert)
+        self.state.peer.internal_key = str(private_key)
+
+        # NOTE: pushing the internal-peer cert/CA to disk is owned by the config
+        # subsystem (not yet migrated); operator certs are pushed via
+        # TLSManager.push_tls_files from the events.tls handler.
+        logger.info(
+            "Internal peer certificate generated. Please use a proper TLS operator if possible."
+        )
+
+    def generate_internal_peer_ca(self) -> None:
+        """Generate internal peer CA using the tls lib."""
+        private_key = generate_private_key()
+        ca = generate_ca(
+            private_key,
+            common_name=self.state.internal_peer_ca_common_name,
+            validity=timedelta(days=7300),
+        )
+        logger.warning("Internal peer CA generated. Please use a proper TLS operator if possible.")
+        self.state.set_secret(APP_SCOPE, "internal-ca-key", str(private_key))
+        self.state.set_secret(APP_SCOPE, "internal-ca", str(ca))
+
+    def rotate_peer_ca(self, ca: str) -> None:
+        """Track the operator peer CA for rotation (current-ca -> old-ca).
+
+        Only the CA is tracked in state; the operator cert/key are fetched live
+        from the requirer.
+        """
+        if ca != self.state.peer.current_ca:
+            if self.state.peer.current_ca:
+                self.state.peer.old_ca = self.state.peer.current_ca
+            else:
+                # Re-enabling after a disable cleared current-ca: nothing is being
+                # rotated out, so drop any stale old CA left from before the disable.
+                self.state.peer.remove_secret("old-ca")
+            self.state.peer.current_ca = ca
+
+    def clear_peer_ca(self) -> None:
+        """Retire the operator peer CA into old-ca on relation removal."""
+        current = self.state.peer.current_ca
+        if current:
+            self.state.peer.old_ca = current
+        self.state.peer.remove_secret("current-ca")
+
+    def get_client_tls_files(self) -> tuple[str | None, str | None, str | None]:
+        """Return (key, ca, cert) for the operator client cert, fetched live.
+
+        Reads from the requirer's assigned certificate (the durable relation
+        databag) rather than persisted state — matches the pre-port charm.
+        """
+        key = ca = cert = None
+        if self.client_certificate is not None:
+            certs, private_key = self.client_certificate.get_assigned_certificates()
+            if private_key:
+                key = str(private_key)
+            if certs:
+                cert = str(certs[0].certificate)
+                ca = str(certs[0].ca)
+        return key, ca, cert
+
+    def client_tls_files_on_disk(self) -> bool:
+        """Whether the client TLS files this unit serves are present on disk.
+
+        The reload bridge checks this before enabling TLS in the config so it never
+        renders ssl:on against files the push has not yet written: on K8s the Pebble
+        push can defer while the local config render would still succeed. A workload
+        that cannot be read (container down) counts as not-on-disk, so the caller defers.
+        """
+        tls = self.workload.paths.tls
+        try:
+            return all(
+                self.workload.exists(tls / f) for f in (TLS_KEY_FILE, TLS_CERT_FILE, TLS_CA_FILE)
+            )
+        except PostgreSQLFileOperationError:
+            return False
+
+    def get_peer_ca_bundle(self) -> str:
+        """Compose the peer CA bundle: live operator CA, old CA, internal CA.
+
+        The current operator CA is read live from the requirer (pre-port style);
+        the old CA and internal CA come from state.
+        """
+        operator_ca = ""
+        if self.peer_certificate is not None:
+            certs, _ = self.peer_certificate.get_assigned_certificates()
+            operator_ca = str(certs[0].ca) if certs else ""
+        cas = [
+            operator_ca,
+            self.state.peer.old_ca,
+            self.state.get_secret(APP_SCOPE, "internal-ca"),
+        ]
+        return "\n".join(ca for ca in cas if ca).strip()
+
+    def get_peer_tls_files(self) -> tuple[str | None, str | None, str | None]:
+        """Return (key, ca, cert) for the peer certificate, operator cert fetched live.
+
+        Prefers the operator-provided peer material (read live from the requirer,
+        with the composed CA bundle); falls back to the internally generated peer
+        material.
+        """
+        key = cert = None
+        if self.peer_certificate is not None:
+            certs, private_key = self.peer_certificate.get_assigned_certificates()
+            if private_key:
+                key = str(private_key)
+            if certs:
+                cert = str(certs[0].certificate)
+        if not all((key, cert)):
+            return (
+                self.state.peer.internal_key,
+                self.state.get_secret(APP_SCOPE, "internal-ca"),
+                self.state.peer.internal_cert,
+            )
+        return key, self.get_peer_ca_bundle(), cert
+
+    def _write_tls_file(self, content: str, path) -> None:
+        """Write a TLS file with substrate-specific permissions and ownership.
+
+        The mode comes from the workload (VM 0o600, K8s 0o400, matching the
+        pre-migration charms). Ownership is forwarded through pathops so it works
+        on both VM (LocalPath uses os.chown) and K8s (ContainerPath uses Pebble push).
+        """
+        self.workload.write_text(
+            content,
+            path,
+            self.workload.tls_file_mode,
+            user=self.workload.user,
+            group=self.workload.group,
+        )
+
+    def push_tls_files(self) -> None:
+        """Write the client, peer, and CA-bundle TLS files to the workload."""
+        tls = self.workload.paths.tls
+
+        key, ca, cert = self.get_client_tls_files()
+        if key is not None:
+            self._write_tls_file(key, tls / TLS_KEY_FILE)
+        if ca is not None:
+            self._write_tls_file(ca, tls / TLS_CA_FILE)
+        if cert is not None:
+            self._write_tls_file(cert, tls / TLS_CERT_FILE)
+
+        key, ca, cert = self.get_peer_tls_files()
+        if key is not None:
+            self._write_tls_file(key, tls / f"peer_{TLS_KEY_FILE}")
+        if ca is not None:
+            self._write_tls_file(ca, tls / f"peer_{TLS_CA_FILE}")
+        if cert is not None:
+            self._write_tls_file(cert, tls / f"peer_{TLS_CERT_FILE}")
+
+        self._write_tls_file(self.get_peer_ca_bundle(), tls / TLS_CA_BUNDLE_FILE)
+
+    def get_statuses(
+        self, scope: AdvancedStatusesScope, recompute: bool = False
+    ) -> list[StatusObject]:
+        """Compute the manager's statuses."""
+        return [GeneralStatuses.ACTIVE_IDLE.value]

{postgresql_charms_single_kernel-16.3.2 → postgresql_charms_single_kernel-16.3.4}/single_kernel_postgresql/workload/base.py

@@ -41,6 +41,27 @@ class BaseWorkload(ABC):
         """Return the root path."""
         pass
 
+    @property
+    @abstractmethod
+    def user(self) -> str:
+        """The OS user that owns workload files (substrate-specific)."""
+        pass
+
+    @property
+    @abstractmethod
+    def group(self) -> str:
+        """The OS group that owns workload files (substrate-specific)."""
+        pass
+
+    @property
+    def tls_file_mode(self) -> int:
+        """File mode for TLS material written to disk.
+
+        Defaults to 0o600 (VM); K8s overrides to 0o400 to match the
+        pre-migration charm.
+        """
+        return 0o600
+
     @abstractmethod
     def install(self) -> None:
         """Install the workload."""
@@ -59,7 +80,12 @@ class BaseWorkload(ABC):
         pass
 
     def write_text(
-        self, content: str, path: pathops.PathProtocol, mode: int | None = None
+        self,
+        content: str,
+        path: pathops.PathProtocol,
+        mode: int | None = None,
+        user: str | None = None,
+        group: str | None = None,
     ) -> None:
         """Write content to a file on disk.
 
@@ -67,18 +93,22 @@ class BaseWorkload(ABC):
             content (str): The content to be written.
             path (pathops.PathProtocol): The file path where the content should be written.
             mode (int, optional): The mode/permissions to use when writing the file.
+            user (str, optional): The user to own the file (forwarded to pathops for
+                substrate-correct chown: os.chown on VM, Pebble push on K8s).
+            group (str, optional): The group to own the file (forwarded to pathops).
 
         Raises:
             PostgreSQLFileOperationError: If there is an error during the file write operation.
         """
         try:
-            path.write_text(content, mode=mode)
+            path.write_text(content, mode=mode, user=user, group=group)
         except (
             FileNotFoundError,
             LookupError,
             NotADirectoryError,
             PermissionError,
             pathops.PebbleConnectionError,
+            PebbleError,
             ValueError,
         ) as e:
             raise PostgreSQLFileOperationError(e) from e

{postgresql_charms_single_kernel-16.3.2 → postgresql_charms_single_kernel-16.3.4}/single_kernel_postgresql/workload/k8s.py

@@ -167,6 +167,21 @@ class K8sWorkload(BaseWorkload):
                 except PostgreSQLFileOperationError as e:
                     logger.warning(f"Failed to delete temporary file {file_path}: {e}")
 
+    @property
+    def user(self) -> str:
+        """The OS user that owns workload files in the K8s container."""
+        return "postgres"
+
+    @property
+    def group(self) -> str:
+        """The OS group that owns workload files in the K8s container."""
+        return "postgres"
+
+    @property
+    def tls_file_mode(self) -> int:
+        """K8s pushes TLS material owner-read-only, matching the original charm."""
+        return 0o400
+
     @property
     def root(self) -> PathProtocol:
         """Return the root path for container filesystem.

{postgresql_charms_single_kernel-16.3.2 → postgresql_charms_single_kernel-16.3.4}/single_kernel_postgresql/workload/paths/base.py

@@ -82,3 +82,9 @@ class Paths(ABC):
     def pgbackrest_conf(self) -> PathProtocol:
         """Path to the patroni logs."""
         pass
+
+    @property
+    @abstractmethod
+    def tls(self) -> PathProtocol:
+        """Directory where TLS files are written for this substrate."""
+        pass

{postgresql_charms_single_kernel-16.3.2 → postgresql_charms_single_kernel-16.3.4}/single_kernel_postgresql/workload/paths/k8s.py

@@ -60,7 +60,22 @@ class K8sPaths(Paths):
 
     @property
     def patroni_conf(self) -> PathProtocol:
-        """Path to the patroni configuration file."""
+        """Path to the patroni configuration directory.
+
+        This is the data storage root (``/var/lib/pg/data``) where the Patroni
+        config subsystem renders ``patroni.yaml`` — matching #172's Patroni port.
+        (The TLS ``.pem`` files go to the ``tls`` path, which is the same dir.)
+        """
+        return self.root / K8S_DATA_PATH
+
+    @property
+    def tls(self) -> PathProtocol:
+        """Directory where TLS files are written on K8s (the data dir Patroni reads from).
+
+        This is the *unversioned* data storage root (``/var/lib/pg/data``), which is
+        where the charm-rendered patroni.yml references the ``.pem`` files
+        (``{storage_path}/*.pem``) — NOT the versioned ``data`` subdir (``.../16/main``).
+        """
         return self.root / K8S_DATA_PATH
 
     @property

{postgresql_charms_single_kernel-16.3.2 → postgresql_charms_single_kernel-16.3.4}/single_kernel_postgresql/workload/paths/vm.py

@@ -74,6 +74,11 @@ class VMPaths(Paths):
         """Path to the patroni.yaml file."""
         return self.snap_current / PATRONI_CONF_PATH
 
+    @property
+    def tls(self) -> PathProtocol:
+        """Directory where TLS files are written on VM (same as patroni_conf)."""
+        return self.patroni_conf
+
     @property
     def patroni_logs(self) -> PathProtocol:
         """Path to the patroni logs."""

{postgresql_charms_single_kernel-16.3.2 → postgresql_charms_single_kernel-16.3.4}/single_kernel_postgresql/workload/vm.py

@@ -195,6 +195,16 @@ class VMWorkload(BaseWorkload):
                 except OSError as e:
                     raise e
 
+    @property
+    def user(self) -> str:
+        """The OS user that owns workload files on VM."""
+        return "_daemon_"
+
+    @property
+    def group(self) -> str:
+        """The OS group that owns workload files on VM."""
+        return "_daemon_"
+
     @property
     def paths(self) -> BasePaths:
         """Return Workload's paths."""

postgresql_charms_single_kernel-16.3.2/single_kernel_postgresql/managers/tls.py

@@ -1,100 +0,0 @@
-#!/usr/bin/env python3
-# Copyright 2025 Canonical Ltd.
-# See LICENSE file for licensing details.
-
-"""TLS Manager.
-
-Responsible for managing the TLS configuration of the PostgreSQL instance.
-"""
-
-import logging
-from datetime import timedelta
-
-from charmlibs.interfaces.tls_certificates import (
-    Certificate,
-    PrivateKey,
-    generate_ca,
-    generate_certificate,
-    generate_csr,
-    generate_private_key,
-)
-from data_platform_helpers.advanced_statuses import StatusObject
-from data_platform_helpers.advanced_statuses.types import Scope as AdvancedStatusesScope
-
-from single_kernel_postgresql.config.exceptions import TlsError
-from single_kernel_postgresql.config.literals import (
-    APP_SCOPE,
-)
-from single_kernel_postgresql.config.statuses import GeneralStatuses
-from single_kernel_postgresql.core.state import CharmState
-from single_kernel_postgresql.managers.base import BaseManager
-from single_kernel_postgresql.workload.base import BaseWorkload
-
-logger = logging.getLogger(__name__)
-
-
-class TLSManager(BaseManager):
-    """PostgreSQL TLS Manager.
-
-    This manager is responsible for handling TLS configuration operations.
-    """
-
-    def __init__(self, state: CharmState, workload: BaseWorkload):
-        super().__init__(state, workload, "tls_manager")
-
-    def configure_internal_peer_ca(self) -> None:
-        """Configure TLS internal peer CA."""
-        if not self.state.get_secret(APP_SCOPE, "internal-ca"):
-            self.generate_internal_peer_ca()
-
-    def configure_internal_peer_cert(self) -> None:
-        """Configure TLS internal peer certificate."""
-        if not self.state.peer.internal_cert:
-            self.generate_internal_peer_cert()
-
-    def generate_internal_peer_cert(self) -> None:
-        """Generate internal peer certificate using the tls lib."""
-        if not (ca_key_secret := self.state.application.internal_ca_key):
-            raise TlsError("No CA key content.")
-        ca_key = PrivateKey.from_string(ca_key_secret)
-        if not (ca_secret := self.state.application.internal_ca):
-            raise TlsError("No CA cert content.")
-        ca = Certificate.from_string(ca_secret)
-        private_key = generate_private_key()
-        csr = generate_csr(
-            private_key,
-            common_name=self.state.peer_common_name,
-            sans_ip=frozenset(self.state.peer.peer_addresses),
-            sans_dns=frozenset({
-                *self.state.common_hosts,
-                # IP address need to be part of the DNS SANs list due to
-                # https://github.com/pgbackrest/pgbackrest/issues/1977.
-                *self.state.peer.peer_addresses,
-            }),
-        )
-        cert = generate_certificate(csr, ca, ca_key, validity=timedelta(days=7300))
-        self.state.peer.internal_cert = str(cert)
-        self.state.peer.internal_key = str(private_key)
-
-        # self.charm.push_tls_files_to_workload()
-        logger.info(
-            "Internal peer certificate generated. Please use a proper TLS operator if possible."
-        )
-
-    def generate_internal_peer_ca(self) -> None:
-        """Generate internal peer CA using the tls lib."""
-        private_key = generate_private_key()
-        ca = generate_ca(
-            private_key,
-            common_name=self.state.internal_peer_ca_common_name,
-            validity=timedelta(days=7300),
-        )
-        logger.warning("Internal peer CA generated. Please use a proper TLS operator if possible.")
-        self.state.set_secret(APP_SCOPE, "internal-ca-key", str(private_key))
-        self.state.set_secret(APP_SCOPE, "internal-ca", str(ca))
-
-    def get_statuses(
-        self, scope: AdvancedStatusesScope, recompute: bool = False
-    ) -> list[StatusObject]:
-        """Compute the manager's statuses."""
-        return [GeneralStatuses.ACTIVE_IDLE.value]