postgresql-charms-single-kernel 16.3.4__tar.gz → 16.3.5__tar.gz

{postgresql_charms_single_kernel-16.3.4 → postgresql_charms_single_kernel-16.3.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: postgresql-charms-single-kernel
-Version: 16.3.4
+Version: 16.3.5
 Summary: Shared and reusable code for PostgreSQL-related charms
 Author: Canonical Data Platform
 Author-email: Canonical Data Platform <data-platform@lists.launchpad.net>
@@ -212,6 +212,8 @@ Classifier: Operating System :: POSIX :: Linux
 Requires-Dist: ops>=2.0.0
 Requires-Dist: tenacity>=9.0.0
 Requires-Dist: psycopg2>=2.9.10 ; extra == 'db-driver'
+Requires-Dist: lightkube>=0.21.0 ; python_full_version >= '3.12' and extra == 'k8s'
+Requires-Dist: lightkube-models>=1.28.1.4 ; python_full_version >= '3.12' and extra == 'k8s'
 Requires-Dist: httpx ; python_full_version >= '3.12' and extra == 'postgresql'
 Requires-Dist: data-platform-helpers>=0.1.7 ; python_full_version >= '3.12' and extra == 'postgresql'
 Requires-Dist: charmlibs-pathops>=1.0.1 ; python_full_version >= '3.12' and extra == 'postgresql'
@@ -228,6 +230,7 @@ Requires-Dist: charmlibs-snap>=1.0.1 ; python_full_version >= '3.12' and extra =
 Requires-Dist: charmlibs-systemd>=1.0.0.post0 ; python_full_version >= '3.12' and extra == 'vm'
 Requires-Python: >=3.8, <4.0
 Provides-Extra: db-driver
+Provides-Extra: k8s
 Provides-Extra: postgresql
 Provides-Extra: vm
 Description-Content-Type: text/markdown

postgresql_charms_single_kernel-16.3.5/pyproject.toml

@@ -0,0 +1,166 @@
+[project]
+name = "postgresql-charms-single-kernel"
+description = "Shared and reusable code for PostgreSQL-related charms"
+version = "16.3.5"
+readme = "README.md"
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Intended Audience :: Developers",
+    "Operating System :: POSIX :: Linux",
+]
+requires-python = ">=3.8,<4.0"
+dependencies = [
+    "ops>=2.0.0",
+    "tenacity>=9.0.0",
+]
+
+[project.license]
+file = "LICENSE"
+
+[[project.authors]]
+name = "Canonical Data Platform"
+email = "data-platform@lists.launchpad.net"
+
+[project.optional-dependencies]
+postgresql = [
+    "httpx; python_version >= '3.12'",
+    "data-platform-helpers>=0.1.7; python_version >= '3.12'",
+    "charmlibs-pathops>=1.0.1; python_version >= '3.12'",
+    "charmlibs-interfaces-tls-certificates>=1.8.3; python_version >= '3.12'",
+    "charm-refresh; python_version >= '3.12'",
+    "requests; python_version >= '3.12'",
+    "tomli; python_version >= '3.12'",
+    "pydantic>=2.0; python_version >= '3.12'",
+    "jinja2 >=3.1.6; python_version >= '3.12'",
+    "charmlibs-rollingops>=1.1.1; python_version >= '3.12'",
+]
+vm = [
+    "pysyncobj>=0.3.15; python_version >= '3.12'",
+    "psutil>=7.2.2; python_version >= '3.12'",
+    "charmlibs-snap>=1.0.1; python_version >= '3.12'",
+    "charmlibs-systemd>=1.0.0.post0; python_version >= '3.12'",
+]
+k8s = [
+    "lightkube>=0.21.0; python_version >= '3.12'",
+    "lightkube-models>=1.28.1.4; python_version >= '3.12'",
+]
+db-driver = ["psycopg2>=2.9.10"]
+
+[build-system]
+requires = ["uv_build>=0.12.1,<0.13.0"]
+build-backend = "uv_build"
+
+[tool.uv]
+exclude-newer = "1 day"
+
+[tool.uv.build-backend]
+module-name = "single_kernel_postgresql"
+module-root = ""
+
+[tool.uv.dependency-groups.unit]
+requires-python = ">=3.12"
+
+[tool.uv.dependency-groups.lint]
+requires-python = ">=3.12"
+
+[tool.uv.dependency-groups.format]
+requires-python = ">=3.12"
+
+[tool.coverage.run]
+branch = true
+
+[tool.coverage.report]
+show_missing = true
+
+[tool.pytest.ini_options]
+minversion = "6.0"
+log_cli_level = "INFO"
+
+[tool.ruff]
+preview = true
+target-version = "py312"
+src = [
+    "src",
+    ".",
+]
+line-length = 99
+
+[tool.ruff.lint]
+explicit-preview-rules = true
+select = [
+    "A",
+    "E",
+    "W",
+    "F",
+    "C",
+    "N",
+    "D",
+    "I001",
+    "B",
+    "CPY001",
+    "RUF",
+    "S",
+    "SIM",
+    "UP",
+    "TCH",
+]
+extend-ignore = [
+    "D203",
+    "D204",
+    "D213",
+    "D215",
+    "D400",
+    "D404",
+    "D406",
+    "D407",
+    "D408",
+    "D409",
+    "D413",
+]
+ignore = [
+    "E501",
+    "D107",
+]
+
+[tool.ruff.lint.per-file-ignores]
+"tests/*" = [
+    "D100",
+    "D101",
+    "D102",
+    "D103",
+    "D104",
+    "B011",
+    "S",
+]
+
+[tool.ruff.lint.flake8-copyright]
+author = "Canonical Ltd."
+notice-rgx = 'Copyright\s\d{4}([-,]\d{4})*\s+'
+min-file-size = 1
+
+[tool.ruff.lint.mccabe]
+max-complexity = 10
+
+[tool.ruff.lint.pydocstyle]
+convention = "google"
+
+[tool.ty.environment]
+python = ".tox/lint/"
+python-version = "3.12"
+
+[tool.ty.src]
+exclude = [
+    "tests",
+    "single_kernel_postgresql/lib",
+]
+
+[dependency-groups]
+format = ["ruff==0.16.3"]
+lint = [
+    "codespell==2.4.3",
+    "ty==0.0.72",
+]
+unit = [
+    "coverage[toml]==7.15.4",
+    "pytest==9.1.1",
+]

postgresql_charms_single_kernel-16.3.4/pyproject.toml → postgresql_charms_single_kernel-16.3.5/pyproject.toml.orig

@@ -4,7 +4,7 @@
 [project]
 name = "postgresql-charms-single-kernel"
 description = "Shared and reusable code for PostgreSQL-related charms"
-version = "16.3.4"
+version = "16.3.5"
 readme = "README.md"
 license = {file = "LICENSE"}
 authors = [
@@ -40,12 +40,16 @@ vm = [
     "charmlibs-snap>=1.0.1; python_version >= '3.12'",
     "charmlibs-systemd>=1.0.0.post0; python_version >= '3.12'"
 ]
+k8s = [
+    "lightkube>=0.21.0; python_version >= '3.12'",
+    "lightkube-models>=1.28.1.4; python_version >= '3.12'",
+]
 db-driver = [
     "psycopg2>=2.9.10",
 ]
 
 [build-system]
-requires = ["uv_build>=0.11.0,<0.12.0"]
+requires = ["uv_build>=0.12.1,<0.13.0"]
 build-backend = "uv_build"
 
 [tool.uv]
@@ -57,14 +61,14 @@ module-root = ""
 
 [dependency-groups]
 format = [
-    "ruff==0.15.21"
+    "ruff==0.16.3"
 ]
 lint = [
-    "codespell==2.4.2",
-    "ty==0.0.59"
+    "codespell==2.4.3",
+    "ty==0.0.72"
 ]
 unit = [
-    "coverage[toml]==7.15.1",
+    "coverage[toml]==7.15.4",
     "pytest==9.1.1"
 ]
 

{postgresql_charms_single_kernel-16.3.4 → postgresql_charms_single_kernel-16.3.5}/single_kernel_postgresql/charms/abstract_charm.py

@@ -42,7 +42,15 @@ class AbstractPostgreSQLCharm(CharmBase, ABC):
         )
         self.patroni_manager = PatroniManager(state=self.state, workload=self.workload)
         self.cluster_manager = ClusterManager(state=self.state, workload=self.workload)
-        self.config_manager = ConfigManager(state=self.state, workload=self.workload)
+        self.config_manager = ConfigManager(
+            state=self.state,
+            workload=self.workload,
+            tls_manager=self.tls_manager,
+            patroni_manager=self.patroni_manager,
+            request_restart=self.request_restart,
+            refresh_endpoints=self.refresh_endpoints,
+            restart_services=self.restart_services,
+        )
 
         # Events Handler
         self.postgresql_events_handler = PostgreSQLEventsHandler(
@@ -84,3 +92,21 @@ class AbstractPostgreSQLCharm(CharmBase, ABC):
     def substrate(self) -> Substrates:
         """Access current substrate."""
         pass
+
+    # Config-update bridges: charm-side callables the ConfigManager invokes for the
+    # substrate-tangled restart trigger, endpoint refresh and monitoring/ldap service
+    # restarts. They stay in the charm until their own migration phases.
+    @abstractmethod
+    def request_restart(self) -> None:
+        """Run the substrate pre-restart side effect and acquire the restart lock."""
+        pass
+
+    @abstractmethod
+    def refresh_endpoints(self) -> None:
+        """Refresh the client relation endpoints."""
+        pass
+
+    @abstractmethod
+    def restart_services(self) -> None:
+        """Restart the monitoring and LDAP-sync sidecar services."""
+        pass

{postgresql_charms_single_kernel-16.3.4 → postgresql_charms_single_kernel-16.3.5}/single_kernel_postgresql/charms/k8s_charm.py

@@ -26,6 +26,7 @@ class PostgreSQLK8sCharm(AbstractPostgreSQLCharm):
             "Workload must be an instance of K8sWorkload"
         )
         self.k8s_manager = K8sManager(self.state, self.workload)
+        self.state.resource_provider = self.k8s_manager
 
     @property
     def postgresql(self) -> PostgreSQL:
@@ -52,7 +53,8 @@ class PostgreSQLK8sCharm(AbstractPostgreSQLCharm):
             BaseWorkload: The K8sWorkload instance for this charm
         """
         return K8sWorkload(
-            charm_dir=self.charm_dir, container=self.unit.get_container(CONTAINER_NAME)
+            charm_dir=self.charm_dir,
+            container=self.unit.get_container(CONTAINER_NAME),
         )
 
     @property
@@ -63,3 +65,15 @@ class PostgreSQLK8sCharm(AbstractPostgreSQLCharm):
             Substrates: always Substrates.K8S for this charm
         """
         return Substrates.K8S
+
+    # The concrete production charm owns these bridges (update_scrape_job_spec +
+    # acquire_lock, update_endpoints, pebble metrics/ldap restarts), so they default to
+    # no-ops here.
+    def request_restart(self) -> None:
+        """Run the substrate pre-restart side effect and acquire the restart lock."""
+
+    def refresh_endpoints(self) -> None:
+        """Refresh the client relation endpoints."""
+
+    def restart_services(self) -> None:
+        """Restart the monitoring and LDAP-sync sidecar services."""

{postgresql_charms_single_kernel-16.3.4 → postgresql_charms_single_kernel-16.3.5}/single_kernel_postgresql/charms/vm_charm.py

@@ -9,7 +9,6 @@ import logging
 from single_kernel_postgresql.charms.abstract_charm import AbstractPostgreSQLCharm, PostgreSQL
 from single_kernel_postgresql.config.enums import Substrates
 from single_kernel_postgresql.config.literals import SYSTEM_USERS, USER
-from single_kernel_postgresql.workload.base import BaseWorkload
 from single_kernel_postgresql.workload.vm import VMWorkload
 
 logger = logging.getLogger(__name__)
@@ -21,6 +20,7 @@ class PostgreSQLVMCharm(AbstractPostgreSQLCharm):
     def __init__(self, *args):
         """Initialize the PostgreSQL VM Charm."""
         super().__init__(*args)
+        self.state.resource_provider = self.workload
 
     @property
     def postgresql(self) -> PostgreSQL:
@@ -38,13 +38,13 @@ class PostgreSQLVMCharm(AbstractPostgreSQLCharm):
         )
 
     @property
-    def workload(self) -> BaseWorkload:
+    def workload(self) -> VMWorkload:
         """Access current workload instance.
 
         Returns the workload object.
 
         Returns:
-            BaseWorkload: The VMWorkload instance for this charm
+            VMWorkload: The VMWorkload instance for this charm
         """
         return VMWorkload(charm_dir=self.charm_dir)
 
@@ -56,3 +56,15 @@ class PostgreSQLVMCharm(AbstractPostgreSQLCharm):
             Substrates: always Substrates.VM for this charm
         """
         return Substrates.VM
+
+    # The concrete production charm owns these bridges (pops postgresql_restarted +
+    # acquire_lock, update_endpoints, snap metrics/ldap restarts), so they default to
+    # no-ops here.
+    def request_restart(self) -> None:
+        """Run the substrate pre-restart side effect and acquire the restart lock."""
+
+    def refresh_endpoints(self) -> None:
+        """Refresh the client relation endpoints."""
+
+    def restart_services(self) -> None:
+        """Restart the monitoring and LDAP-sync sidecar services."""

{postgresql_charms_single_kernel-16.3.4 → postgresql_charms_single_kernel-16.3.5}/single_kernel_postgresql/config/exceptions.py

@@ -73,3 +73,7 @@ class SwitchoverNotSyncError(SwitchoverFailedError):
 
 class UpdateSyncNodeCountError(Exception):
     """Raised when updating synchronous_node_count failed for some reason."""
+
+
+class DeployedWithoutTrustError(Exception):
+    """Raised when the K8s API denies access because the app wasn't deployed with --trust."""

{postgresql_charms_single_kernel-16.3.4 → postgresql_charms_single_kernel-16.3.5}/single_kernel_postgresql/core/peer_relation.py

@@ -225,6 +225,48 @@ class PostgreSQLPeer(RelationState):
             return True
         return self.relation.data[self.unit].get("connectivity", "on") == "on"
 
+    @property
+    def config_hash(self) -> str | None:
+        """Get the last-applied PostgreSQL config hash from the peer relation data."""
+        if not self.relation:
+            return None
+        return self.relation.data[self.unit].get("config_hash")
+
+    @config_hash.setter
+    def config_hash(self, value: str) -> None:
+        """Set the last-applied PostgreSQL config hash in the peer relation data."""
+        if not self.relation:
+            return
+        self.relation.data[self.unit]["config_hash"] = value
+
+    @property
+    def user_hash(self) -> str | None:
+        """Get the last-applied users hash from the peer relation data."""
+        if not self.relation:
+            return None
+        return self.relation.data[self.unit].get("user_hash")
+
+    @user_hash.setter
+    def user_hash(self, value: str) -> None:
+        """Set the last-applied users hash in the peer relation data."""
+        if not self.relation:
+            return
+        self.relation.data[self.unit]["user_hash"] = value
+
+    @property
+    def tls(self) -> bool:
+        """Get the last-rendered TLS flag from the peer relation data."""
+        if not self.relation:
+            return False
+        return self.relation.data[self.unit].get("tls") == "enabled"
+
+    @tls.setter
+    def tls(self, value: bool) -> None:
+        """Set the last-rendered TLS flag in the peer relation data."""
+        if not self.relation:
+            return
+        self.relation.data[self.unit]["tls"] = "enabled" if value else ""
+
     @cached_property
     def data(self) -> MutableMapping[str, str]:
         """Escape hatch method to access the peer data directly."""
@@ -418,6 +460,20 @@ class PostgreSQLApplication(RelationState):
         """Return whether this unit has LDAP enabled."""
         return self.is_ldap_charm_related and self.is_cluster_initialised
 
+    @property
+    def user_hash(self) -> str | None:
+        """Get the last-applied users hash from the peer relation data."""
+        if not self.relation:
+            return None
+        return self.relation.data[self.app].get("user_hash")
+
+    @user_hash.setter
+    def user_hash(self, value: str) -> None:
+        """Set the last-applied users hash in the peer relation data."""
+        if not self.relation:
+            return
+        self.relation.data[self.app]["user_hash"] = value
+
     def get_secret(self, key: str) -> str | None:
         """Get the secret value for 'key' from the peer relation data."""
         if not self.relation:

{postgresql_charms_single_kernel-16.3.4 → postgresql_charms_single_kernel-16.3.5}/single_kernel_postgresql/core/state.py

@@ -8,7 +8,7 @@ import re
 import socket
 from contextlib import suppress
 from functools import cached_property
-from typing import Any, get_args
+from typing import TYPE_CHECKING, Any, get_args
 
 from data_platform_helpers.advanced_statuses import StatusesState, StatusObject
 from data_platform_helpers.advanced_statuses.types import Scope as AdvancedStatusesScope
@@ -44,6 +44,9 @@ from single_kernel_postgresql.utils import unit_name_to_pod_name
 from single_kernel_postgresql.utils.secret import translate_field_to_secret_key
 from single_kernel_postgresql.utils.status import format_status
 
+if TYPE_CHECKING:
+    from single_kernel_postgresql.workload.base import ResourceProvider
+
 
 class CharmState(Object):
     """The global PostgreSQL Charm State."""
@@ -61,6 +64,16 @@ class CharmState(Object):
 
         self.statuses = StatusesState(self, STATUS_PEERS_RELATION)
 
+        # Set by the charm to the substrate's resource introspector (VM workload / K8s manager).
+        self.resource_provider: ResourceProvider | None = None
+
+    @property
+    def available_resources(self) -> tuple[int, int]:
+        """(cpu_cores, memory_bytes) for this unit, via the substrate's provider."""
+        if self.resource_provider is None:
+            raise RuntimeError("resource_provider was not set by the charm")
+        return self.resource_provider.get_available_resources()
+
     # -- Charm Config
     @cached_property
     def config(self) -> CharmConfig:

{postgresql_charms_single_kernel-16.3.4 → postgresql_charms_single_kernel-16.3.5}/single_kernel_postgresql/events/tls.py

@@ -25,6 +25,10 @@ class RefreshTLSCertificatesEvent(EventBase):
     """Event emitted to trigger a re-request of TLS certificates with updated SANs."""
 
 
+class TLSFilesPushedEvent(EventBase):
+    """Event emitted after the handler successfully pushes cert files to the workload."""
+
+
 class TLS(Object):
     """Owns the client/peer certificate requirers and pushes assigned certs to the workload.
 
@@ -50,9 +54,18 @@ class TLS(Object):
        trigger.  The client/peer SANs in the certificate requests remain inert until
        the cluster (address-writer) code migrates and starts writing
        ``database-address`` / ``database-peers-address`` keys into the peer databag.
+
+    4. **Push-completion event.** ``tls_files_pushed`` fires only after a successful
+       ``push_tls_files()``. The charm's reload bridge observes it rather than
+       ``certificate_available`` directly, so a deferred push (Pebble not ready, or the
+       internal CA not yet present) does not trigger a reload against files that were
+       never written -- the retried push is what emits and reloads. Defer is per-observer,
+       so coupling the reload to this event is the only way a deferred push and its reload
+       retry together.
     """
 
     refresh_tls_certificates_event = EventSource(RefreshTLSCertificatesEvent)
+    tls_files_pushed = EventSource(TLSFilesPushedEvent)
 
     def __init__(self, charm, state):
         super().__init__(charm, key="tls")
@@ -118,13 +131,16 @@ class TLS(Object):
         self.refresh_tls_certificates_event.emit()
 
     def _push_tls_files(self, event) -> None:
-        """Guard-then-push helper: defer if the workload is not yet ready.
+        """Guard, push, then emit ``tls_files_pushed`` on success; defer if not ready.
 
         Two conditions must hold before files can be written:
         1. The internal CA secret must exist — it is written by the leader on
            leader-elected, so non-leaders and early hooks may see it absent.
         2. The workload must accept file writes — on K8s the Pebble container
            may not be ready yet, causing PostgreSQLFileOperationError.
+
+        Either guard defers without emitting, so nothing reloads against unwritten files;
+        the emit happens only once the push has actually landed.
         """
         if not self.state.application.internal_ca:
             logger.debug("Internal CA not yet present; deferring TLS file push.")
@@ -135,6 +151,8 @@ class TLS(Object):
         except PostgreSQLFileOperationError:
             logger.debug("Workload not ready for TLS file write; deferring.")
             event.defer()
+            return
+        self.tls_files_pushed.emit()
 
     def _on_certificate_available(self, event) -> None:
         """Push TLS files; the operator client cert/key is read live at push time."""