postgresql-charms-single-kernel 16.3.5__tar.gz → 16.3.7__tar.gz

{postgresql_charms_single_kernel-16.3.5 → postgresql_charms_single_kernel-16.3.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: postgresql-charms-single-kernel
-Version: 16.3.5
+Version: 16.3.7
 Summary: Shared and reusable code for PostgreSQL-related charms
 Author: Canonical Data Platform
 Author-email: Canonical Data Platform <data-platform@lists.launchpad.net>

{postgresql_charms_single_kernel-16.3.5 → postgresql_charms_single_kernel-16.3.7}/pyproject.toml

@@ -1,7 +1,7 @@
 [project]
 name = "postgresql-charms-single-kernel"
 description = "Shared and reusable code for PostgreSQL-related charms"
-version = "16.3.5"
+version = "16.3.7"
 readme = "README.md"
 classifiers = [
     "Development Status :: 3 - Alpha",

{postgresql_charms_single_kernel-16.3.5 → postgresql_charms_single_kernel-16.3.7}/pyproject.toml.orig

@@ -4,7 +4,7 @@
 [project]
 name = "postgresql-charms-single-kernel"
 description = "Shared and reusable code for PostgreSQL-related charms"
-version = "16.3.5"
+version = "16.3.7"
 readme = "README.md"
 license = {file = "LICENSE"}
 authors = [

{postgresql_charms_single_kernel-16.3.5 → postgresql_charms_single_kernel-16.3.7}/single_kernel_postgresql/charms/abstract_charm.py

@@ -5,18 +5,25 @@
 from abc import ABC, abstractmethod
 
 from data_platform_helpers.advanced_statuses import StatusHandler
+from ops import StatusBase
 from ops.charm import CharmBase
 
 from single_kernel_postgresql.core.state import CharmState
+from single_kernel_postgresql.events.database import DatabaseEventsHandler
 from single_kernel_postgresql.events.postgresql import PostgreSQLEventsHandler
 from single_kernel_postgresql.events.tls import TLS
+from single_kernel_postgresql.lib.charms.data_platform_libs.v0.data_interfaces import (
+    DatabaseProvides,
+)
 from single_kernel_postgresql.managers.cluster import ClusterManager
 from single_kernel_postgresql.managers.config import ConfigManager
+from single_kernel_postgresql.managers.database import DatabaseManager
 from single_kernel_postgresql.managers.patroni import PatroniManager
 from single_kernel_postgresql.managers.tls import TLSManager
-from single_kernel_postgresql.workload.base import BaseWorkload
+from single_kernel_postgresql.workload.base import BaseWorkload, ResourceProvider
 
 from ..config.enums import Substrates
+from ..config.literals import DATABASE
 from ..utils.postgresql import PostgreSQL
 
 
@@ -42,13 +49,27 @@ class AbstractPostgreSQLCharm(CharmBase, ABC):
         )
         self.patroni_manager = PatroniManager(state=self.state, workload=self.workload)
         self.cluster_manager = ClusterManager(state=self.state, workload=self.workload)
+
+        # Client-relation subsystem: the charm is the composition root, as with the
+        # other managers; the handler owns only the observers and guard/defer decisions.
+        self.database_manager = DatabaseManager(
+            state=self.state,
+            workload=self.workload,
+            database_provides=DatabaseProvides(self, relation_name=DATABASE),
+            set_unit_status=self.set_unit_status,
+        )
+        self.database = DatabaseEventsHandler(
+            self, self.state, self.database_manager, self.patroni_manager, self.tls_manager
+        )
+
         self.config_manager = ConfigManager(
             state=self.state,
             workload=self.workload,
             tls_manager=self.tls_manager,
             patroni_manager=self.patroni_manager,
+            database_manager=self.database_manager,
+            resource_provider=self.get_resource_provider,
             request_restart=self.request_restart,
-            refresh_endpoints=self.refresh_endpoints,
             restart_services=self.restart_services,
         )
 
@@ -93,20 +114,39 @@ class AbstractPostgreSQLCharm(CharmBase, ABC):
         """Access current substrate."""
         pass
 
-    # Config-update bridges: charm-side callables the ConfigManager invokes for the
-    # substrate-tangled restart trigger, endpoint refresh and monitoring/ldap service
-    # restarts. They stay in the charm until their own migration phases.
+    # Charm-side bridges the lib calls back into. request_restart/restart_services are
+    # substrate-tangled and stay until their own migration phases; update_config still
+    # supplies the ldap/async/watcher values those phases own; primary_endpoint is the
+    # VM's Patroni-derived primary lookup. set_unit_status routes status writes through
+    # the charm_refresh priority gate and stays until the refresh logic itself migrates
+    # into the library, at which point the managers own their status writes.
     @abstractmethod
-    def request_restart(self) -> None:
-        """Run the substrate pre-restart side effect and acquire the restart lock."""
+    def get_resource_provider(self) -> ResourceProvider:
+        """Return the substrate's (cpu_cores, memory_bytes) introspector."""
         pass
 
     @abstractmethod
-    def refresh_endpoints(self) -> None:
-        """Refresh the client relation endpoints."""
+    def request_restart(self) -> None:
+        """Run the substrate pre-restart side effect and acquire the restart lock."""
         pass
 
     @abstractmethod
     def restart_services(self) -> None:
         """Restart the monitoring and LDAP-sync sidecar services."""
         pass
+
+    @abstractmethod
+    def set_unit_status(self, status: StatusBase) -> None:
+        """Set the unit status without overriding a higher-priority refresh status."""
+        pass
+
+    @abstractmethod
+    def update_config(self) -> bool:
+        """Re-render the Patroni configuration and apply it."""
+        pass
+
+    @property
+    @abstractmethod
+    def primary_endpoint(self) -> str | None:
+        """Address of the cluster primary, or None when there is not one."""
+        pass

{postgresql_charms_single_kernel-16.3.5 → postgresql_charms_single_kernel-16.3.7}/single_kernel_postgresql/charms/k8s_charm.py

@@ -6,6 +6,8 @@
 
 import logging
 
+from ops import StatusBase
+
 from single_kernel_postgresql.charms.abstract_charm import AbstractPostgreSQLCharm, PostgreSQL
 from single_kernel_postgresql.config.enums import Substrates
 from single_kernel_postgresql.config.literals import CONTAINER_NAME, SYSTEM_USERS, USER
@@ -26,7 +28,6 @@ class PostgreSQLK8sCharm(AbstractPostgreSQLCharm):
             "Workload must be an instance of K8sWorkload"
         )
         self.k8s_manager = K8sManager(self.state, self.workload)
-        self.state.resource_provider = self.k8s_manager
 
     @property
     def postgresql(self) -> PostgreSQL:
@@ -67,13 +68,27 @@ class PostgreSQLK8sCharm(AbstractPostgreSQLCharm):
         return Substrates.K8S
 
     # The concrete production charm owns these bridges (update_scrape_job_spec +
-    # acquire_lock, update_endpoints, pebble metrics/ldap restarts), so they default to
-    # no-ops here.
+    # acquire_lock, pebble metrics/ldap restarts, the refresh-aware status write and the
+    # config re-render), so they are minimal here.
+    def get_resource_provider(self) -> K8sManager:
+        """Return the substrate's (cpu_cores, memory_bytes) introspector."""
+        return self.k8s_manager
+
     def request_restart(self) -> None:
         """Run the substrate pre-restart side effect and acquire the restart lock."""
 
-    def refresh_endpoints(self) -> None:
-        """Refresh the client relation endpoints."""
-
     def restart_services(self) -> None:
         """Restart the monitoring and LDAP-sync sidecar services."""
+
+    def set_unit_status(self, status: StatusBase) -> None:
+        """Set the unit status without overriding a higher-priority refresh status."""
+        self.unit.status = status
+
+    def update_config(self) -> bool:
+        """Re-render the Patroni configuration and apply it."""
+        return self.config_manager.update_config(self.postgresql)
+
+    @property
+    def primary_endpoint(self) -> str | None:
+        """Address of the cluster primary's Service."""
+        return self.state.primary_endpoint

{postgresql_charms_single_kernel-16.3.5 → postgresql_charms_single_kernel-16.3.7}/single_kernel_postgresql/charms/vm_charm.py

@@ -6,6 +6,8 @@
 
 import logging
 
+from ops import StatusBase
+
 from single_kernel_postgresql.charms.abstract_charm import AbstractPostgreSQLCharm, PostgreSQL
 from single_kernel_postgresql.config.enums import Substrates
 from single_kernel_postgresql.config.literals import SYSTEM_USERS, USER
@@ -20,7 +22,6 @@ class PostgreSQLVMCharm(AbstractPostgreSQLCharm):
     def __init__(self, *args):
         """Initialize the PostgreSQL VM Charm."""
         super().__init__(*args)
-        self.state.resource_provider = self.workload
 
     @property
     def postgresql(self) -> PostgreSQL:
@@ -58,13 +59,28 @@ class PostgreSQLVMCharm(AbstractPostgreSQLCharm):
         return Substrates.VM
 
     # The concrete production charm owns these bridges (pops postgresql_restarted +
-    # acquire_lock, update_endpoints, snap metrics/ldap restarts), so they default to
-    # no-ops here.
+    # acquire_lock, snap metrics/ldap restarts, the refresh-aware status write, the
+    # Patroni-derived primary lookup and the config re-render), so they are minimal here.
+    def get_resource_provider(self) -> VMWorkload:
+        """Return the substrate's (cpu_cores, memory_bytes) introspector."""
+        return self.workload
+
     def request_restart(self) -> None:
         """Run the substrate pre-restart side effect and acquire the restart lock."""
 
-    def refresh_endpoints(self) -> None:
-        """Refresh the client relation endpoints."""
-
     def restart_services(self) -> None:
         """Restart the monitoring and LDAP-sync sidecar services."""
+
+    def set_unit_status(self, status: StatusBase) -> None:
+        """Set the unit status without overriding a higher-priority refresh status."""
+        self.unit.status = status
+
+    def update_config(self) -> bool:
+        """Re-render the Patroni configuration and apply it."""
+        return self.config_manager.update_config(self.postgresql)
+
+    @property
+    def primary_endpoint(self) -> str | None:
+        """Address of the cluster primary, or None when there is not one."""
+        primary = self.patroni_manager.get_primary()
+        return self.patroni_manager.get_member_ip(primary) if primary else None

{postgresql_charms_single_kernel-16.3.5 → postgresql_charms_single_kernel-16.3.7}/single_kernel_postgresql/core/state.py

@@ -8,7 +8,7 @@ import re
 import socket
 from contextlib import suppress
 from functools import cached_property
-from typing import TYPE_CHECKING, Any, get_args
+from typing import Any, get_args
 
 from data_platform_helpers.advanced_statuses import StatusesState, StatusObject
 from data_platform_helpers.advanced_statuses.types import Scope as AdvancedStatusesScope
@@ -44,9 +44,6 @@ from single_kernel_postgresql.utils import unit_name_to_pod_name
 from single_kernel_postgresql.utils.secret import translate_field_to_secret_key
 from single_kernel_postgresql.utils.status import format_status
 
-if TYPE_CHECKING:
-    from single_kernel_postgresql.workload.base import ResourceProvider
-
 
 class CharmState(Object):
     """The global PostgreSQL Charm State."""
@@ -64,16 +61,6 @@ class CharmState(Object):
 
         self.statuses = StatusesState(self, STATUS_PEERS_RELATION)
 
-        # Set by the charm to the substrate's resource introspector (VM workload / K8s manager).
-        self.resource_provider: ResourceProvider | None = None
-
-    @property
-    def available_resources(self) -> tuple[int, int]:
-        """(cpu_cores, memory_bytes) for this unit, via the substrate's provider."""
-        if self.resource_provider is None:
-            raise RuntimeError("resource_provider was not set by the charm")
-        return self.resource_provider.get_available_resources()
-
     # -- Charm Config
     @cached_property
     def config(self) -> CharmConfig:
@@ -248,6 +235,13 @@ class CharmState(Object):
             addresses.remove(current_unit_ip)
         return addresses
 
+    def unit_database_address(self, unit: Unit, relation_name: str = DATABASE) -> str | None:
+        """The client-facing address a peer unit published for the given relation."""
+        if not (peer_relation := self.peer_relation):
+            return None
+        with suppress(KeyError):
+            return peer_relation.data[unit].get(f"{relation_name}-address")
+
     @property
     def host(self) -> str:
         """Current unit host."""
@@ -539,3 +533,8 @@ class CharmState(Object):
     def primary_endpoint(self) -> str:
         """Returns the endpoint of the primary instance's service."""
         return self._build_service_name("primary")
+
+    @property
+    def replicas_endpoint(self) -> str:
+        """Returns the endpoint of the replicas instances' service."""
+        return self._build_service_name("replicas")

postgresql_charms_single_kernel-16.3.7/single_kernel_postgresql/events/database.py

@@ -0,0 +1,243 @@
+#!/usr/bin/env python3
+# Copyright 2026 Canonical Ltd.
+# See LICENSE file for licensing details.
+"""Client-relation events handler — owns the client-relation observers."""
+
+import logging
+
+from ops import BlockedStatus, ModelError, Object, RelationBrokenEvent, RelationDepartedEvent
+
+from single_kernel_postgresql.config.enums import Substrates
+from single_kernel_postgresql.config.literals import DATABASE, DATABASE_PORT
+from single_kernel_postgresql.core.state import CharmState
+from single_kernel_postgresql.lib.charms.data_platform_libs.v0.data_interfaces import (
+    DatabaseRequestedEvent,
+)
+from single_kernel_postgresql.managers.database import (
+    NO_ACCESS_TO_SECRET_MSG,
+    DatabaseManager,
+    DatabaseRequest,
+)
+from single_kernel_postgresql.managers.patroni import PatroniManager
+from single_kernel_postgresql.managers.tls import TLSManager
+from single_kernel_postgresql.utils.postgresql import (
+    PostgreSQLCreateDatabaseError,
+    PostgreSQLCreateUserError,
+)
+
+logger = logging.getLogger(__name__)
+
+
+class DatabaseEventsHandler(Object):
+    """Handles the ``database`` (``postgresql_client``) provider relation.
+
+    Owns the three observers the client relation needs and drives the
+    :class:`~single_kernel_postgresql.managers.database.DatabaseManager` the charm
+    constructs, mirroring how the postgresql events handler receives its managers.
+
+    Each handler keeps its guard and its work in one observer: ``defer()`` is
+    per-observer, so splitting the readiness check from the action would let a deferred
+    action retry alone against state its guard never re-checked.
+
+    ``charm`` is deliberately untyped, as in the TLS handler: the production charms do
+    not derive from :class:`AbstractPostgreSQLCharm` until the cutover phase, and they
+    are the callers that construct this.
+    """
+
+    def __init__(
+        self,
+        charm,
+        state: CharmState,
+        database_manager: DatabaseManager,
+        patroni_manager: PatroniManager,
+        tls_manager: TLSManager,
+        relation_name: str = DATABASE,
+    ) -> None:
+        super().__init__(charm, key="database")
+        self.charm = charm
+        self.state = state
+        self.relation_name = relation_name
+        # The charm is the composition root: it constructs the manager and the provider
+        # interface; this handler owns the observers and the guard/defer decisions.
+        self.manager = database_manager
+        self.database_provides = database_manager.database_provides
+        # Held for the readiness guards and the endpoint-input gathers: the manager
+        # takes no peer-manager references.
+        self.patroni_manager = patroni_manager
+        self.tls_manager = tls_manager
+
+        self.framework.observe(
+            charm.on[relation_name].relation_departed, self._on_relation_departed
+        )
+        self.framework.observe(charm.on[relation_name].relation_broken, self._on_relation_broken)
+        self.framework.observe(
+            self.database_provides.on.database_requested, self._on_database_requested
+        )
+
+    def _ready_for_request(self) -> bool:
+        """Whether the cluster can serve a new client request right now."""
+        if not self.state.application.is_cluster_initialised:
+            return False
+        if self.state.substrate == Substrates.K8S:
+            return self.patroni_manager.primary_endpoint_ready
+        return bool(self.patroni_manager.member_started and self.charm.primary_endpoint)
+
+    def _ready_for_removal(self) -> bool:
+        """Whether the cluster can serve a relation removal right now.
+
+        K8s settles for a started member here where a request additionally waits on the
+        primary endpoint being reachable.
+        """
+        if not self.state.application.is_cluster_initialised:
+            return False
+        if self.state.substrate == Substrates.K8S:
+            return self.patroni_manager.member_started
+        return bool(self.patroni_manager.member_started and self.charm.primary_endpoint)
+
+    def _on_database_requested(self, event: DatabaseRequestedEvent) -> None:
+        """Generate password and handle user and database creation for the related app."""
+        # The provider library only emits this on the leader.
+        if not self.state.peer.is_app_leader:
+            return
+
+        if not self._ready_for_request():
+            logger.debug(
+                "Deferring on_database_requested: %s",
+                "Cluster must be initialized before database can be requested"
+                if self.state.substrate == Substrates.K8S
+                else "cluster not initialized, Patroni not started or primary endpoint not available",
+            )
+            event.defer()
+            return
+
+        # The vendored property resolves the secret on access: until the grant lands it
+        # raises ModelError, which the manager's own guard can no longer see.
+        try:
+            requested_entity_secret_content = event.requested_entity_secret_content
+        except ModelError:
+            self.charm.set_unit_status(BlockedStatus(NO_ACCESS_TO_SECRET_MSG))
+            return
+
+        request = DatabaseRequest(
+            relation_id=event.relation.id,
+            database=event.database or "",
+            extra_user_roles=event.extra_user_roles,
+            prefix_matching=event.prefix_matching,
+            requested_entity_secret_content=requested_entity_secret_content,
+        )
+        postgresql = self.charm.postgresql
+
+        if not (creds := self.manager.get_credentials(postgresql, request)):
+            return
+        user, password = creds
+
+        if not (databases_setup := self.manager.collect_databases(postgresql, user, request)):
+            return
+        database, databases = databases_setup
+
+        self.manager.update_username_mapping(event.relation.id, user)
+        self.charm.update_config()
+        if not self.manager.are_units_in_sync():
+            logger.debug("Not all units have synced configuration")
+            event.defer()
+            return
+
+        extra_user_roles = self.manager.build_extra_user_roles(event.extra_user_roles)
+
+        try:
+            self.manager.create_relation_user_and_database(
+                postgresql, user, password, database, databases, extra_user_roles
+            )
+            self.database_provides.set_credentials(event.relation.id, user, password)
+            self._publish_k8s_inline_endpoints(event.relation.id, user, password, database)
+            self.database_provides.set_version(
+                event.relation.id, postgresql.get_postgresql_version()
+            )
+            self.database_provides.set_database(event.relation.id, database)
+            if self.state.substrate == Substrates.K8S:
+                # K8s refreshed every relation from the request handler.
+                self.manager.update_endpoints(
+                    client_tls_files=self.tls_manager.get_client_tls_files()
+                )
+            else:
+                self.manager.update_endpoints(
+                    event.relation.id,
+                    online_members=self.patroni_manager.online_cluster_members(),
+                    client_tls_files=self.tls_manager.get_client_tls_files(),
+                )
+            self.manager.update_unit_status(postgresql, event.relation)
+            self.charm.update_config()
+        except self.manager.request_errors as e:
+            if self.state.substrate == Substrates.K8S:
+                logger.exception(e)
+            self.charm.set_unit_status(
+                BlockedStatus(
+                    e.message
+                    if isinstance(e, PostgreSQLCreateDatabaseError | PostgreSQLCreateUserError)
+                    and e.message is not None
+                    # The clearer of the two charms' wordings, now shared by both.
+                    else f"Failed to initialize {self.relation_name} relation"
+                )
+            )
+            return
+
+    def _publish_k8s_inline_endpoints(
+        self, relation_id: int, user: str, password: str, database: str
+    ) -> None:
+        """Publish the endpoint/URI/TLS fields the K8s charm wrote inside the request handler.
+
+        ``update_endpoints`` writes the same values moments later, so this is redundant;
+        it is kept so the port does not change K8s databag write ordering.
+        """
+        if self.state.substrate != Substrates.K8S:
+            return
+        primary = f"{self.state.primary_endpoint}:{DATABASE_PORT}"
+        self.database_provides.set_endpoints(relation_id, primary)
+        self.database_provides.set_uris(
+            relation_id, f"postgresql://{user}:{password}@{primary}/{database}"
+        )
+        client_tls_files = self.tls_manager.get_client_tls_files()
+        self.database_provides.set_tls(relation_id, "True" if all(client_tls_files) else "False")
+        if all(client_tls_files):
+            self.database_provides.set_tls_ca(relation_id, client_tls_files[1] or "")
+
+    def _on_relation_departed(self, event: RelationDepartedEvent) -> None:
+        """Set a flag to avoid deleting database users when not wanted."""
+        # Set a flag to avoid deleting database users when this unit
+        # is removed and receives relation broken events from related applications.
+        # This is needed because of https://bugs.launchpad.net/juju/+bug/1979811.
+        if event.departing_unit == self.state.model.unit and self.state.peer_relation:
+            self.state.peer.data.update({"departing": "True"})
+
+    def _on_relation_broken(self, event: RelationBrokenEvent) -> None:
+        """Remove the user created for this relation."""
+        if not self.state.peer_relation or not self._ready_for_removal():
+            logger.debug(
+                "Deferring on_relation_broken: %s",
+                "Cluster must be initialized before user can be deleted"
+                if self.state.substrate == Substrates.K8S
+                else "Cluster must be initialized and primary available before user can be deleted",
+            )
+            event.defer()
+            return
+
+        postgresql = self.charm.postgresql
+        self.manager.update_unit_status(postgresql, event.relation)
+
+        if self.state.peer.is_unit_departing:
+            logger.debug("Early exit on_relation_broken: Skipping departing unit")
+            return
+
+        if not self.state.peer.is_app_leader:
+            user = self.manager.get_username_mapping().get(
+                str(event.relation.id), self.manager.relation_username(event.relation.id)
+            )
+            if user in postgresql.list_users():
+                logger.debug("Deferring on_relation_broken: user was not deleted yet")
+                event.defer()
+            else:
+                self.charm.update_config()
+            return
+
+        self.manager.delete_relation_user(postgresql, event.relation.id)
+        self.charm.update_config()

{postgresql_charms_single_kernel-16.3.5 → postgresql_charms_single_kernel-16.3.7}/single_kernel_postgresql/managers/config.py

@@ -36,10 +36,11 @@ from single_kernel_postgresql.managers.patroni import PatroniManager
 from single_kernel_postgresql.managers.tls import TLSManager
 from single_kernel_postgresql.utils import _change_owner, render_file
 from single_kernel_postgresql.utils.postgresql import PostgreSQL as PostgreSQLClient
-from single_kernel_postgresql.workload.base import BaseWorkload
+from single_kernel_postgresql.workload.base import BaseWorkload, ResourceProvider
 
 if TYPE_CHECKING:
     # Import-time only: the VM workload pulls the snap charm lib, which K8s does not ship.
+    from single_kernel_postgresql.managers.database import DatabaseManager
     from single_kernel_postgresql.workload.vm import VMWorkload
 
 logger = logging.getLogger(__name__)
@@ -57,17 +58,21 @@ class ConfigManager(BaseManager):
         workload: BaseWorkload,
         tls_manager: TLSManager,
         patroni_manager: PatroniManager,
+        database_manager: "DatabaseManager",
+        resource_provider: Callable[[], ResourceProvider],
         request_restart: Callable[[], None],
-        refresh_endpoints: Callable[[], None],
         restart_services: Callable[[], None],
     ):
         super().__init__(state, workload, "config_manager")
         self.tls_manager = tls_manager
         self.patroni_manager = patroni_manager
-        # Charm-side bridges: the substrate-tangled restart trigger, endpoint refresh and
-        # monitoring/ldap service restarts stay in the charm until their own migration phases.
+        self.database_manager = database_manager
+        # Resolved on use, not at construction: the K8s manager that provides it is built
+        # after this manager in the charm's __init__.
+        self.resource_provider = resource_provider
+        # Charm-side bridges: the substrate-tangled restart trigger and the monitoring/ldap
+        # service restarts stay in the charm until their own migration phases.
         self.request_restart = request_restart
-        self.refresh_endpoints = refresh_endpoints
         self.restart_services = restart_services
 
     @staticmethod
@@ -304,6 +309,24 @@ class ConfigManager(BaseManager):
             self.tls_manager.client_tls_files_on_disk()
         )
 
+    def _client_relation_endpoint_inputs(self) -> dict:
+        """Gather the DatabaseManager.update_endpoints inputs this caller must supply.
+
+        The Patroni cluster-status query is a live REST call: gather it only where
+        update_endpoints would use it — on the leader (it returns early otherwise) and
+        on VM (K8s endpoints come from the Services state). The raw TLS files are
+        passed as-is: the endpoint publish uses the databag-only view, not this
+        manager's on-disk-augmented is_tls_enabled.
+        """
+        return {
+            "online_members": (
+                self.patroni_manager.online_cluster_members()
+                if self.state.peer.is_app_leader and self.state.substrate == Substrates.VM
+                else None
+            ),
+            "client_tls_files": self.tls_manager.get_client_tls_files(),
+        }
+
     @cached_property
     def generate_config_hash(self) -> str:
         """Generate current configuration hash."""
@@ -432,7 +455,7 @@ class ConfigManager(BaseManager):
                 pass
 
         self.state.peer.tls = self.is_tls_enabled
-        self.refresh_endpoints()
+        self.database_manager.update_endpoints(**self._client_relation_endpoint_inputs())
 
         # Restart PostgreSQL if TLS configuration has changed
         # (so the both old and new connections use the configuration).
@@ -443,7 +466,6 @@ class ConfigManager(BaseManager):
     def update_config(
         self,
         postgresql_client: PostgreSQLClient,
-        user_hash: str,
         is_creating_backup: bool = False,
         # TODO add rel handler
         relations_user_databases_map: dict[str, Any] | None = None,
@@ -468,7 +490,7 @@ class ConfigManager(BaseManager):
         # Snapshot resources once so parameter-building and the API patch agree. On K8s
         # these are lightkube reads; re-fetching per callee doubled the API calls and
         # could disagree mid-scaling.
-        cpu_cores, available_memory = self.state.available_resources
+        cpu_cores, available_memory = self.resource_provider().get_available_resources()
 
         # Build PostgreSQL parameters
         pg_parameters = self._build_postgresql_parameters(
@@ -514,7 +536,7 @@ class ConfigManager(BaseManager):
             # in a bundle together with the TLS certificates operator. This flag is used to
             # know when to call the Patroni API using HTTP or HTTPS.
             self.state.peer.tls = self.is_tls_enabled
-            self.refresh_endpoints()
+            self.database_manager.update_endpoints(**self._client_relation_endpoint_inputs())
             logger.debug("Early exit update_config: Workload not started yet")
             return True
 
@@ -563,6 +585,7 @@ class ConfigManager(BaseManager):
 
         self.restart_services()
 
+        user_hash = self.database_manager.user_hash
         self.state.peer.user_hash = user_hash
         self.state.peer.config_hash = self.generate_config_hash
         if self.state.peer.is_app_leader: