Merge remote-tracking branch 'origin/main' into lucas/diff-incr-backups

.github/workflows/ci.yaml

@@ -22,7 +22,7 @@ on:
 jobs:
   lint:
     name: Lint
-    uses: canonical/data-platform-workflows/.github/workflows/lint.yaml@v13.1.2
+    uses: canonical/data-platform-workflows/.github/workflows/lint.yaml@v13.2.0
 
   unit-test:
     name: Unit test charm
@@ -42,7 +42,7 @@ jobs:
 
   build:
     name: Build charm
-    uses: canonical/data-platform-workflows/.github/workflows/build_charm.yaml@v13.1.2
+    uses: canonical/data-platform-workflows/.github/workflows/build_charm.yaml@v13.2.0
     with:
       cache: true
 
@@ -53,21 +53,25 @@ jobs:
         juju:
           - agent: 2.9.49  # renovate: latest juju 2
             libjuju: ==2.9.49.0  # renovate: latest libjuju 2
-            allure: false
+            allure_on_amd64: false
           - agent: 3.1.8  # renovate: latest juju 3
-            allure: true
-    name: Integration test charm | ${{ matrix.juju.agent }}
+            allure_on_amd64: true
+        architecture:
+          - amd64
+          - arm64
+    name: Integration test charm | ${{ matrix.juju.agent }} | ${{ matrix.architecture }}
     needs:
       - lint
       - unit-test
       - build
-    uses: canonical/data-platform-workflows/.github/workflows/integration_test_charm.yaml@v13.1.2
+    uses: canonical/data-platform-workflows/.github/workflows/integration_test_charm.yaml@v13.2.0
     with:
       artifact-prefix: ${{ needs.build.outputs.artifact-prefix }}
+      architecture: ${{ matrix.architecture }}
       cloud: lxd
       juju-agent-version: ${{ matrix.juju.agent }}
       libjuju-version-constraint: ${{ matrix.juju.libjuju }}
-      _beta_allure_report: ${{ matrix.juju.allure }}
+      _beta_allure_report: ${{ matrix.juju.allure_on_amd64 && matrix.architecture == 'amd64' }}
     secrets:
       integration-test: |
         {

.github/workflows/release.yaml

@@ -24,14 +24,14 @@ jobs:
 
   build:
     name: Build charm
-    uses: canonical/data-platform-workflows/.github/workflows/build_charm.yaml@v13.1.2
+    uses: canonical/data-platform-workflows/.github/workflows/build_charm.yaml@v13.2.0
 
   release:
     name: Release charm
     needs:
       - ci-tests
       - build
-    uses: canonical/data-platform-workflows/.github/workflows/release_charm.yaml@v13.1.2
+    uses: canonical/data-platform-workflows/.github/workflows/release_charm.yaml@v13.2.0
     with:
       channel: 14/edge
       artifact-prefix: ${{ needs.build.outputs.artifact-prefix }}

.github/workflows/sync_issue_to_jira.yaml

@@ -9,7 +9,7 @@ on:
 jobs:
   sync:
     name: Sync GitHub issue to Jira
-    uses: canonical/data-platform-workflows/.github/workflows/sync_issue_to_jira.yaml@v13.1.2
+    uses: canonical/data-platform-workflows/.github/workflows/sync_issue_to_jira.yaml@v13.2.0
     with:
       jira-base-url: https://warthogs.atlassian.net
       jira-project-key: DPE

pyproject.toml

@@ -66,10 +66,10 @@ optional = true
 
 [tool.poetry.group.integration.dependencies]
 pytest = "^8.2.0"
-pytest-github-secrets = {git = "https://github.com/canonical/data-platform-workflows", tag = "v13.1.2", subdirectory = "python/pytest_plugins/github_secrets"}
+pytest-github-secrets = {git = "https://github.com/canonical/data-platform-workflows", tag = "v13.2.0", subdirectory = "python/pytest_plugins/github_secrets"}
 pytest-operator = "^0.35.0"
-pytest-operator-cache = {git = "https://github.com/canonical/data-platform-workflows", tag = "v13.1.2", subdirectory = "python/pytest_plugins/pytest_operator_cache"}
-pytest-operator-groups = {git = "https://github.com/canonical/data-platform-workflows", tag = "v13.1.2", subdirectory = "python/pytest_plugins/pytest_operator_groups"}
+pytest-operator-cache = {git = "https://github.com/canonical/data-platform-workflows", tag = "v13.2.0", subdirectory = "python/pytest_plugins/pytest_operator_cache"}
+pytest-operator-groups = {git = "https://github.com/canonical/data-platform-workflows", tag = "v13.2.0", subdirectory = "python/pytest_plugins/pytest_operator_groups"}
 # renovate caret doesn't work: https://github.com/renovatebot/renovate/issues/26940
 juju = "<=3.4.0.0"
 boto3 = "*"

src/backups.py

@@ -97,6 +97,22 @@ def _are_backup_settings_ok(self) -> Tuple[bool, Optional[str]]:
 
         return True, None
 
+    @property
+    def _can_initialise_stanza(self) -> bool:
+        """Validates whether this unit can initialise a stanza."""
+        # Don't allow stanza initialisation if this unit hasn't started the database
+        # yet and either hasn't joined the peer relation yet or hasn't configured TLS
+        # yet while other unit already has TLS enabled.
+        if not self.charm._patroni.member_started and (
+            (len(self.charm._peers.data.keys()) == 2)
+            or (
+                "tls" not in self.charm.unit_peer_data
+                and any("tls" in unit_data for _, unit_data in self.charm._peers.data.items())
+            )
+        ):
+            return False
+        return True
+
     def _can_unit_perform_backup(self) -> Tuple[bool, Optional[str]]:
         """Validates whether this unit can perform a backup."""
         if self.charm.is_blocked:
@@ -530,6 +546,11 @@ def _on_s3_credential_changed(self, event: CredentialsChangedEvent):
             logger.debug("Cannot set pgBackRest configurations, missing configurations.")
             return
 
+        if not self._can_initialise_stanza:
+            logger.debug("Cannot initialise stanza yet.")
+            event.defer()
+            return
+
         # Verify the s3 relation only on the primary.
         if not self.charm.is_primary:
             return

tests/integration/architecture.py

@@ -0,0 +1,7 @@
+# Copyright 2024 Canonical Ltd.
+# See LICENSE file for licensing details.
+import subprocess
+
+architecture = subprocess.run(
+    ["dpkg", "--print-architecture"], capture_output=True, check=True, encoding="utf-8"
+).stdout.strip()

tests/integration/ha_tests/test_async_replication.py

@@ -3,6 +3,7 @@
 # See LICENSE file for licensing details.
 import contextlib
 import logging
+import subprocess
 from asyncio import gather
 from typing import Optional
 
@@ -12,7 +13,7 @@
 from pytest_operator.plugin import OpsTest
 from tenacity import Retrying, stop_after_delay, wait_fixed
 
-from .. import markers
+from .. import architecture, markers
 from ..helpers import (
     APPLICATION_NAME,
     DATABASE_APP_NAME,
@@ -70,6 +71,11 @@ async def second_model(ops_test: OpsTest, first_model, request) -> Model:
     second_model_name = f"{first_model.info.name}-other"
     if second_model_name not in await ops_test._controller.list_models():
         await ops_test._controller.add_model(second_model_name)
+        subprocess.run(["juju", "switch", second_model_name], check=True)
+        subprocess.run(
+            ["juju", "set-model-constraints", f"arch={architecture.architecture}"], check=True
+        )
+        subprocess.run(["juju", "switch", first_model.info.name], check=True)
     second_model = Model()
     await second_model.connect(model_name=second_model_name)
     yield second_model

tests/integration/ha_tests/test_upgrade_from_stable.py

@@ -6,6 +6,7 @@
 import pytest
 from pytest_operator.plugin import OpsTest
 
+from .. import markers
 from ..helpers import (
     APPLICATION_NAME,
     DATABASE_APP_NAME,
@@ -26,6 +27,7 @@
 
 
 @pytest.mark.group(1)
+@markers.amd64_only  # TODO: remove after arm64 stable release
 @pytest.mark.abort_on_fail
 async def test_deploy_stable(ops_test: OpsTest) -> None:
     """Simple test to ensure that the PostgreSQL and application charms get deployed."""
@@ -77,6 +79,7 @@ async def test_deploy_stable(ops_test: OpsTest) -> None:
 
 
 @pytest.mark.group(1)
+@markers.amd64_only  # TODO: remove after arm64 stable release
 @pytest.mark.abort_on_fail
 async def test_pre_upgrade_check(ops_test: OpsTest) -> None:
     """Test that the pre-upgrade-check action runs successfully."""
@@ -95,6 +98,7 @@ async def test_pre_upgrade_check(ops_test: OpsTest) -> None:
 
 
 @pytest.mark.group(1)
+@markers.amd64_only  # TODO: remove after arm64 stable release
 @pytest.mark.abort_on_fail
 async def test_upgrade_from_stable(ops_test: OpsTest):
     """Test updating from stable channel."""

tests/integration/markers.py

@@ -4,8 +4,15 @@
 
 import pytest
 
+from . import architecture
 from .juju_ import juju_major_version
 
 juju2 = pytest.mark.skipif(juju_major_version != 2, reason="Requires juju 2")
 juju3 = pytest.mark.skipif(juju_major_version != 3, reason="Requires juju 3")
 juju_secrets = pytest.mark.skipif(juju_major_version < 3, reason="Requires juju secrets")
+amd64_only = pytest.mark.skipif(
+    architecture.architecture != "amd64", reason="Requires amd64 architecture"
+)
+arm64_only = pytest.mark.skipif(
+    architecture.architecture != "arm64", reason="Requires arm64 architecture"
+)

tests/integration/new_relations/test_new_relations.py

@@ -12,6 +12,7 @@
 import yaml
 from pytest_operator.plugin import OpsTest
 
+from .. import markers
 from ..helpers import CHARM_SERIES, assert_sync_standbys, get_leader_unit, scale_application
 from ..juju_ import juju_major_version
 from .helpers import (
@@ -583,6 +584,7 @@ async def test_invalid_extra_user_roles(ops_test: OpsTest):
 
 
 @pytest.mark.group(1)
+@markers.amd64_only  # nextcloud charm not available for arm64
 async def test_nextcloud_db_blocked(ops_test: OpsTest, charm: str) -> None:
     async with ops_test.fast_forward():
         # Deploy Nextcloud.

tests/integration/test_backups.py

@@ -10,6 +10,7 @@
 from pytest_operator.plugin import OpsTest
 from tenacity import Retrying, stop_after_attempt, wait_exponential
 
+from . import architecture
 from .helpers import (
     CHARM_SERIES,
     DATABASE_APP_NAME,
@@ -31,13 +32,19 @@
 FAILED_TO_INITIALIZE_STANZA_ERROR_MESSAGE = "failed to initialize stanza, check your S3 settings"
 S3_INTEGRATOR_APP_NAME = "s3-integrator"
 if juju_major_version < 3:
-    TLS_CERTIFICATES_APP_NAME = "tls-certificates-operator"
-    TLS_CHANNEL = "legacy/stable"
-    TLS_CONFIG = {"generate-self-signed-certificates": "true", "ca-common-name": "Test CA"}
+    tls_certificates_app_name = "tls-certificates-operator"
+    if architecture.architecture == "arm64":
+        tls_channel = "legacy/edge"
+    else:
+        tls_channel = "legacy/stable"
+    tls_config = {"generate-self-signed-certificates": "true", "ca-common-name": "Test CA"}
 else:
-    TLS_CERTIFICATES_APP_NAME = "self-signed-certificates"
-    TLS_CHANNEL = "latest/stable"
-    TLS_CONFIG = {"ca-common-name": "Test CA"}
+    tls_certificates_app_name = "self-signed-certificates"
+    if architecture.architecture == "arm64":
+        tls_channel = "latest/edge"
+    else:
+        tls_channel = "latest/stable"
+    tls_config = {"ca-common-name": "Test CA"}
 
 logger = logging.getLogger(__name__)
 
@@ -96,7 +103,7 @@ async def test_backup(ops_test: OpsTest, cloud_configs: Tuple[Dict, Dict], charm
     """Build and deploy two units of PostgreSQL and then test the backup and restore actions."""
     # Deploy S3 Integrator and TLS Certificates Operator.
     await ops_test.model.deploy(S3_INTEGRATOR_APP_NAME)
-    await ops_test.model.deploy(TLS_CERTIFICATES_APP_NAME, config=TLS_CONFIG, channel=TLS_CHANNEL)
+    await ops_test.model.deploy(tls_certificates_app_name, config=tls_config, channel=tls_channel)
 
     for cloud, config in cloud_configs[0].items():
         # Deploy and relate PostgreSQL to S3 integrator (one database app for each cloud for now
@@ -111,7 +118,7 @@ async def test_backup(ops_test: OpsTest, cloud_configs: Tuple[Dict, Dict], charm
             config={"profile": "testing"},
         )
         await ops_test.model.relate(database_app_name, S3_INTEGRATOR_APP_NAME)
-        await ops_test.model.relate(database_app_name, TLS_CERTIFICATES_APP_NAME)
+        await ops_test.model.relate(database_app_name, tls_certificates_app_name)
 
         # Configure and set access and secret keys.
         logger.info(f"configuring S3 integrator for {cloud}")
@@ -304,7 +311,7 @@ async def test_backup(ops_test: OpsTest, cloud_configs: Tuple[Dict, Dict], charm
         if cloud == list(cloud_configs[0].keys())[0]:
             # Remove the relation to the TLS certificates operator.
             await ops_test.model.applications[database_app_name].remove_relation(
-                f"{database_app_name}:certificates", f"{TLS_CERTIFICATES_APP_NAME}:certificates"
+                f"{database_app_name}:certificates", f"{tls_certificates_app_name}:certificates"
             )
             await ops_test.model.wait_for_idle(
                 apps=[database_app_name], status="active", timeout=1000
@@ -359,7 +366,7 @@ async def test_backup(ops_test: OpsTest, cloud_configs: Tuple[Dict, Dict], charm
         await ops_test.model.remove_application(database_app_name, block_until_done=True)
 
     # Remove the TLS operator.
-    await ops_test.model.remove_application(TLS_CERTIFICATES_APP_NAME, block_until_done=True)
+    await ops_test.model.remove_application(tls_certificates_app_name, block_until_done=True)
 
 
 @pytest.mark.group(1)