Don't overwrite keys

canonical · Jan 7, 2025 · ebc10a3 · ebc10a3
1 parent cc4a25b
commit ebc10a3
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 9 deletions.
diff --git a/lib/charms/postgresql_k8s/v0/postgresql.py b/lib/charms/postgresql_k8s/v0/postgresql.py
@@ -368,8 +368,8 @@ def enable_disable_extensions(
                 connection.close()
 
     def _generate_database_privileges_statements(
-        self, relations_accessing_this_database: int, schemas: list[str], user: str
-    ) -> list[Composed]:
+        self, relations_accessing_this_database: int, schemas: List[str], user: str
+    ) -> List[Composed]:
         """Generates a list of databases privileges statements."""
         statements = []
         if relations_accessing_this_database == 1:

diff --git a/lib/charms/postgresql_k8s/v0/postgresql_tls.py b/lib/charms/postgresql_k8s/v0/postgresql_tls.py
@@ -130,17 +130,22 @@ def _on_certificate_available(self, event: CertificateAvailableEvent) -> None:
             logger.error("An unknown certificate available.")
             return
 
-        self.charm.set_secret(
-            SCOPE, "chain", "\n".join(event.chain) if event.chain is not None else None
-        )
-        self.charm.set_secret(SCOPE, "cert", event.certificate)
-        self.charm.set_secret(SCOPE, "ca", event.ca)
-
         if not event.certificate:
-            logger.debug("Cannot push TLS certificates at this moment")
+            logger.debug("No certificate available.")
             event.defer()
             return
 
+        chain = self.charm.get_secret(SCOPE, "chain")
+        new_chain = "\n".join(event.chain) if event.chain is not None else None
+        if chain != new_chain:
+            self.charm.set_secret(SCOPE, "chain", new_chain)
+        cert = self.charm.get_secret(SCOPE, "cert")
+        if cert != event.certificate:
+            self.charm.set_secret(SCOPE, "cert", event.certificate)
+        ca = self.charm.get_secret(SCOPE, "ca")
+        if ca != event.ca:
+            self.charm.set_secret(SCOPE, "ca", event.ca)
+
         try:
             if not self.charm.push_tls_files_to_workload():
                 logger.debug("Cannot push TLS certificates at this moment")