TLS implementation

[marceloneppel]

Issue

• PostgreSQL charm needs to have a way to enable TLS in the connections between instances and from the client applications to the PostgreSQL server.

Solution

• This PR continues to solve that issue by implementing the interaction with https://github.com/canonical/tls-certificates-operator using lib/charms/postgresql_k8s/v0/postgresql_tls.py and uploading certificates to the PostgreSQL container to enable TLS. It doesn't take care of enabling TLS on Patroni API, only on PostgreSQL connections.

Context

• This PR should be merged only after TLS relations files #35.
• Files that you can skip during review:
  • tests/unit/test_charm.py (because it changed mostly because of a refactor on method names)
• You can FOCUS your review on:
  • src/charm.py (ignoring the changes to get_secret and set_secret methods, which was only a refactor needed to use them outside the class, like in lib/charms/postgresql_k8s/v0/postgresql_tls.py; FOCUS on the other methods, that push TLS files to the container and later enable/disable TLS, also performing a rolling restart, which is needed for the other instances to start to use TLS in the replication connection)
  • templates/patroni.yml.j2 (changes to enable/disable SSL in the client and other instances connections; this is something specific to PostgreSQL/Patroni)

Testing

• Unit tests were updated on tests/unit/test_charm.py and tests/unit/test_patroni.py.
• Unit tests were added for from the previous PR through tests/unit/test_postgresql_tls.py.
• Integration tests were added in the next PR.

Release Notes

• Add TLS implementation.

[marcoppenheimer]

nit, but I wonder if it's more explicit having a:

enable_tls = all(self.tls.get_tls_files())

[marceloneppel]

Good catch! I will change it here. Thanks Marc!

[marceloneppel]

Updated on 9e4d481.

[marcoppenheimer]

nit, I think it would be more obviously parsable to have boring if's here.

if self.postgresql.is_tls_enabled() != enable_tls:
	self.on[self.restart_manager.name].acquire_lock.emit()

[marceloneppel]

In this specific part of the code, the check must be made before self._patroni.reload_patroni_configuration() is called (because it enables TLS, which is a step needed before restarting PostgreSQL).

self._patroni.reload_patroni_configuration() is called before the if because it is also needed when other configuration change.

Is it ok to keep the check this way due to that needs?