TLS implementation

[marceloneppel]

Issue

• Jira issue: DPE-510
• PostgreSQL charm needs to have a way to enable TLS in the connections between instances and from the client applications to the PostgreSQL server.
• For that, the charm should implement the interaction with the TLS Certificates Operator and use the certificates provided by it to enable TLS on PostgreSQL client and internal (replication) connections.

Solution

• This PR continues to solve that issue by implementing the interaction with https://github.com/canonical/tls-certificates-operator using lib/charms/postgresql_k8s/v0/postgresql_tls.py and uploading certificates to the PostgreSQL container to enable TLS. It doesn't take care of enabling TLS on Patroni API, only on PostgreSQL connections.

Context

• This PR consists on REPLICATING what was already reviewed on TLS implementation postgresql-k8s-operator#36 to the PostgreSQL VM charm.
• Files that you can skip during review:
  • tests/unit/test_charm.py (because it changed mostly because of a refactor on method names)
• You can FOCUS your review on:
  • src/charm.py (ignoring the changes to get_secret and set_secret methods, which was only a refactor needed to use them outside the class, like in lib/charms/postgresql_k8s/v0/postgresql_tls.py; FOCUS on the other methods, that push TLS files to the workload directory and later enable/disable TLS, also performing a rolling restart, which is needed for the other instances to start to use TLS in the replication connection). Also, there is a way to update the certificates if the unit IP changes.
  • templates/patroni.yml.j2 (changes to enable/disable SSL in the client and other instances connections; this is something specific to PostgreSQL/Patroni)
  • Both above files have pretty similar implementation that the one made on TLS implementation postgresql-k8s-operator#36.
• Using IP addresses on certificates because the hostname that is exposed inside the VMs can be based on IP addresses (like ip-172-31-54-71) in clouds other than LXD (like AWS), so they will also change with the IP addresses changing (so the IP address is used as the hostname can behave even different on other clouds).

Testing

• Unit tests were updated on tests/unit/test_charm.py and tests/unit/test_patroni.py.
• Integration tests were added in the next PR.

Release Notes

• Add TLS implementation.

[zmraul]

LGTM!