Add initial backup and rewind settings

[marceloneppel]

Issue

• Jira issue: DPE-700
• PostgreSQL needs some initial settings for backups and rewind operations (synchronisation of the data between a primary and the replicas after a replica is promoted to primary).
• We also need to ensure that a rewind operations (the ones using the pg_rewind tool) are done using connections encrypted by TLS.

Solution

• Add the following settings for backup operations:

  • achieve_mode=on

  • archive_command=/bin/true

  • wal_level = logical

• Add the following settings for rewind operations:

  • remove_data_directory_on_rewind_failure = true

  • remove_data_directory_on_diverged_timelines = true

Add a user for pg_rewind and test that it uses TLS when connecting to other PostgreSQL instance.

Context

• pg_rewind had a new user created only for it, and that user was added in the list of users that can have the password rotated.

• You can FOCUS more on the following files when reviewing the code:

  • templates/patroni.yml.j2: contains the new backup and rewind settings.

  • tests/integration/helpers.py: container new helper methods used to ensure that pg_rewind is using TLS in its connections.

  • tests/integration/test_charm.py: the integration test was updated to ensure that the new settings are the current settings in the database.

  • tests/integration/test_tls.py: adds an additional check that ensures pg_rewind is using TLS in its connections.

• Other files are related to the new pg_rewind user.

Testing

• Existing unit tests on tests/unit/test_patroni.py were updated to match the new settings.
• The extra backup and rewind settings are now added to the integration test that checks the current instance configuration.
• An additional check was added to ensure that pg_rewind is using TLS.

Release Notes

• Add initial settings for backup and rewind operations.
• Add user for pg_rewind.
• Add test to ensure pg_rewind is using TLS.

[MiaAltieri]

Nice work! Thorough tests!

[MiaAltieri]

Wow so thorough 🤩