Password rotation

[marceloneppel]

Issue

• Database charms should enable the human operator to rotate any system user (users that are need for the correct operation of the charm and/or the workload, like a superuser, a replication user, etc.) password.

Solution

• Create an action to set system users passwords and propagate that password to all the other units.

Context

• This was already done in a very similar way in Password rotation postgresql-k8s-operator#26.
• Users created through relations (legacy or new relations) are not covered by this mechanism. Those users will have the password rotated after a sequence of a broken relation and a new relation being established.
• When updating a password using the set-password action, that password need to be update in the Patroni configuration (which also needs to be reloaded). The configuration is reloaded in the leader unit first and later on the other units (through relation changed event; that event already handles Patroni configuration changes and its reload process). There is no downtime in that processes.
• The new integration test from tests/integration/test_password_rotation.py rotate the two system users password and checks that they are correctly updated in all the units (which is checked after restarting Patroni; it would trigger an connection error in the Patroni process if the password is not updated).

Testing

• Unit and integration tests were updated based in the new actions.
• Additional unit and integration tests were added to validate the password rotation mechanism.

Release Notes

• Add password rotation mechanism for all system users (users used by the charm/workload and that were not created through relations).

[codecov-commenter]

Codecov Report

Merging #25 (d99bcaf) into main (ceeba02) will increase coverage by 1.61%.
The diff coverage is 77.41%.

@@            Coverage Diff             @@
##             main      #25      +/-   ##
==========================================
+ Coverage   60.11%   61.73%   +1.61%     
==========================================
  Files           6        6              
  Lines         692      763      +71     
  Branches      103      118      +15     
==========================================
+ Hits          416      471      +55     
- Misses        256      264       +8     
- Partials       20       28       +8     

Impacted Files	Coverage Δ
src/cluster.py	54.81% <50.00%> (+0.33%)	⬆️
src/charm.py	55.85% <78.04%> (+3.67%)	⬆️
src/constants.py	100.00% <100.00%> (ø)

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

[shayancanonical]

lgtm!!

[shayancanonical]

minor suggestion (feel free to ignore): is it possible to use fstrings instead of .format?

[marceloneppel]

.format is needed to correctly escape and handle invalid characters in the user name. But I can improve it to user a Placeholder object from psycopg2 to avoid using the plus signal to concat the password. I will do it in the library in the k8s repository along with other improvements and then update it here.

Thanks for the questions and the suggestion Shayan!

[zmraul]

Looks good!