This PR is targeting the issue where we have to use different secret fields than what we had in the databag.
Typically ca (short) or auth_cfg (_ not permitted) are currently "manyally" translated on the charm's side.
The difference between old/new names typically causes an issue for rolling upgrades. Currently PG charms and soon upcoming Zookeeper would be impacted by this issue.
After a LOT of thinking, the lib seemed to be the right place to hold this logic, as it's already handling the rest of the backwards compatibility functionalities (typically for rolling upgrades). The current code is already following through changes like moving sensitive data from databag to secrets, or to move from a secret URI (stored in databag) to secret labels. Since the translation problem is strongly related to the former, the logic should go to the lib. Even though I'm not happy about this extra complexity at all :-/
Implementation
I chose to take a mapping as a parameter, as this should cover existing use-cases. The other option would have been to add a user-defined translation function, however that feels a lot less safe (i.e. introducting bugs on secrets!!!) than a straightforward mapping. Note that the current scheme is easily extendible to take both options.
Problem
This PR is targeting the issue where we have to use different secret fields than what we had in the databag.
Typically
ca(short) orauth_cfg(_not permitted) are currently "manyally" translated on the charm's side.The difference between old/new names typically causes an issue for rolling upgrades. Currently PG charms and soon upcoming Zookeeper would be impacted by this issue.
After a LOT of thinking, the lib seemed to be the right place to hold this logic, as it's already handling the rest of the backwards compatibility functionalities (typically for rolling upgrades). The current code is already following through changes like moving sensitive data from databag to secrets, or to move from a secret URI (stored in databag) to secret labels. Since the translation problem is strongly related to the former, the logic should go to the lib. Even though I'm not happy about this extra complexity at all :-/
Implementation
I chose to take a mapping as a parameter, as this should cover existing use-cases. The other option would have been to add a user-defined translation function, however that feels a lot less safe (i.e. introducting bugs on secrets!!!) than a straightforward mapping. Note that the current scheme is easily extendible to take both options.
POC (Pgbouncer)
The POC of this working with Pgbouncer (one of the main requestors of the feature) can be found here: https://github.com/canonical/pgbouncer-operator/pull/149
Let me know what you think.