[DPE-4967] Block charm if dependent objects on disabled plugins (#560)

* add block config feature

* fix integration test

lib/charms/postgresql_k8s/v0/postgresql.py

@@ -36,7 +36,7 @@
 
 # Increment this PATCH version before using `charmcraft publish-lib` or reset
 # to 0 if you are raising the major API version
-LIBPATCH = 30
+LIBPATCH = 33
 
 INVALID_EXTRA_USER_ROLE_BLOCKING_MESSAGE = "invalid role(s) for extra user roles"
 
@@ -327,6 +327,8 @@ def enable_disable_extensions(self, extensions: Dict[str, bool], database: str =
  )
  except psycopg2.errors.UniqueViolation:
  pass
+ except psycopg2.errors.DependentObjectsStillExist:
+ raise
  except psycopg2.Error:
  raise PostgreSQLEnableDisableExtensionError()
  finally:

src/charm.py

@@ -106,6 +106,7 @@
 
 PRIMARY_NOT_REACHABLE_MESSAGE = "waiting for primary to be reachable from this unit"
 EXTENSIONS_DEPENDENCY_MESSAGE = "Unsatisfied plugin dependencies. Please check the logs"
+EXTENSION_OBJECT_MESSAGE = "Cannot disable plugins: Existing objects depend on it. See logs"
 
 Scopes = Literal[APP_SCOPE, UNIT_SCOPE]
 
@@ -1013,8 +1014,18 @@ def enable_disable_extensions(self, database: str = None) -> None:
  self.unit.status = WaitingStatus("Updating extensions")
  try:
  self.postgresql.enable_disable_extensions(extensions, database)
+ except psycopg2.errors.DependentObjectsStillExist as e:
+ logger.error(
+ "Failed to disable plugin: %s\nWas the plugin enabled manually? If so, update charm config with `juju config postgresql-k8s plugin_<plugin_name>_enable=True`",
+ str(e),
+ )
+ self.unit.status = BlockedStatus(EXTENSION_OBJECT_MESSAGE)
+ return
  except PostgreSQLEnableDisableExtensionError as e:
  logger.exception("failed to change plugins: %s", str(e))
+ if original_status.message == EXTENSION_OBJECT_MESSAGE:
+ self.unit.status = ActiveStatus()
+ return
  self.unit.status = original_status
 
  def _check_extension_dependencies(self, extension: str, enable: bool) -> bool:
@@ -1358,6 +1369,9 @@ def _can_run_on_update_status(self) -> bool:
  return False
 
  if self.is_blocked:
+ # If charm was failing to disable plugin, try again (user may have removed the objects)
+ if self.unit.status.message == EXTENSION_OBJECT_MESSAGE:
+ self.enable_disable_extensions()
  logger.debug("on_update_status early exit: Unit is in Blocked status")
  return False
 

tests/integration/test_plugins.py

@@ -208,3 +208,54 @@ def enable_disable_config(enabled: False):
  else:
  connection.cursor().execute(query)
  connection.close()
+
+
+@pytest.mark.group(1)
+async def test_plugin_objects(ops_test: OpsTest) -> None:
+ """Checks if charm gets blocked when trying to disable a plugin in use."""
+ primary = await get_primary(ops_test, f"{DATABASE_APP_NAME}/0")
+ password = await get_password(ops_test, primary)
+ address = get_unit_address(ops_test, primary)
+
+ logger.info("Creating an index object which depends on the pg_trgm config")
+ with db_connect(host=address, password=password) as connection:
+ connection.autocommit = True
+ connection.cursor().execute("CREATE TABLE example (value VARCHAR(10));")
+ connection.cursor().execute(
+ "CREATE INDEX example_idx ON example USING gin(value gin_trgm_ops);"
+ )
+ connection.close()
+
+ logger.info("Disabling the plugin on charm config, waiting for blocked status")
+ await ops_test.model.applications[DATABASE_APP_NAME].set_config({
+ "plugin_pg_trgm_enable": "False"
+ })
+ await ops_test.model.block_until(
+ lambda: ops_test.model.units[primary].workload_status == "blocked",
+ timeout=100,
+ )
+
+ logger.info("Enabling the plugin back on charm config, status should resolve")
+ await ops_test.model.applications[DATABASE_APP_NAME].set_config({
+ "plugin_pg_trgm_enable": "True"
+ })
+ await ops_test.model.wait_for_idle(apps=[DATABASE_APP_NAME], status="active")
+
+ logger.info("Re-disabling plugin, waiting for blocked status to come back")
+ await ops_test.model.applications[DATABASE_APP_NAME].set_config({
+ "plugin_pg_trgm_enable": "False"
+ })
+ await ops_test.model.block_until(
+ lambda: ops_test.model.units[primary].workload_status == "blocked",
+ timeout=100,
+ )
+
+ logger.info("Delete the object which depends on the plugin")
+ with db_connect(host=address, password=password) as connection:
+ connection.autocommit = True
+ connection.cursor().execute("DROP INDEX example_idx;")
+ connection.close()
+
+ logger.info("Waiting for status to resolve again")
+ async with ops_test.fast_forward(fast_interval="60s"):
+ await ops_test.model.wait_for_idle(apps=[DATABASE_APP_NAME], status="active")

tests/unit/test_charm.py

@@ -8,6 +8,7 @@
 from unittest import TestCase
 from unittest.mock import MagicMock, Mock, PropertyMock, call, mock_open, patch, sentinel
 
+import psycopg2
 import pytest
 from charms.operator_libs_linux.v2 import snap
 from charms.postgresql_k8s.v0.postgresql import (
@@ -556,6 +557,18 @@ def test_enable_disable_extensions(harness, caplog):
  new_harness.charm.enable_disable_extensions()
  assert postgresql_mock.enable_disable_extensions.call_count == 1
 
+ # Block if extension-dependent object error is raised
+ postgresql_mock.reset_mock()
+ postgresql_mock.enable_disable_extensions.side_effect = [
+ psycopg2.errors.DependentObjectsStillExist,
+ None,
+ ]
+ harness.charm.enable_disable_extensions()
+ assert isinstance(harness.charm.unit.status, BlockedStatus)
+ # Should resolve afterwards
+ harness.charm.enable_disable_extensions()
+ assert isinstance(harness.charm.unit.status, ActiveStatus)
+
 
 @patch_network_get(private_address="1.1.1.1")
 def test_on_start(harness):