Merge ~arturo-seijas/charm-k8s-discourse:sidecar into charm-k8s-discourse:master

[Arturo Enrique Seijas Fernández]

Conversion to sidecar. Based on the MR https://code.launchpad.net/~jk0ne/charm-k8s-discourse/+git/charm-k8s-discourse/+merge/402858

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

This merge proposal is being monitored by mergebot. Change the status to Approved to merge.

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

Unable to determine commit message from repository - please click "Set commit message" and enter the commit message manually.

[Johann David Krister Andersson (jdkandersson)]

A few comments, it looks like there are a bunch of merge conflicts in here

review: Needs Fixing

[Mariyan Dimitrov (merkata)]

Good stuff, only thing is that there are some merge conflicts currently that need fixing.

*UPDATE* I was looking at a previous version, this looks good!

Unmerged commits

63a1dce... by Arturo Enrique Seijas Fernández on 2022-09-15

Code style

67dcce1... by Arturo Enrique Seijas Fernández on 2022-09-15

Code style

00a6ef9... by Arturo Enrique Seijas Fernández on 2022-09-15

Migrate to sidecar pattern

5ea251e... by Jay Kuri on 2021-06-10

Update readme with ingress details, update external_hostname to default to app_name

46439f2... by Jay Kuri on 2021-06-09

change test to use correct call for generating env. Comment old non-sidecar items until they can be rewritten.

c0471b7... by Jay Kuri on 2021-06-07

Updates to startup process + logging - WIP

cd00284... by Jay Kuri on 2021-05-21

Revisions for today. WIP

ddbdca5... by Jay Kuri on 2021-05-20

Add ingress integrator and attempt to integrate it. Still WIP.

070e47d... by Jay Kuri on 2021-05-18

Revisions for today - WIP.

f3cbf83... by Jay Kuri on 2021-05-17

Initial tentative steps at converting to sidecar

diff --git a/README.md b/README.md
index b49813d..12c4d16 100644
--- a/README.md
+++ b/README.md
@@ -23,8 +23,15 @@ To deploy into a Juju K8s model:
     juju relate discourse-k8s postgresql-k8s:db-admin
     juju relate discourse-k8s redis-k8s
 
+Then expose Discourse via the Kubernetes ingress:
+
+    juju deploy nginx-ingress-integrator
+    juju relate discourse-k8s nginx-ingress-integrator
+
 Once the deployment is completed and the "discourse" workload state in `juju
-status` has changed to "active" you can visit http://{$discourse_ip}:3000 in a
-browser and log in to your Discourse instance.
+status` has changed to "active" you can add `discourse-k8s` to `/etc/hosts`
+with the IP address of your Kubernetes cluster's ingress (127.0.0.1 if you're
+using MicroK8s) and visit `http://discourse-k8s` in a browser and log in to
+your Discourse instance.
 
-For further details, [see here](https://charmhub.io/discourse-charmers-discourse-k8s/docs).
+For further details, [see here](https://charmhub.io/discourse-k8s/docs).
diff --git a/config.yaml b/config.yaml
index e74a8c3..01704f1 100644
--- a/config.yaml
+++ b/config.yaml
@@ -1,4 +1,5 @@
 options:
+<<<<<<< config.yaml
   discourse_image:
     type: string
     description: "Discourse image to use"
@@ -11,14 +12,16 @@ options:
     type: string
     description: "Private registry password"
     default: ""
+=======
+>>>>>>> config.yaml
   db_name:
     type: string
     description: "PostgreSQL database name. Defaults to Juju Application name."
     default: ""
   external_hostname:
     type: string
-    description: "External hostname this discourse instance should respond to"
-    default: "foo.internal"
+    description: "External hostname this discourse instance should respond to. Defaults to the deployed application name."
+    default: ""
   enable_cors:
     type: boolean
     description: "Enable Cross-origin Resource Sharing (CORS) at the application level (required for SSO)"
diff --git a/lib/charms/nginx_ingress_integrator/v0/ingress.py b/lib/charms/nginx_ingress_integrator/v0/ingress.py
new file mode 100644
index 0000000..4d98ee5
--- /dev/null
+++ b/lib/charms/nginx_ingress_integrator/v0/ingress.py
@@ -0,0 +1,200 @@
+"""Library for the ingress relation.
+
+This library contains the Requires and Provides classes for handling
+the ingress interface.
+
+Import `IngressRequires` in your charm, with two required options:
+    - "self" (the charm itself)
+    - config_dict
+
+`config_dict` accepts the following keys:
+    - service-hostname (required)
+    - service-name (required)
+    - service-port (required)
+    - limit-rps
+    - limit-whitelist
+    - max-body-size
+    - path-routes
+    - retry-errors
+    - service-namespace
+    - session-cookie-max-age
+    - tls-secret-name
+
+See [the config section](https://charmhub.io/nginx-ingress-integrator/configure) for descriptions
+of each, along with the required type.
+
+As an example, add the following to `src/charm.py`:
+```
+from charms.nginx_ingress_integrator.v0.ingress import IngressRequires
+
+# In your charm's `__init__` method.
+self.ingress = IngressRequires(self, {"service-hostname": self.config["external_hostname"],
+                                      "service-name": self.app.name,
+                                      "service-port": 80})
+
+# In your charm's `config-changed` handler.
+self.ingress.update_config({"service-hostname": self.config["external_hostname"]})
+```
+And then add the following to `metadata.yaml`:
+```
+requires:
+  ingress:
+    interface: ingress
+```
+"""
+
+import logging
+
+from ops.charm import CharmEvents
+from ops.framework import EventBase, EventSource, Object
+from ops.model import BlockedStatus
+
+# The unique Charmhub library identifier, never change it
+LIBID = "db0af4367506491c91663468fb5caa4c"
+
+# Increment this major API version when introducing breaking changes
+LIBAPI = 0
+
+# Increment this PATCH version before using `charmcraft publish-lib` or reset
+# to 0 if you are raising the major API version
+LIBPATCH = 7
+
+logger = logging.getLogger(__name__)
+
+REQUIRED_INGRESS_RELATION_FIELDS = {
+    "service-hostname",
+    "service-name",
+    "service-port",
+}
+
+OPTIONAL_INGRESS_RELATION_FIELDS = {
+    "limit-rps",
+    "limit-whitelist",
+    "max-body-size",
+    "retry-errors",
+    "service-namespace",
+    "session-cookie-max-age",
+    "tls-secret-name",
+    "path-routes",
+}
+
+
+class IngressAvailableEvent(EventBase):
+    pass
+
+
+class IngressCharmEvents(CharmEvents):
+    """Custom charm events."""
+
+    ingress_available = EventSource(IngressAvailableEvent)
+
+
+class IngressRequires(Object):
+    """This class defines the functionality for the 'requires' side of the 'ingress' relation.
+
+    Hook events observed:
+        - relation-changed
+    """
+
+    def __init__(self, charm, config_dict):
+        super().__init__(charm, "ingress")
+
+        self.framework.observe(charm.on["ingress"].relation_changed, self._on_relation_changed)
+
+        self.config_dict = config_dict
+
+    def _config_dict_errors(self, update_only=False):
+        """Check our config dict for errors."""
+        blocked_message = "Error in ingress relation, check `juju debug-log`"
+        unknown = [
+            x
+            for x in self.config_dict
+            if x not in REQUIRED_INGRESS_RELATION_FIELDS | OPTIONAL_INGRESS_RELATION_FIELDS
+        ]
+        if unknown:
+            logger.error(
+                "Ingress relation error, unknown key(s) in config dictionary found: %s",
+                ", ".join(unknown),
+            )
+            self.model.unit.status = BlockedStatus(blocked_message)
+            return True
+        if not update_only:
+            missing = [x for x in REQUIRED_INGRESS_RELATION_FIELDS if x not in self.config_dict]
+            if missing:
+                logger.error(
+                    "Ingress relation error, missing required key(s) in config dictionary: %s",
+                    ", ".join(missing),
+                )
+                self.model.unit.status = BlockedStatus(blocked_message)
+                return True
+        return False
+
+    def _on_relation_changed(self, event):
+        """Handle the relation-changed event."""
+        # `self.unit` isn't available here, so use `self.model.unit`.
+        if self.model.unit.is_leader():
+            if self._config_dict_errors():
+                return
+            for key in self.config_dict:
+                event.relation.data[self.model.app][key] = str(self.config_dict[key])
+
+    def update_config(self, config_dict):
+        """Allow for updates to relation."""
+        if self.model.unit.is_leader():
+            self.config_dict = config_dict
+            if self._config_dict_errors(update_only=True):
+                return
+            relation = self.model.get_relation("ingress")
+            if relation:
+                for key in self.config_dict:
+                    relation.data[self.model.app][key] = str(self.config_dict[key])
+
+
+class IngressProvides(Object):
+    """This class defines the functionality for the 'provides' side of the 'ingress' relation.
+
+    Hook events observed:
+        - relation-changed
+    """
+
+    def __init__(self, charm):
+        super().__init__(charm, "ingress")
+        # Observe the relation-changed hook event and bind
+        # self.on_relation_changed() to handle the event.
+        self.framework.observe(charm.on["ingress"].relation_changed, self._on_relation_changed)
+        self.charm = charm
+
+    def _on_relation_changed(self, event):
+        """Handle a change to the ingress relation.
+
+        Confirm we have the fields we expect to receive."""
+        # `self.unit` isn't available here, so use `self.model.unit`.
+        if not self.model.unit.is_leader():
+            return
+
+        ingress_data = {
+            field: event.relation.data[event.app].get(field)
+            for field in REQUIRED_INGRESS_RELATION_FIELDS | OPTIONAL_INGRESS_RELATION_FIELDS
+        }
+
+        missing_fields = sorted(
+            [
+                field
+                for field in REQUIRED_INGRESS_RELATION_FIELDS
+                if ingress_data.get(field) is None
+            ]
+        )
+
+        if missing_fields:
+            logger.error(
+                "Missing required data fields for ingress relation: {}".format(
+                    ", ".join(missing_fields)
+                )
+            )
+            self.model.unit.status = BlockedStatus(
+                "Missing fields for ingress: {}".format(", ".join(missing_fields))
+            )
+
+        # Create an event that our charm can use to decide it's okay to
+        # configure the ingress.
+        self.charm.on.ingress_available.emit()
diff --git a/metadata.yaml b/metadata.yaml
index 0c8beb2..b382d31 100644
--- a/metadata.yaml
+++ b/metadata.yaml
@@ -12,12 +12,21 @@ maintainers:
 tags:
   - applications
   - forum
-series:
-  - kubernetes
-min-juju-version: 2.8.0
 requires:
   redis:
     interface: redis
   db:
     interface: pgsql
     limit: 1
+  ingress:
+    interface: ingress
+    limit: 1
+
+containers:
+  discourse:
+    resource: discourse-image
+
+resources:
+  discourse-image:
+    type: oci-image
+    description: OCI image for discourse  
diff --git a/pyproject.toml b/pyproject.toml
index d2f23b9..8d92e28 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,3 +1,7 @@
+[tool.coverage.report]
+fail_under = 85
+show_missing = true
+
 [tool.black]
 skip-string-normalization = true
 line-length = 120
diff --git a/src/charm.py b/src/charm.py
index 4710b2c..cc4c11f 100755
--- a/src/charm.py
+++ b/src/charm.py
@@ -12,13 +12,11 @@ from charms.redis_k8s.v0.redis import (
 from ops.charm import CharmBase
 from ops.main import main
 from ops.framework import StoredState
-
 from ops.model import ActiveStatus, BlockedStatus, MaintenanceStatus, WaitingStatus
+from charms.nginx_ingress_integrator.v0.ingress import IngressRequires
 
 
 logger = logging.getLogger(__name__)
-
-
 pgsql = ops.lib.use("pgsql", 1, "[e-mail]")
 
 THROTTLE_LEVELS = {
@@ -42,6 +40,7 @@ THROTTLE_LEVELS = {
 }
 REQUIRED_S3_SETTINGS = ['s3_access_key_id', 's3_bucket', 's3_region', 's3_secret_access_key']
 
+<<<<<<< src/charm.py
 
 def create_discourse_pod_config(config):
     """Create the pod environment config from the juju config."""
@@ -262,11 +261,14 @@ def check_for_missing_config_fields(config, stored):
             missing_fields.append(key)
 
     return sorted(missing_fields)
+=======
+SERVICE_NAME = "discourse"
+>>>>>>> src/charm.py
 
 
 class DiscourseCharm(CharmBase):
     on = RedisRelationCharmEvents()
-    stored = StoredState()
+    _stored = StoredState()
 
     def __init__(self, *args):
         """Initialization.
@@ -276,27 +278,41 @@ class DiscourseCharm(CharmBase):
         """
         super().__init__(*args)
 
-        self.stored.set_default(
+        self._stored.set_default(
             db_name=None,
             db_user=None,
             db_password=None,
             db_host=None,
-            has_db_relation=False,
-            has_db_credentials=False,
             redis_relation={},
         )
-        self.framework.observe(self.on.leader_elected, self.configure_pod)
-        self.framework.observe(self.on.config_changed, self.configure_pod)
-        self.framework.observe(self.on.upgrade_charm, self.configure_pod)
+        self.ingress = IngressRequires(self, self._ingress_config())
+        self.framework.observe(self.on.leader_elected, self.config_changed)
+        self.framework.observe(self.on.discourse_pebble_ready, self.config_changed)
+        self.framework.observe(self.on.config_changed, self.config_changed)
+        self.framework.observe(self.on.upgrade_charm, self.config_changed)
 
         self.db = pgsql.PostgreSQLClient(self, 'db')
         self.framework.observe(self.db.on.database_relation_joined, self.on_database_relation_joined)
         self.framework.observe(self.db.on.master_changed, self.on_database_changed)
 
-        self.redis = RedisRequires(self, self.stored)
-        self.framework.observe(self.on.redis_relation_updated, self.configure_pod)
-
-    def check_config_is_valid(self, config):
+        self.redis = RedisRequires(self, self._stored)
+        self.framework.observe(self.on.redis_relation_updated, self.config_changed)
+
+    def _ingress_config(self):
+        """Return a dict of our ingress config."""
+        ingress_config = {
+            "service-hostname": self.config['external_hostname'] or self.app.name,
+            "service-name": self.app.name,
+            "service-port": 3000,
+            "session-cookie-max-age": 3600,
+        }
+        if self.config["tls_secret_name"]:
+            ingress_config["tls-secret-name"] = self.config["tls_secret_name"]
+        if self.config["max_body_size"]:
+            ingress_config["max-body-size"] = self.config["max_body_size"]
+        return ingress_config
+
+    def check_config_is_valid(self):
         """Check that the provided config is valid.
 
         - Returns True if config is valid, False otherwise.
@@ -304,7 +320,7 @@ class DiscourseCharm(CharmBase):
         - Sets model status as appropriate.
         """
         valid_config = True
-        errors = check_for_config_problems(config, self.stored)
+        errors = self.check_for_config_problems()
 
         # Set status if we have a bad config.
         if errors:
@@ -315,58 +331,164 @@ class DiscourseCharm(CharmBase):
 
         return valid_config
 
-    def check_db_is_valid(self, state):
-        if not state.has_db_relation:
-            self.model.unit.status = BlockedStatus("db relation is required")
-            return False
-        if not state.has_db_credentials:
-            self.model.unit.status = WaitingStatus("db relation is setting up")
-            return False
-        self.model.unit.status = MaintenanceStatus("db relation is ready")
-        return True
+    def get_saml_config(self):
+        saml_fingerprints = {
+            'https://login.ubuntu.com/+saml': '32:15:20:9F:A4:3C:8E:3E:8E:47:72:62:9A:86:8D:0E:E6:CF:45:D5'
+        }
+        saml_config = {}
+
+        if self.config.get('saml_target_url'):
+            saml_config['DISCOURSE_SAML_TARGET_URL'] = self.config['saml_target_url']
+            saml_config['DISCOURSE_SAML_FULL_SCREEN_LOGIN'] = "true" if self.config['force_saml_login'] else "false"
+            fingerprint = saml_fingerprints.get(self.config['saml_target_url'])
+            if fingerprint:
+                saml_config['DISCOURSE_SAML_CERT_FINGERPRINT'] = fingerprint
+
+        return saml_config
+
+    def check_for_config_problems(self):
+        """Check if there are issues with the juju config.
 
-    def configure_pod(self, event=None):
-        """Configure pod.
+        - Primarily looks for missing config options using check_for_missing_config_fields()
 
-        - Verifies config is valid and unit is leader.
+        - Returns a list of errors if any were found.
+        """
+        errors = []
+        missing_fields = self.check_for_missing_config_fields()
+
+        if missing_fields:
+            errors.append('Required configuration missing: {}'.format(" ".join(missing_fields)))
+
+        if not THROTTLE_LEVELS.get(self.config['throttle_level']):
+            errors.append('throttle_level must be one of: ' + ' '.join(THROTTLE_LEVELS.keys()))
+
+        if self.config['force_saml_login'] and self.config['saml_target_url'] == '':
+            errors.append('force_saml_login can not be true without a saml_target_url')
 
-        - Configures pod using pod_spec generated from config.
+        return errors
+
+    def check_for_missing_config_fields(self):
+        """Check for missing fields in juju config.
+
+        - Returns a list of required fields that are either not present
+        or are empty.
         """
+        missing_fields = []
+
+        needed_fields = [
+            'smtp_address',
+            'cors_origin',
+            'developer_emails',
+            'smtp_domain',
+            'external_hostname',
+        ]
+        # See if Redis connection information has been provided via a relation.
+        redis_hostname = None
+        for redis_unit in self._stored.redis_relation:
+            redis_hostname = self._stored.redis_relation[redis_unit]["hostname"]
+        if not redis_hostname:
+            needed_fields.append("redis_host")
+        for key in needed_fields:
+            if not self.config.get(key):
+                missing_fields.append(key)
+
+        return sorted(missing_fields)
+
+    def check_db_is_valid(self):
+        return self._stored.db_name
+
+    def create_discourse_environment_settings(self):
+        """Create the pod environment config from the existing config."""
+
         # Get redis connection information from config but allow overriding
         # via a relation.
         redis_hostname = self.config["redis_host"]
         redis_port = 6379
-        for redis_unit in self.stored.redis_relation:
-            redis_hostname = self.stored.redis_relation[redis_unit]["hostname"]
-            redis_port = self.stored.redis_relation[redis_unit]["port"]
-            logging.debug("Got redis connection details from relation of %s:%s", redis_hostname, redis_port)
+        for redis_unit in self._stored.redis_relation:
+            redis_hostname = self._stored.redis_relation[redis_unit]["hostname"]
+            redis_port = self._stored.redis_relation[redis_unit]["port"]
+            logger.debug("Got redis connection details from relation of %s:%s", redis_hostname, redis_port)
+
+        pod_config = {
+            'DISCOURSE_CORS_ORIGIN': self.config['cors_origin'],
+            'DISCOURSE_DB_HOST': self._stored.db_host,
+            'DISCOURSE_DB_NAME': self._stored.db_name,
+            'DISCOURSE_DB_PASSWORD': self._stored.db_password,
+            'DISCOURSE_DB_USERNAME': self._stored.db_user,
+            'DISCOURSE_DEVELOPER_EMAILS': self.config['developer_emails'],
+            'DISCOURSE_ENABLE_CORS': self.config['enable_cors'],
+            'DISCOURSE_HOSTNAME': self.config['external_hostname'],
+            'DISCOURSE_REDIS_HOST': redis_hostname,
+            'DISCOURSE_REDIS_PORT': redis_port,
+            'DISCOURSE_REFRESH_MAXMIND_DB_DURING_PRECOMPILE_DAYS': "0",
+            'DISCOURSE_SERVE_STATIC_ASSETS': "true",
+            'DISCOURSE_SMTP_ADDRESS': self.config['smtp_address'],
+            'DISCOURSE_SMTP_AUTHENTICATION': self.config['smtp_authentication'],
+            'DISCOURSE_SMTP_DOMAIN': self.config['smtp_domain'],
+            'DISCOURSE_SMTP_OPENSSL_VERIFY_MODE': self.config['smtp_openssl_verify_mode'],
+            'DISCOURSE_SMTP_PASSWORD': self.config['smtp_password'],
+            'DISCOURSE_SMTP_PORT': self.config['smtp_port'],
+            'DISCOURSE_SMTP_USER_NAME': self.config['smtp_username'],
+        }
+
+        saml_config = self.get_saml_config()
+        for key in saml_config:
+            pod_config[key] = saml_config[key]
+
+        # We only get valid throttle levels here, otherwise it would be caught
+        # by `check_for_config_problems`, so we can be sure this won't raise a
+        # KeyError.
+        for key in THROTTLE_LEVELS[self.config['throttle_level']]:
+            pod_config[key] = THROTTLE_LEVELS[self.config['throttle_level']][key]
+
+        return pod_config
+
+    def create_layer_config(self):
+        """Create a layer config based on our current configuration.
+
+        - uses create_discourse_environment_settings to genreate the environment we need.
+        """
+        logger.info("Generating Layer config")
+        layer_config = {
+            "summary": "Discourse layer",
+            "description": "Discourse layer",
+            "services": {
+                "discourse": {
+                    "override": "replace",
+                    "summary": "Discourse web application",
+                    "command": "sh -c '/srv/scripts/pod_start >>/srv/discourse/discourse.log 2&>1'",
+                    "startup": "enabled",
+                    "environment": self.create_discourse_environment_settings(),
+                }
+            },
+        }
+        return layer_config
 
-        # Set our status while we get configured.
-        self.model.unit.status = MaintenanceStatus('Configuring pod')
+    def config_changed(self, event):
+        """Configure service.
 
-        # Leader must set the pod spec.
-        if self.model.unit.is_leader():
-            if not self.check_db_is_valid(self.stored):
-                return
-
-            # Merge our config and state into a single dict and set
-            # defaults here, because the helpers avoid dealing with
-            # the framework.
-            config = dict(self.model.config)
-            config["db_name"] = self.stored.db_name
-            config["db_user"] = self.stored.db_user
-            config["db_password"] = self.stored.db_password
-            config["db_host"] = self.stored.db_host
-            config["redis_host"] = redis_hostname
-            config["redis_port"] = redis_port
-            # Get our spec definition.
-            if self.check_config_is_valid(config):
-                # Get pod spec using our app name and config
-                pod_spec = get_pod_spec(self.framework.model.app.name, config)
-                # Set our pod spec.
-                self.model.pod.set_spec(pod_spec)
-                self.model.unit.status = ActiveStatus()
-        else:
+        - Verifies config is valid
+
+        - Configures pod using pebble and layer generated from config.
+        """
+
+        self.model.unit.status = MaintenanceStatus('Configuring service')
+
+        if not self.check_db_is_valid():
+            self.model.unit.status = WaitingStatus("Waiting for database relation")
+            event.defer()
+            return
+
+        container = self.unit.get_container(SERVICE_NAME)
+        if not container.can_connect():
+            event.defer()
+            return
+
+        if self.check_config_is_valid():
+            layer_config = self.create_layer_config()
+            container.add_layer(SERVICE_NAME, layer_config, combine=True)
+            container.pebble.replan_services()
+            self.ingress.update_config(self._ingress_config())
             self.model.unit.status = ActiveStatus()
 
     def on_database_relation_joined(self, event):
@@ -377,7 +499,6 @@ class DiscourseCharm(CharmBase):
         - Required because setting the database name is only possible
           from inside the event handler per https://github.com/canonical/ops-lib-pgsql/issues/2
         """
-        self.stored.has_db_relation = True
         # Ensure event.database is always set to a non-empty string. PostgreSQL
         # can infer this if it's in the same model as Discourse, but not if
         # we're using cross-model relations.
@@ -400,22 +521,20 @@ class DiscourseCharm(CharmBase):
           in the relation event.
         """
         if event.master is None:
-            self.stored.db_name = None
-            self.stored.db_user = None
-            self.stored.db_password = None
-            self.stored.db_host = None
-            self.stored.has_db_credentials = False
+            self._stored.db_name = None
+            self._stored.db_user = None
+            self._stored.db_password = None
+            self._stored.db_host = None
             self.model.unit.status = WaitingStatus("waiting for db relation")
             return
 
-        self.stored.db_name = event.master.dbname
-        self.stored.db_user = event.master.user
-        self.stored.db_password = event.master.password
-        self.stored.db_host = event.master.host
-        self.stored.has_db_credentials = True
+        self._stored.db_name = event.master.dbname
+        self._stored.db_user = event.master.user
+        self._stored.db_password = event.master.password
+        self._stored.db_host = event.master.host
 
-        self.configure_pod()
+        self.config_changed(event)
 
 
 if __name__ == '__main__':  # pragma: no cover
-    main(DiscourseCharm)
+    main(DiscourseCharm, use_juju_for_storage=True)
diff --git a/tests/__init__.py b/tests/__init__.py
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/tests/__init__.py
diff --git a/tests/unit/__init__.py b/tests/unit/__init__.py
new file mode 100644
index 0000000..0c77dd5
--- /dev/null
+++ b/tests/unit/__init__.py
@@ -0,0 +1,6 @@
+# Copyright 2022 Canonical Ltd.
+# See LICENSE file for licensing details.
+
+import ops.testing
+
+ops.testing.SIMULATE_CAN_CONNECT = True
diff --git a/tests/unit/_patched_charm.py b/tests/unit/_patched_charm.py
new file mode 100644
index 0000000..14a612b
--- /dev/null
+++ b/tests/unit/_patched_charm.py
@@ -0,0 +1,59 @@
+# Copyright 2022 Canonical Ltd.
+# See LICENSE file for licensing details.
+
+"""Patch the ``ops-lib-pgsql`` library for unit testing.
+
+This script is used to monkey patch necessary code to allow running unit tests with
+``ops-lib-pgsql``. This patch needs to be run prior to the importing of the main module since
+the main module uses ``ops.lib.use`` which runs ``exec_module`` internally and the
+``ops-lib-pgsql`` just happens to use ``from .client import *``. Combined, that makes patching
+any private variables inside ``pgsql.client`` afterwards impossible.
+"""
+
+from unittest.mock import MagicMock, patch
+
+import ops.lib
+import pgsql.client
+
+__all__ = ["DiscourseCharm", "pgsql_patch"]
+
+_og_use = ops.lib.use
+
+
+def _use(*args, **kwargs):
+    print("use: ", args)
+    if args == ("pgsql", 1, "[e-mail]"):
+        return pgsql
+    else:
+        return _og_use(*args, **kwargs)
+
+
+ops.lib.use = _use
+
+
+class _PGSQLPatch:
+    def __init__(self):
+        # borrow some code from
+        # https://github.com/canonical/ops-lib-pgsql/blob/master/tests/test_client.py
+        self._leadership_data = {}
+        self._patch = patch.multiple(
+            pgsql.client,
+            _is_ready=MagicMock(return_value=True),
+            _get_pgsql_leader_data=self._leadership_data.copy,
+            _set_pgsql_leader_data=self._leadership_data.update,
+        )
+
+    def _reset_leadership_data(self):
+        self._leadership_data.clear()
+
+    def start(self):
+        self._reset_leadership_data()
+        self._patch.start()
+
+    def stop(self):
+        self._reset_leadership_data()
+        self._patch.stop()
+
+
+pgsql_patch = _PGSQLPatch()
+DiscourseCharm = __import__("charm").DiscourseCharm
diff --git a/tests/unit/fixtures/config_invalid_bad_throttle_mode.yaml b/tests/unit/fixtures/config_invalid_bad_throttle_mode.yaml
index a8da6f4..501bc9a 100644
--- a/tests/unit/fixtures/config_invalid_bad_throttle_mode.yaml
+++ b/tests/unit/fixtures/config_invalid_bad_throttle_mode.yaml
@@ -1,3 +1,4 @@
+<<<<<<< tests/unit/fixtures/config_invalid_bad_throttle_mode.yaml
 config: 
     cors_origin: '*'
     db_name: discourse
@@ -23,3 +24,5 @@ config:
 config_problems:
     - 'throttle_level must be one of: none permissive strict'
 missing_fields: []
+=======
+>>>>>>> tests/unit/fixtures/config_invalid_bad_throttle_mode.yaml
diff --git a/tests/unit/fixtures/config_invalid_force_saml_no_saml_target.yaml b/tests/unit/fixtures/config_invalid_force_saml_no_saml_target.yaml
index 514f436..b158648 100644
--- a/tests/unit/fixtures/config_invalid_force_saml_no_saml_target.yaml
+++ b/tests/unit/fixtures/config_invalid_force_saml_no_saml_target.yaml
@@ -1,3 +1,4 @@
+<<<<<<< tests/unit/fixtures/config_invalid_force_saml_no_saml_target.yaml
 config: 
     cors_origin: '*'
     db_name: discourse
@@ -25,3 +26,5 @@ config_problems:
     - "'force_saml_login' cannot be true without a 'saml_target_url'"
     - "'saml_sync_groups' cannot be specified without a 'saml_target_url'"
 missing_fields: []
+=======
+>>>>>>> tests/unit/fixtures/config_invalid_force_saml_no_saml_target.yaml
diff --git a/tests/unit/fixtures/config_invalid_missing_cors.yaml b/tests/unit/fixtures/config_invalid_missing_cors.yaml
index 14019e0..7ba779c 100644
--- a/tests/unit/fixtures/config_invalid_missing_cors.yaml
+++ b/tests/unit/fixtures/config_invalid_missing_cors.yaml
@@ -1,3 +1,4 @@
+<<<<<<< tests/unit/fixtures/config_invalid_missing_cors.yaml
 config:
     cors_origin: ''
     db_name: discourse
@@ -23,3 +24,5 @@ config_problems:
     - 'Required configuration missing: cors_origin'
 missing_fields: 
     - 'cors_origin'
+=======
+>>>>>>> tests/unit/fixtures/config_invalid_missing_cors.yaml
diff --git a/tests/unit/fixtures/config_valid_complete.yaml b/tests/unit/fixtures/config_valid_complete.yaml
index 1d14364..33809df 100644
--- a/tests/unit/fixtures/config_valid_complete.yaml
+++ b/tests/unit/fixtures/config_valid_complete.yaml
@@ -1,3 +1,4 @@
+<<<<<<< tests/unit/fixtures/config_valid_complete.yaml
 config: 
     cors_origin: '*'
     db_name: discourse
@@ -144,3 +145,5 @@ pod_spec:
                   - hosts:
                       - 'discourse.local'
                     secretName: 'discourse_local'
+=======
+>>>>>>> tests/unit/fixtures/config_valid_complete.yaml
diff --git a/tests/unit/fixtures/config_valid_no_saml_fingerprint.yaml b/tests/unit/fixtures/config_valid_no_saml_fingerprint.yaml
index b3f7f54..897377c 100644
--- a/tests/unit/fixtures/config_valid_no_saml_fingerprint.yaml
+++ b/tests/unit/fixtures/config_valid_no_saml_fingerprint.yaml
@@ -1,3 +1,4 @@
+<<<<<<< tests/unit/fixtures/config_valid_no_saml_fingerprint.yaml
 config:
     cors_origin: '*'
     db_name: discourse
@@ -44,3 +45,5 @@ pod_config:
     DISCOURSE_SAML_FULL_SCREEN_LOGIN: "true"
     DISCOURSE_MAX_REQS_PER_IP_MODE: "none"
     DISCOURSE_MAX_REQS_RATE_LIMIT_ON_PRIVATE: "false"
+=======
+>>>>>>> tests/unit/fixtures/config_valid_no_saml_fingerprint.yaml
diff --git a/tests/unit/fixtures/config_valid_no_saml_target_url.yaml b/tests/unit/fixtures/config_valid_no_saml_target_url.yaml
index 0999b90..94878ff 100644
--- a/tests/unit/fixtures/config_valid_no_saml_target_url.yaml
+++ b/tests/unit/fixtures/config_valid_no_saml_target_url.yaml
@@ -1,3 +1,4 @@
+<<<<<<< tests/unit/fixtures/config_valid_no_saml_target_url.yaml
 config:
     cors_origin: '*'
     db_name: discourse
@@ -42,3 +43,5 @@ pod_config:
     DISCOURSE_SERVE_STATIC_ASSETS: 'true'
     DISCOURSE_MAX_REQS_PER_IP_MODE: "none"
     DISCOURSE_MAX_REQS_RATE_LIMIT_ON_PRIVATE: "false"
+=======
+>>>>>>> tests/unit/fixtures/config_valid_no_saml_target_url.yaml
diff --git a/tests/unit/fixtures/config_valid_no_tls.yaml b/tests/unit/fixtures/config_valid_no_tls.yaml
index 2a57ded..d95507b 100644
--- a/tests/unit/fixtures/config_valid_no_tls.yaml
+++ b/tests/unit/fixtures/config_valid_no_tls.yaml
@@ -1,3 +1,4 @@
+<<<<<<< tests/unit/fixtures/config_valid_no_tls.yaml
 config:
     cors_origin: '*'
     db_name: discourse
@@ -107,3 +108,5 @@ pod_spec:
                              serviceName: discourse-k8s
                              servicePort: 3000
                            path: '/'
+=======
+>>>>>>> tests/unit/fixtures/config_valid_no_tls.yaml
diff --git a/tests/unit/fixtures/config_valid_with_tls.yaml b/tests/unit/fixtures/config_valid_with_tls.yaml
index 18c68bc..d18cdce 100644
--- a/tests/unit/fixtures/config_valid_with_tls.yaml
+++ b/tests/unit/fixtures/config_valid_with_tls.yaml
@@ -1,3 +1,4 @@
+<<<<<<< tests/unit/fixtures/config_valid_with_tls.yaml
 config: 
     cors_origin: '*'
     db_name: discourse
@@ -49,3 +50,5 @@ pod_config:
     DISCOURSE_MAX_USER_API_REQS_PER_MINUTE: 400
     DISCOURSE_MAX_ASSET_REQS_PER_IP_PER_10_SECONDS: 400 
     DISCOURSE_MAX_REQS_RATE_LIMIT_ON_PRIVATE: "false"
+=======
+>>>>>>> tests/unit/fixtures/config_valid_with_tls.yaml
diff --git a/tests/unit/fixtures/config_valid_without_tls.yaml b/tests/unit/fixtures/config_valid_without_tls.yaml
index 5091acc..d757c76 100644
--- a/tests/unit/fixtures/config_valid_without_tls.yaml
+++ b/tests/unit/fixtures/config_valid_without_tls.yaml
@@ -1,3 +1,4 @@
+<<<<<<< tests/unit/fixtures/config_valid_without_tls.yaml
 config: 
     cors_origin: '*'
     db_name: discourse
@@ -48,3 +49,5 @@ pod_config:
     DISCOURSE_MAX_USER_API_REQS_PER_MINUTE: 100 
     DISCOURSE_MAX_ASSET_REQS_PER_IP_PER_10_SECONDS: 200 
     DISCOURSE_MAX_REQS_RATE_LIMIT_ON_PRIVATE: "false"
+=======
+>>>>>>> tests/unit/fixtures/config_valid_without_tls.yaml
diff --git a/tests/unit/requirements.txt b/tests/unit/requirements.txt
deleted file mode 100644
index 65431fc..0000000
--- a/tests/unit/requirements.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-mock
-pytest
-pytest-cov
-pyyaml
diff --git a/tests/unit/test_charm.py b/tests/unit/test_charm.py
index 5342278..d4f73c8 100644
--- a/tests/unit/test_charm.py
+++ b/tests/unit/test_charm.py
@@ -3,15 +3,12 @@
 # Copyright 2020 Canonical Ltd.
 # See LICENSE file for licensing details.
 
-import copy
-import glob
-import mock
-import os
 import unittest
-import yaml
 
-from types import SimpleNamespace
+from ops.model import ActiveStatus, BlockedStatus, WaitingStatus
+from ops.testing import Harness
 
+<<<<<<< tests/unit/test_charm.py
 from charm import (
     check_for_config_problems,
     check_for_missing_config_fields,
@@ -19,35 +16,18 @@ from charm import (
     get_pod_spec,
     DiscourseCharm,
 )
+=======
+from tests.unit._patched_charm import DiscourseCharm, pgsql_patch
+>>>>>>> tests/unit/test_charm.py
 
-from ops import testing
 
-
-def load_configs(directory):
-    """Load configs for use by tests.
-
-    Valid and invalid configs are present in the fixtures directory. The files
-    contain the juju config, along with the spec that that config should
-    produce in the case of valid configs. In the case of invalid configs, they
-    contain the juju config and the error that should be triggered by the
-    config. These scenarios are tested below. Additional config variations can
-    be created by creating an appropriately named config file in the fixtures
-    directory. Valid configs should be named: config_valid_###.yaml and invalid
-    configs should be named: config_invalid_###.yaml."""
-    configs = {}
-    for filename in glob.glob(os.path.join(directory, 'config*.yaml')):
-        with open(filename) as file:
-            name, _ = os.path.splitext(os.path.basename(filename))
-            configs[name] = yaml.full_load(file)
-    return configs
-
-
-class TestDiscourseK8sCharmHooksDisabled(unittest.TestCase):
+class TestDiscourseK8sCharm(unittest.TestCase):
     def setUp(self):
-        self.harness = testing.Harness(DiscourseCharm)
-        self.harness.disable_hooks()
-        self.harness.set_leader(True)
+        pgsql_patch.start()
+        self.harness = Harness(DiscourseCharm)
+        self.addCleanup(self.harness.cleanup)
         self.harness.begin()
+<<<<<<< tests/unit/test_charm.py
         self.maxDiff = None
         # Let's list fields we store in config dict() which are not actual charm options
         self.not_actual_charm_config = ['db_user', 'db_password', 'db_host', 'redis_port']
@@ -167,3 +147,132 @@ class TestDiscourseK8sCharmHooksDisabled(unittest.TestCase):
         self.harness.update_config(self.configs['config_valid_complete']['config'], unset=self.not_actual_charm_config)
         self.harness.charm.on_database_relation_joined(action_event)
         self.assertEqual(action_event.database, "discourse")
+=======
+        self.harness.set_leader(True)
+
+    def tearDown(self):
+        pgsql_patch.stop()
+
+    def test_db_relation_not_ready(self):
+        self.harness.container_pebble_ready("discourse")
+        self.assertEqual(
+            self.harness.model.unit.status,
+            WaitingStatus("Waiting for database relation"),
+        )
+
+    def test_config_changed_when_no_saml_target(self):
+        self.add_database_relations()
+        self.harness.container_pebble_ready("discourse")
+        self.harness.update_config(
+            {
+                "external_hostname": "discourse.local",
+                "force_saml_login": True,
+            }
+        )
+        self.assertEqual(
+            self.harness.model.unit.status,
+            BlockedStatus("force_saml_login can not be true without a saml_target_url"),
+        )
+
+    def test_config_changed_when_no_cors(self):
+        self.add_database_relations()
+        self.harness.container_pebble_ready("discourse")
+        self.harness.update_config(
+            {
+                "cors_origin": "",
+                "external_hostname": "discourse.local",
+            }
+        )
+        self.assertEqual(
+            self.harness.model.unit.status,
+            BlockedStatus("Required configuration missing: cors_origin"),
+        )
+
+    def test_config_changed_when_throttle_mode_invalid(self):
+        self.add_database_relations()
+        self.harness.container_pebble_ready("discourse")
+        self.harness.update_config(
+            {
+                "external_hostname": "discourse.local",
+                "throttle_level": "Scream",
+            }
+        )
+        self.assertEqual(
+            self.harness.model.unit.status,
+            BlockedStatus("throttle_level must be one of: none permissive strict"),
+        )
+
+    def test_config_changed_when_valid(self):
+        self.add_database_relations()
+        self.harness.container_pebble_ready("discourse")
+        self.harness.update_config(
+            {
+                "enable_cors": True,
+                "external_hostname": "discourse.local",
+                "force_saml_login": True,
+                "saml_target_url": "https://login.ubuntu.com/+saml",
+                "smtp_password": "OBV10USLYF4K3",
+                "smtp_username": "apikey",
+                "tls_secret_name": "somesecret",
+            }
+        )
+
+        updated_plan = self.harness.get_container_pebble_plan("discourse").to_dict()
+        print(updated_plan)
+        updated_plan_env = updated_plan["services"]["discourse"]["environment"]
+
+        self.assertEqual("*", updated_plan_env["DISCOURSE_CORS_ORIGIN"])
+        self.assertEqual("dbhost", updated_plan_env["DISCOURSE_DB_HOST"])
+        self.assertEqual("discourse-k8s", updated_plan_env["DISCOURSE_DB_NAME"])
+        self.assertEqual("somepasswd", updated_plan_env["DISCOURSE_DB_PASSWORD"])
+        self.assertEqual("someuser", updated_plan_env["DISCOURSE_DB_USERNAME"])
+        self.assertEqual("[e-mail]", updated_plan_env["DISCOURSE_DEVELOPER_EMAILS"])
+        self.assertTrue(updated_plan_env["DISCOURSE_ENABLE_CORS"])
+        self.assertEqual("discourse.local", updated_plan_env["DISCOURSE_HOSTNAME"])
+        self.assertEqual("redis-host", updated_plan_env["DISCOURSE_REDIS_HOST"])
+        self.assertEqual(1010, updated_plan_env["DISCOURSE_REDIS_PORT"])
+        self.assertEqual(
+            "32:15:20:9F:A4:3C:8E:3E:8E:47:72:62:9A:86:8D:0E:E6:CF:45:D5",
+            updated_plan_env["DISCOURSE_SAML_CERT_FINGERPRINT"],
+        )
+        self.assertEqual("true", updated_plan_env["DISCOURSE_SAML_FULL_SCREEN_LOGIN"])
+        self.assertEqual("https://login.ubuntu.com/+saml", updated_plan_env["DISCOURSE_SAML_TARGET_URL"])
+        self.assertTrue(updated_plan_env["DISCOURSE_SERVE_STATIC_ASSETS"])
+        self.assertEqual("127.0.0.1", updated_plan_env["DISCOURSE_SMTP_ADDRESS"])
+        self.assertEqual("none", updated_plan_env["DISCOURSE_SMTP_AUTHENTICATION"])
+        self.assertEqual("foo.internal", updated_plan_env["DISCOURSE_SMTP_DOMAIN"])
+        self.assertEqual("none", updated_plan_env["DISCOURSE_SMTP_OPENSSL_VERIFY_MODE"])
+        self.assertEqual("OBV10USLYF4K3", updated_plan_env["DISCOURSE_SMTP_PASSWORD"])
+        self.assertEqual(587, updated_plan_env["DISCOURSE_SMTP_PORT"])
+        self.assertEqual("apikey", updated_plan_env["DISCOURSE_SMTP_USER_NAME"])
+
+        self.assertEqual(self.harness.model.unit.status, ActiveStatus())
+
+        self.assertEqual("discourse.local", self.harness.charm.ingress.config_dict["service-hostname"])
+        self.assertEqual("somesecret", self.harness.charm.ingress.config_dict["tls-secret-name"])
+        self.assertEqual(20, self.harness.charm.ingress.config_dict["max-body-size"])
+
+    def test_db_relation(self):
+        self.add_database_relations()
+        self.harness.set_leader(True)
+        # testing harness not re-emits deferred events, manually trigger that
+        self.harness.framework.reemit()
+        db_relation_data = self.harness.get_relation_data(self.db_relation_id, self.harness.charm.app.name)
+        self.assertEqual(
+            db_relation_data.get("database"),
+            "discourse-k8s",
+            "database name should be set after relation joined",
+        )
+
+    def add_database_relations(self):
+        self.harness.charm._stored.db_name = "discourse-k8s"
+        self.harness.charm._stored.db_user = "someuser"
+        self.harness.charm._stored.db_password = "somepasswd"
+        self.harness.charm._stored.db_host = "dbhost"
+        self.db_relation_id = self.harness.add_relation("db", self.harness.charm.app.name)
+        self.harness.add_relation_unit(self.db_relation_id, "postgresql/0")
+
+        redis_relation_id = self.harness.add_relation("redis", self.harness.charm.app.name)
+        self.harness.add_relation_unit(redis_relation_id, "redis/0")
+        self.harness.charm._stored.redis_relation = {redis_relation_id: {"hostname": "redis-host", "port": 1010}}
+>>>>>>> tests/unit/test_charm.py
diff --git a/tox.ini b/tox.ini
index 6c0b24c..63e371f 100644
--- a/tox.ini
+++ b/tox.ini
@@ -5,6 +5,13 @@ skip_missing_interpreters = True
 
 [testenv]
 basepython = python3
+<<<<<<< tox.ini
+=======
+setenv =
+  PYTHONPATH = {toxinidir}/lib:{toxinidir}/src:{toxinidir}/tests:{toxinidir}/build/lib:{toxinidir}/build/venv
+passenv =
+  PYTHONPATH
+>>>>>>> tox.ini
 
 [testenv:unit]
 commands =
@@ -12,9 +19,12 @@ commands =
       {posargs:-v  --cov=src --cov-report=term-missing --cov-branch}
 deps = -r{toxinidir}/tests/unit/requirements.txt
        -r{toxinidir}/requirements.txt
+<<<<<<< tox.ini
 setenv =
   PYTHONPATH = {toxinidir}/lib:{toxinidir}/src
   TZ=UTC
+=======
+>>>>>>> tox.ini
 
 [testenv:black]
 commands = black src/ tests/