Merge ~barryprice/charm-k8s-bind/+git/charm-k8s-bind:sidecar into charm-k8s-bind:master

[Barry Price]

WIP sidecar conversion for bind (test coverage not yet complete), with a few tweaks to base files

492731a... by Barry Price on 2021-05-18

Rename charm for consistency with others

66bae80... by Barry Price on 2021-05-19

Bugfixes

0511d12... by Barry Price on 2021-05-19

Bind, not Mattermost!

0ae5151... by Barry Price on 2021-05-19

Remove duplicate hook

270c6f0... by Barry Price on 2021-05-19

Use the new image spec with a single wrapper to apply config and run the service

3c06f70... by Barry Price on 2021-05-21

Remove obsolete unit tests (i.e. most of them)

0056497... by Barry Price on 2021-05-21

Address conflicts

a353662... by Barry Price on 2021-05-21

Merge from master, address conflicts

1646220... by Barry Price on 2021-05-21

Add tests, bring us up to 55% coverage

1594dbe... by Barry Price on 2021-05-21

Add HTML test coverage report

eb36238... by Barry Price on 2021-05-21

Add a few more tests

059eb95... by Barry Price on 2021-05-28

More test fixes, giving us 68% coverage

6a7adf0... by Barry Price on 2021-05-28

Pull from upstream, enable RFC1918 net recursion by default, add tests to 69% coverage

7f3608e... by Barry Price on 2021-05-28

Pull from master, fix conflicts

3334949... by Barry Price on 2021-05-28

Pull from master, fix conflicts

e9fb7e4... by Barry Price on 2021-05-28

Charmcraft should pack, not build

44c1096... by Barry Price on 2021-06-01

Add logging/verbosity throughout

74d5bf1... by Barry Price on 2021-06-01

Move wrapper logging inside the script, fix the exec bug

6c1203c... by Barry Price on 2021-06-01

Move wrapper logging into the pebble command

6baed5e... by Barry Price on 2021-06-01

Restore semicolons to wrapper script

9e4f75e... by Barry Price on 2021-06-06

Restore default config if recursion is toggled off post-install

3e2c7cb... by Barry Price on 2021-06-07

Merge from master, address conflicts

3f0d665... by Barry Price on 2021-06-07

Merge from master, address conflicts

f524d71... by Barry Price on 2021-06-07

Merge branch 'master' into sidecar

Unmerged commits

f524d71... by Barry Price on 2021-06-07

Merge branch 'master' into sidecar

3f0d665... by Barry Price on 2021-06-07

Merge from master, address conflicts

3e2c7cb... by Barry Price on 2021-06-07

Merge from master, address conflicts

9e4f75e... by Barry Price on 2021-06-06

Restore default config if recursion is toggled off post-install

6baed5e... by Barry Price on 2021-06-01

Restore semicolons to wrapper script

6c1203c... by Barry Price on 2021-06-01

Move wrapper logging into the pebble command

74d5bf1... by Barry Price on 2021-06-01

Move wrapper logging inside the script, fix the exec bug

44c1096... by Barry Price on 2021-06-01

Add logging/verbosity throughout

e9fb7e4... by Barry Price on 2021-05-28

Charmcraft should pack, not build

3334949... by Barry Price on 2021-05-28

Pull from master, fix conflicts

diff --git a/.jujuignore b/.jujuignore
index 128851d..2a8f147 100644
--- a/.jujuignore
+++ b/.jujuignore
@@ -1,9 +1,14 @@
-*~
 *.charm
+*.py[cod]
+*~
 .coverage
 .gitignore
-__pycache__
-/dockerfile
-/image-scripts/
-/tests/
+/Dockerfile
 /Makefile
+/env
+/htmlcov/
+/image-scripts/
+__pycache__
+requirements.txt
+tests/
+tox.ini
diff --git a/Makefile b/Makefile
index 564aeb9..9869bc8 100644
--- a/Makefile
+++ b/Makefile
@@ -5,11 +5,16 @@ blacken:
 	@echo "Normalising python layout with black."
 	@tox -e black
 
-
 lint: blacken
 	@echo "Running flake8"
 	@tox -e lint
 
+deps:
+	@echo "Checking charmcraft is present."
+	@command -v charmcraft >/dev/null || { echo "Please install charmcraft to continue ('sudo snap install charmcraft')" && false; }
+	@echo "Checking tox is present."
+	@command -v tox >/dev/null || { echo "Please install tox to continue ('sudo apt-get install tox')" && false; }
+
 # We actually use the build directory created by charmcraft,
 # but the .charm file makes a much more convenient sentinel.
 unittest: bind-k8s.charm
@@ -22,11 +27,13 @@ clean:
 	@git clean -fXd
 
 bind-k8s.charm: src/*.py requirements.txt
-	charmcraft build
+	charmcraft pack
 
 image-deps:
 	@echo "Checking shellcheck is present."
 	@command -v shellcheck >/dev/null || { echo "Please install shellcheck to continue ('sudo snap install shellcheck')" && false; }
+	@echo "Checking docker is present."
+	@command -v docker >/dev/null || { echo "Please install docker to continue ('sudo apt-get install docker.io')" && false; }
 
 image-lint: image-deps
 	@echo "Running shellcheck."
@@ -43,4 +50,4 @@ image-build: image-lint
 		-t bind:$(DIST_RELEASE)-latest \
 		.
 
-.PHONY: blacken lint unittest test clean image-deps image-lint image-build
+.PHONY: blacken lint deps unittest test clean image-deps image-lint image-build
diff --git a/README.md b/README.md
index 8a2b7e6..c4f750f 100644
--- a/README.md
+++ b/README.md
@@ -17,7 +17,7 @@ details on using Juju with MicroK8s for easy local testing [see here](https://ju
 
 To deploy this charm in a juju k8s model:
 ```
-juju deploy bind-k8s
+juju deploy bind-k8s --channel edge
 ```
 The charm will deploy bind with its stock Ubuntu package configuration, which
 will forward all queries to root name servers. DNSSEC is enabled by default.
diff --git a/config.yaml b/config.yaml
index 9b1de1d..e65e986 100644
--- a/config.yaml
+++ b/config.yaml
@@ -1,33 +1,4 @@
 options:
-  bind_image_path:
-    type: string
-    description: |
-        The location of the image to use, e.g. "registry.example.com/bind:v1".
-
-        This setting is required.
-    default: "bindcharmers/bind:v1.0-20.04_edge"
-  bind_image_username:
-    type: string
-    description: "Username to use for the configured image registry, if required"
-    default: ""
-  bind_image_password:
-    type: string
-    description: "Password to use for the configured image registry, if required"
-    default: ""
-  container_config:
-    type: string
-    description: >
-      YAML formatted map of container config keys & values. These are
-      generally accessed from inside the image as environment variables.
-      Use to configure customized Wordpress images. This configuration
-      gets logged; use container_secrets for secrets.
-    default: ""
-  container_secrets:
-    type: string
-    description: >
-      YAML formatted map of secrets. Works just like container_config,
-      except that values should not be logged.
-    default: ""
   custom_config_repo:
     type: string
     description: |
diff --git a/metadata.yaml b/metadata.yaml
index 6c09e29..87d17fc 100644
--- a/metadata.yaml
+++ b/metadata.yaml
@@ -5,11 +5,15 @@ docs: https://discourse.charmhub.io/t/bind-documentation-overview/3973
 description: |
   The original, complete open source DNS implementation.
   https://www.isc.org/bind/
-min-juju-version: 2.8.0
 maintainers:
   - https://launchpad.net/~bind-charmers <[e-mail]>
 tags:
   - network
   - ops
-series:
-  - kubernetes
+containers:
+  bind:
+    resource: bind-image
+resources:
+  bind-image:
+    type: oci-image
+    description: Docker image for Bind to run
diff --git a/requirements.txt b/requirements.txt
index 2d81d3b..fcf2df8 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1 +1 @@
-ops
+https://github.com/canonical/operator/archive/refs/heads/master.zip
diff --git a/src/charm.py b/src/charm.py
index 964922c..c9383e0 100755
--- a/src/charm.py
+++ b/src/charm.py
@@ -5,29 +5,96 @@
 
 import logging
 from ops.charm import CharmBase
+from ops.framework import StoredState
 from ops.main import main
-from ops.model import ActiveStatus, MaintenanceStatus
-from pprint import pformat
-from yaml import safe_load
+from ops.model import ActiveStatus, BlockedStatus, MaintenanceStatus, WaitingStatus
 
-logger = logging.getLogger()
+logger = logging.getLogger(__name__)
 
-REQUIRED_SETTINGS = ['bind_image_path']
+CONTAINER_NAME = 'bind'  # per metadata.yaml
+REQUIRED_SETTINGS = []
 
 
 class BindK8sCharm(CharmBase):
+
+    state = StoredState()
+
     def __init__(self, *args):
         """Initialise our class, we only care about 'start' and 'config-changed' hooks."""
         super().__init__(*args)
-        self.framework.observe(self.on.start, self.on_config_changed)
-        self.framework.observe(self.on.config_changed, self.on_config_changed)
+
+        self.framework.observe(self.on.config_changed, self._on_config_changed)
+        self.framework.observe(self.on.bind_pebble_ready, self._on_bind_pebble_ready)
+
+        # state
+        self.state.set_default(bind_pebble_ready=False)
+
+    def _get_pebble_config(self):
+        """Generate our pebble config."""
+        logger.debug('Generating pebble config')
+        env_config = self._generate_env_config()
+        pebble_config = {
+            "summary": "Bind layer",
+            "description": "Bind layer",
+            "services": {
+                "bind": {
+                    "override": "replace",
+                    "summary": "Bind service",
+                    "command": 'bash -c "/usr/local/bin/docker-wrapper.sh &> /proc/1/fd/1"',
+                    "startup": "enabled",
+                    "environment": env_config,
+                }
+            },
+        }
+        return pebble_config
+
+    def _on_bind_pebble_ready(self, event):
+        """Handle the on pebble ready event."""
+        logger.debug('Setting self.state.bind_pebble_ready to True')
+        self.state.bind_pebble_ready = True
+
+    def _on_config_changed(self, event):
+        """Handle config-changed event."""
+        problems = self._check_for_config_problems()
+        if problems:
+            self.unit.status = BlockedStatus(problems)
+            return
+
+        if not self.state.bind_pebble_ready:
+            logger.debug('Waiting for pebble')
+            self.unit.status = WaitingStatus('Waiting for pebble')
+            event.defer()
+            return
+
+        pebble_config = self._get_pebble_config()
+        if not pebble_config:
+            # Charm will be in blocked status.
+            event.defer()
+            return
+
+        container = self.unit.get_container(CONTAINER_NAME)
+        services = container.get_plan().to_dict().get("services", {})
+        if services != pebble_config["services"]:
+            logger.debug('Adding layer to pebble')
+            self.unit.status = MaintenanceStatus('Adding layer to pebble')
+            container.add_layer("bind", pebble_config, combine=True)
+
+            self.unit.status = MaintenanceStatus('Restarting bind')
+            service = container.get_service("bind")
+            if service.is_running():
+                logger.debug('Stopping bind')
+                container.stop("bind")
+            logger.debug('Starting bind')
+            container.start("bind")
+
+        self.unit.status = ActiveStatus()
 
     def _check_for_config_problems(self):
         """Return a string describing any configuration problems (or an empty string if none)."""
         problems = ''
 
         missing = self._missing_charm_settings()
-        if missing:
+        if missing:  # pragma: no cover
             problems = 'required setting(s) empty: {}'.format(', '.join(sorted(missing)))
 
         return problems
@@ -38,104 +105,27 @@ class BindK8sCharm(CharmBase):
 
         missing = {setting for setting in REQUIRED_SETTINGS if not config[setting]}
 
-        if config['bind_image_username'] and not config['bind_image_password']:
-            missing.add('bind_image_password')
-
         return missing
 
-    def on_config_changed(self, event):
-        """Check that we're leader, and if so, set up the pod."""
-        if self.model.unit.is_leader():
-            # Only the leader can set_spec().
-            resources = self.make_pod_resources()
-            spec = self.make_pod_spec()
-            spec.update(resources)
-
-            msg = "Configuring pod"
-            logger.info(msg)
-            self.model.unit.status = MaintenanceStatus(msg)
-            self.model.pod.set_spec(spec)
-
-            msg = "Pod configured"
-            logger.info(msg)
-            self.model.unit.status = ActiveStatus(msg)
-        else:
-            logger.info("Spec changes ignored by non-leader")
-            self.model.unit.status = ActiveStatus()
-
-    def make_pod_resources(self):
-        """Compile and return our pod resources (e.g. ingresses)."""
-        # LP#1889746: We need to define a manual ingress here to work around LP#1889703.
-        resources = {}  # TODO
-        logger.info("This is the Kubernetes Pod resources <<EOM\n{}\nEOM".format(pformat(resources)))
-        return resources
-
-    def generate_pod_config(self, secured=True):
-        """Kubernetes pod config generator.
-
-        generate_pod_config generates Kubernetes deployment config.
-        If the secured keyword is set then it will return a sanitised copy
-        without exposing secrets.
-        """
+    def _generate_env_config(self):
+        """Kubernetes environment config generator."""
         config = self.model.config
-        pod_config = {}
-        if config["container_config"].strip():
-            pod_config = safe_load(config["container_config"])
-
+        env_config = {}
         if config["custom_config_repo"].strip():
-            pod_config["CUSTOM_CONFIG_REPO"] = config["custom_config_repo"]
-
-        if config["enable_rfc1918_recursion"]:
-            pod_config["ENABLE_RFC1918_RECURSION"] = 1
-
-        if config["https_proxy"].strip():
-            pod_config["http_proxy"] = config["https_proxy"]
-            pod_config["https_proxy"] = config["https_proxy"]
-
-        if secured:
-            return pod_config
-
-        if config["container_secrets"].strip():
-            container_secrets = safe_load(config["container_secrets"])
+            logger.debug('Custom config repo set')
+            env_config["CUSTOM_CONFIG_REPO"] = config["custom_config_repo"]
+        elif config["enable_rfc1918_recursion"]:
+            logger.debug('No custom config repo set, recursion will be enabled')
+            env_config["ENABLE_RFC1918_RECURSION"] = 1
         else:
-            container_secrets = {}
-
-        pod_config.update(container_secrets)
-        return pod_config
-
-    def make_pod_spec(self):
-        """Set up and return our full pod spec here."""
-        config = self.model.config
-        full_pod_config = self.generate_pod_config(secured=False)
-        secure_pod_config = self.generate_pod_config(secured=True)
-
-        ports = [
-            {"name": "domain-tcp", "containerPort": 53, "protocol": "TCP"},
-            {"name": "domain-udp", "containerPort": 53, "protocol": "UDP"},
-        ]
-
-        spec = {
-            "version": 2,
-            "containers": [
-                {
-                    "name": self.app.name,
-                    "imageDetails": {"imagePath": config["bind_image_path"]},
-                    "ports": ports,
-                    "config": secure_pod_config,
-                    "kubernetes": {"readinessProbe": {"exec": {"command": ["/usr/local/bin/dns-check.sh"]}}},
-                }
-            ],
-        }
-
-        logger.info("This is the Kubernetes Pod spec config (sans secrets) <<EOM\n{}\nEOM".format(pformat(spec)))
+            logger.debug('No custom config repo set, recursion disabled too, deploying with stock config')
+            pass
 
-        if config.get("bind_image_username") and config.get("bind_image_password"):
-            spec.get("containers")[0].get("imageDetails")["username"] = config["bind_image_username"]
-            spec.get("containers")[0].get("imageDetails")["password"] = config["bind_image_password"]
-
-        secure_pod_config.update(full_pod_config)
+        if config["https_proxy"].strip():
+            env_config["http_proxy"] = config["https_proxy"]
+            env_config["https_proxy"] = config["https_proxy"]
 
-        return spec
+        return env_config
 
 
 if __name__ == "__main__":  # pragma: no cover
diff --git a/tests/unit/test_charm.py b/tests/unit/test_charm.py
index c9834d1..1736527 100644
--- a/tests/unit/test_charm.py
+++ b/tests/unit/test_charm.py
@@ -3,268 +3,127 @@
 
 import unittest
 
+from unittest.mock import MagicMock
+
 from charm import BindK8sCharm
 
 from ops import testing
-from ops.model import ActiveStatus
+from ops.model import WaitingStatus
 
-CONFIG_EMPTY = {
-    'bind_image_path': '',
-    'bind_image_username': '',
-    'bind_image_password': '',
-    'container_config': '',
-    'container_secrets': '',
+CONFIG_VALID = {
     'custom_config_repo': '',
+    'enable_rfc1918_recursion': True,
     'https_proxy': '',
 }
 
-CONFIG_IMAGE_PASSWORD_MISSING = {
-    'bind_image_path': 'example.com/bind:v1',
-    'bind_image_username': 'username',
-    'bind_image_password': '',
-    'container_config': '',
-    'container_secrets': '',
-    'custom_config_repo': '',
-    'https_proxy': '',
-}
 
-CONFIG_VALID = {
-    'bind_image_path': 'example.com/bind:v1',
-    'bind_image_username': '',
-    'bind_image_password': '',
-    'container_config': '',
-    'container_secrets': '',
-    'custom_config_repo': '',
-    'https_proxy': '',
-}
+def _pebble_services_bind(pebble_config):
+    """Extract bind's service from the given pebble_config."""
+    return pebble_config['services']['bind']
 
-CONFIG_VALID_WITHOUT_RECURSION = {
-    'bind_image_path': 'example.com/bind:v1',
-    'bind_image_username': '',
-    'bind_image_password': '',
-    'enable_rfc1918_recursion': False,
-    'container_config': '',
-    'container_secrets': '',
-    'custom_config_repo': '',
-    'https_proxy': '',
-}
 
-CONFIG_VALID_WITH_CREDS = {
-    'bind_image_path': 'secure.example.com/bind:v1',
-    'bind_image_username': 'test-user',
-    'bind_image_password': 'test-password',
-    'container_config': '',
-    'container_secrets': '',
-    'custom_config_repo': '',
-    'https_proxy': '',
-}
+def _pebble_services_bind_env(pebble_config):
+    """Extract bind's service environment from the given pebble_config."""
+    return pebble_config['services']['bind']['environment']
 
-CONFIG_VALID_WITH_CONTAINER_CONFIG = {
-    'bind_image_path': 'example.com/bind:v1',
-    'bind_image_username': '',
-    'bind_image_password': '',
-    'container_config': '"magic_number": 123',
-    'container_secrets': '',
-    'custom_config_repo': '',
-    'https_proxy': '',
-}
 
-CONFIG_VALID_WITH_CONTAINER_CONFIG_AND_SECRETS = {
-    'bind_image_path': 'example.com/bind:v1',
-    'bind_image_username': '',
-    'bind_image_password': '',
-    'container_config': '"magic_number": 123',
-    'container_secrets': '"secret_password": "xyzzy"',
-    'custom_config_repo': '',
-    'https_proxy': '',
-}
+def _pebble_summary(pebble_config):
+    """Extract bind's summary from the given pebble_config."""
+    return pebble_config['summary']
 
-CONFIG_VALID_WITH_CUSTOM_CONFIG_REPO_AND_PROXY = {
-    'bind_image_path': 'example.com/bind:v1',
-    'bind_image_username': '',
-    'bind_image_password': '',
-    'container_config': '',
-    'container_secrets': '',
-    'custom_config_repo': 'https://git.example.com/example-bind-config.git',
-    'https_proxy': 'http://webproxy.example.com:3128/',
-}
+
+def _pebble_description(pebble_config):
+    """Extract bind's description from the given pebble_config."""
+    return pebble_config['description']
 
 
 class TestBindK8s(unittest.TestCase):
     maxDiff = None
 
     def setUp(self):
+        """Setup the harness object."""
         self.harness = testing.Harness(BindK8sCharm)
         self.harness.begin()
-        self.harness.disable_hooks()
+        self.harness.add_oci_resource('bind-image')
 
-    def test_check_for_config_problems_empty_image_path(self):
-        """Confirm that we generate an error if we're not told what image to use."""
-        self.harness.update_config(CONFIG_EMPTY)
-        expected = 'required setting(s) empty: bind_image_path'
-        self.assertEqual(self.harness.charm._check_for_config_problems(), expected)
+        self._expected = dict()
 
-    def test_check_for_config_problems_empty_image_password(self):
-        """Confirm that we generate an error if we're not given valid registry creds."""
-        self.harness.update_config(CONFIG_IMAGE_PASSWORD_MISSING)
-        expected = 'required setting(s) empty: bind_image_password'
-        self.assertEqual(self.harness.charm._check_for_config_problems(), expected)
+    def tearDown(self):
+        """Cleanup the harness."""
+        self.harness.cleanup()
 
     def test_check_for_config_problems_none(self):
         """Confirm that we accept valid config."""
         self.harness.update_config(CONFIG_VALID)
-        expected = ''
-        self.assertEqual(self.harness.charm._check_for_config_problems(), expected)
+        self._expected = ''
+        self.assertEqual(self.harness.charm._check_for_config_problems(), self._expected)
 
-    def test_make_pod_resources(self):
-        """Confirm that we generate the expected pod resources (see LP#1889746)."""
-        expected = {}
-        self.assertEqual(self.harness.charm.make_pod_resources(), expected)
-
-    def test_make_pod_spec_basic(self):
-        """Confirm that we generate the expected pod spec from valid config."""
+    def test_on_bind_pebble_ready_false(self):
         self.harness.update_config(CONFIG_VALID)
-        expected = {
-            'version': 2,
-            'containers': [
-                {
-                    'name': 'bind-k8s',
-                    'imageDetails': {'imagePath': 'example.com/bind:v1'},
-                    'ports': [
-                        {'containerPort': 53, 'name': 'domain-tcp', 'protocol': 'TCP'},
-                        {'containerPort': 53, 'name': 'domain-udp', 'protocol': 'UDP'},
-                    ],
-                    'config': {'ENABLE_RFC1918_RECURSION': 1},
-                    'kubernetes': {'readinessProbe': {'exec': {'command': ['/usr/local/bin/dns-check.sh']}}},
-                }
-            ],
-        }
-        self.assertEqual(self.harness.charm.make_pod_spec(), expected)
-
-    def test_make_pod_spec_without_recursion(self):
-        """Confirm that we generate the expected pod spec from config disabling recursion."""
-        self.harness.update_config(CONFIG_VALID_WITHOUT_RECURSION)
-        expected = {
-            'version': 2,
-            'containers': [
-                {
-                    'name': 'bind-k8s',
-                    'imageDetails': {'imagePath': 'example.com/bind:v1'},
-                    'ports': [
-                        {'containerPort': 53, 'name': 'domain-tcp', 'protocol': 'TCP'},
-                        {'containerPort': 53, 'name': 'domain-udp', 'protocol': 'UDP'},
-                    ],
-                    'config': {},
-                    'kubernetes': {'readinessProbe': {'exec': {'command': ['/usr/local/bin/dns-check.sh']}}},
-                }
-            ],
-        }
-        self.assertEqual(self.harness.charm.make_pod_spec(), expected)
+        # the event hasn't run yet, so we expect this to be False
+        self._expected = False
+        self.assertEqual(self.harness.charm.state.bind_pebble_ready, self._expected)
 
-    def test_make_pod_spec_with_creds(self):
-        """Confirm that we generate the expected pod spec from config containing credentials."""
-        self.harness.update_config(CONFIG_VALID_WITH_CREDS)
-        expected = {
-            'version': 2,
-            'containers': [
-                {
-                    'name': 'bind-k8s',
-                    'imageDetails': {
-                        'imagePath': 'secure.example.com/bind:v1',
-                        'username': 'test-user',
-                        'password': 'test-password',
-                    },
-                    'ports': [
-                        {'containerPort': 53, 'name': 'domain-tcp', 'protocol': 'TCP'},
-                        {'containerPort': 53, 'name': 'domain-udp', 'protocol': 'UDP'},
-                    ],
-                    'config': {'ENABLE_RFC1918_RECURSION': 1},
-                    'kubernetes': {'readinessProbe': {'exec': {'command': ['/usr/local/bin/dns-check.sh']}}},
-                }
-            ],
-        }
-        self.assertEqual(self.harness.charm.make_pod_spec(), expected)
-
-    def test_make_pod_spec_with_extra_config(self):
-        """Confirm that we generate the expected pod spec from a more involved valid config."""
-        self.harness.update_config(CONFIG_VALID_WITH_CONTAINER_CONFIG)
-        expected = {
-            'version': 2,
-            'containers': [
-                {
-                    'name': 'bind-k8s',
-                    'imageDetails': {'imagePath': 'example.com/bind:v1'},
-                    'ports': [
-                        {'containerPort': 53, 'name': 'domain-tcp', 'protocol': 'TCP'},
-                        {'containerPort': 53, 'name': 'domain-udp', 'protocol': 'UDP'},
-                    ],
-                    'config': {
-                        'ENABLE_RFC1918_RECURSION': 1,
-                        'magic_number': 123,
-                    },
-                    'kubernetes': {'readinessProbe': {'exec': {'command': ['/usr/local/bin/dns-check.sh']}}},
-                }
-            ],
-        }
-        self.assertEqual(self.harness.charm.make_pod_spec(), expected)
+    def test_on_config_changed(self):
+        self.harness.update_config(CONFIG_VALID)
+        self._expected = WaitingStatus('Waiting for pebble')
+        self.assertEqual(self.harness.model.unit.status, self._expected)
 
-    def test_make_pod_spec_with_extra_config_and_secrets(self):
-        """Confirm that we generate the expected pod spec from a more involved valid config that includes secrets."""
-        self.harness.update_config(CONFIG_VALID_WITH_CONTAINER_CONFIG_AND_SECRETS)
-        expected = {
-            'version': 2,
-            'containers': [
-                {
-                    'name': 'bind-k8s',
-                    'imageDetails': {'imagePath': 'example.com/bind:v1'},
-                    'ports': [
-                        {'containerPort': 53, 'name': 'domain-tcp', 'protocol': 'TCP'},
-                        {'containerPort': 53, 'name': 'domain-udp', 'protocol': 'UDP'},
-                    ],
-                    'config': {'ENABLE_RFC1918_RECURSION': 1, 'magic_number': 123, 'secret_password': 'xyzzy'},
-                    'kubernetes': {'readinessProbe': {'exec': {'command': ['/usr/local/bin/dns-check.sh']}}},
-                }
-            ],
-        }
-        self.assertEqual(self.harness.charm.make_pod_spec(), expected)
+    def test_missing_charm_settings(self):
+        """Confirm that we're missing no settings."""
+        self.harness.update_config(CONFIG_VALID)
+        self._expected = set()
+        self.assertEqual(self.harness.charm._missing_charm_settings(), self._expected)
 
-    def test_make_pod_spec_with_custom_config_repo(self):
-        """Confirm that we generate the expected pod spec from a config that includes a custom repo."""
-        self.harness.update_config(CONFIG_VALID_WITH_CUSTOM_CONFIG_REPO_AND_PROXY)
-        expected = {
-            'version': 2,
-            'containers': [
-                {
-                    'name': 'bind-k8s',
-                    'imageDetails': {'imagePath': 'example.com/bind:v1'},
-                    'ports': [
-                        {'containerPort': 53, 'name': 'domain-tcp', 'protocol': 'TCP'},
-                        {'containerPort': 53, 'name': 'domain-udp', 'protocol': 'UDP'},
-                    ],
-                    'config': {
-                        'CUSTOM_CONFIG_REPO': 'https://git.example.com/example-bind-config.git',
-                        'ENABLE_RFC1918_RECURSION': 1,
-                        'http_proxy': 'http://webproxy.example.com:3128/',
-                        'https_proxy': 'http://webproxy.example.com:3128/',
-                    },
-                    'kubernetes': {'readinessProbe': {'exec': {'command': ['/usr/local/bin/dns-check.sh']}}},
-                }
-            ],
-        }
-        self.assertEqual(self.harness.charm.make_pod_spec(), expected)
+    def test_get_pebble_config_description(self):
+        self.harness.update_config(CONFIG_VALID)
+        self._expected = "Bind layer"
+        self.assertEqual(_pebble_description(self.harness.charm._get_pebble_config()), self._expected)
 
-    def test_configure_pod_as_leader(self):
-        """Confirm that our status is set correctly when we're the leader."""
-        self.harness.enable_hooks()
-        self.harness.set_leader(True)
+    def test_get_pebble_config_summary(self):
         self.harness.update_config(CONFIG_VALID)
-        expected = ActiveStatus('Pod configured')
-        self.assertEqual(self.harness.model.unit.status, expected)
+        self._expected = "Bind layer"
+        self.assertEqual(_pebble_summary(self.harness.charm._get_pebble_config()), self._expected)
 
-    def test_configure_pod_as_non_leader(self):
-        """Confirm that our status is set correctly when we're not the leader."""
-        self.harness.enable_hooks()
-        self.harness.set_leader(False)
+    def test_get_pebble_config_services_bind(self):
         self.harness.update_config(CONFIG_VALID)
-        expected = ActiveStatus()
-        self.assertEqual(self.harness.model.unit.status, expected)
+        self._expected = {
+            "override": "replace",
+            "summary": "Bind service",
+            "command": 'bash -c "/usr/local/bin/docker-wrapper.sh &> /proc/1/fd/1"',
+            "startup": "enabled",
+            "environment": {'ENABLE_RFC1918_RECURSION': 1},
+        }
+        self.assertEqual(_pebble_services_bind(self.harness.charm._get_pebble_config()), self._expected)
+
+    def test_generate_env_config_custom_repo(self):
+        self.harness.update_config({"custom_config_repo": "https://git.example.com/example-bind-config.git"})
+        self._expected['CUSTOM_CONFIG_REPO'] = "https://git.example.com/example-bind-config.git"
+        self.assertEqual(_pebble_services_bind_env(self.harness.charm._get_pebble_config()), self._expected)
+
+    def test_generage_env_config_custom_repo_and_proxy(self):
+        self.harness.update_config(
+            {
+                "custom_config_repo": "https://git.example.com/example-bind-config.git",
+                "https_proxy": "http://webproxy.example.com:3128/",
+            }
+        )
+        self._expected['CUSTOM_CONFIG_REPO'] = "https://git.example.com/example-bind-config.git"
+        self._expected['http_proxy'] = "http://webproxy.example.com:3128/"
+        self._expected['https_proxy'] = "http://webproxy.example.com:3128/"
+        self.assertEqual(_pebble_services_bind_env(self.harness.charm._get_pebble_config()), self._expected)
+
+    def test_generate_env_config_just_proxy(self):
+        self.harness.update_config({})
+        self._expected['ENABLE_RFC1918_RECURSION'] = 1
+        self.assertEqual(_pebble_services_bind_env(self.harness.charm._get_pebble_config()), self._expected)
+
+    def test_on_bind_pebble_ready(self):
+        """Test the _on_bind_pebble_ready function."""
+
+        # No problem
+        mock_event = MagicMock()
+        expected_ret = None
+
+        r = self.harness.charm._on_bind_pebble_ready(mock_event)
+        self.assertEqual(r, expected_ret)
diff --git a/tox.ini b/tox.ini
index 0de5149..fb74730 100644
--- a/tox.ini
+++ b/tox.ini
@@ -10,7 +10,7 @@ setenv =
 [testenv:unit]
 commands =
     pytest --ignore mod --ignore {toxinidir}/tests/functional \
-      {posargs:-v  --cov=src --cov-report=term-missing --cov-branch}
+      {posargs:-v  --cov=src --cov-report=term-missing --cov-branch --cov-report=html}
 deps = -r{toxinidir}/tests/unit/requirements.txt
        -r{toxinidir}/requirements.txt
 setenv =