[DPE-4913] Migrate to self-hosted runners (#377)

## Issue
This PR implements
[DPE-4913](https://warthogs.atlassian.net/browse/DPE-4913), namely this
PR:
- migrates all our integration tests runners to using the self-hosted
runners.
- In addition, there are minor fixes such as for the bug reported in
Issue #349
- fix client-integration tests


[DPE-4913]:
https://warthogs.atlassian.net/browse/DPE-4913?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ

.github/workflows/ci.yaml

@@ -16,7 +16,7 @@ on:
 jobs:
   lint:
     name: Lint
-    uses: canonical/data-platform-workflows/.github/workflows/lint.yaml@v16.2.1
+    uses: canonical/data-platform-workflows/.github/workflows/lint.yaml@v16.7.0
 
   unit-test:
     name: Unit test charm
@@ -61,22 +61,23 @@ jobs:
         path:
         - .
         - ./tests/integration/relations/opensearch_provider/application-charm/
-    uses: canonical/data-platform-workflows/.github/workflows/build_charm.yaml@v16.2.1
+    uses: canonical/data-platform-workflows/.github/workflows/build_charm.yaml@v16.7.0
     with:
       path-to-charm-directory: ${{ matrix.path }}
       cache: true
 
   integration-test:
-    name: Integration test charm | 3.4.3
+    name: Integration test charm | 3.4.4
     needs:
       - lint
       - unit-test
       - build
-    uses: canonical/data-platform-workflows/.github/workflows/integration_test_charm.yaml@v16.2.1
+    uses: canonical/data-platform-workflows/.github/workflows/integration_test_charm.yaml@v16.7.0
     with:
       artifact-prefix: packed-charm-cache-true
       cloud: lxd
-      juju-agent-version: 3.4.3
+      juju-agent-version: 3.4.4
+      _beta_allure_report: true
     secrets:
       # GitHub appears to redact each line of a multi-line secret
       # Avoid putting `{` or `}` on a line by itself so that it doesn't get redacted in logs
@@ -86,3 +87,5 @@ jobs:
           "GCP_ACCESS_KEY": "${{ secrets.GCP_ACCESS_KEY }}",
           "GCP_SECRET_KEY": "${{ secrets.GCP_SECRET_KEY }}",
           "GCP_SERVICE_ACCOUNT": "${{ secrets.GCP_SERVICE_ACCOUNT }}", }
+    permissions:
+      contents: write

.github/workflows/release.yaml

@@ -12,6 +12,8 @@ jobs:
     name: Tests
     uses: ./.github/workflows/ci.yaml
     secrets: inherit
+    permissions:
+      contents: write  # Needed for Allure Report beta
 
   # release-libraries:
   #   name: Release libraries
@@ -32,13 +34,13 @@ jobs:
 
   build:
     name: Build charm
-    uses: canonical/data-platform-workflows/.github/workflows/build_charm.yaml@v16.2.1
+    uses: canonical/data-platform-workflows/.github/workflows/build_charm.yaml@v16.7.0
 
   release:
     name: Release charm
     needs:
       - build
-    uses: canonical/data-platform-workflows/.github/workflows/release_charm.yaml@v16.2.1
+    uses: canonical/data-platform-workflows/.github/workflows/release_charm.yaml@v16.7.0
     with:
       channel: 2/edge
       artifact-prefix: ${{ needs.build.outputs.artifact-prefix }}

lib/charms/data_platform_libs/v0/data_interfaces.py

@@ -331,7 +331,7 @@ def _on_topic_requested(self, event: TopicRequestedEvent):
 
 # Increment this PATCH version before using `charmcraft publish-lib` or reset
 # to 0 if you are raising the major API version
-LIBPATCH = 37
+LIBPATCH = 38
 
 PYDEPS = ["ops>=2.0.0"]
 
@@ -2606,6 +2606,14 @@ def set_version(self, relation_id: int, version: str) -> None:
         """
         self.update_relation_data(relation_id, {"version": version})
 
+    def set_subordinated(self, relation_id: int) -> None:
+        """Raises the subordinated flag in the application relation databag.
+
+        Args:
+            relation_id: the identifier for a particular relation.
+        """
+        self.update_relation_data(relation_id, {"subordinated": "true"})
+
 
 class DatabaseProviderEventHandlers(EventHandlers):
     """Provider-side of the database relation handlers."""
@@ -2842,6 +2850,21 @@ def _on_relation_created_event(self, event: RelationCreatedEvent) -> None:
 
     def _on_relation_changed_event(self, event: RelationChangedEvent) -> None:
         """Event emitted when the database relation has changed."""
+        is_subordinate = False
+        remote_unit_data = None
+        for key in event.relation.data.keys():
+            if isinstance(key, Unit) and not key.name.startswith(self.charm.app.name):
+                remote_unit_data = event.relation.data[key]
+            elif isinstance(key, Application) and key.name != self.charm.app.name:
+                is_subordinate = event.relation.data[key].get("subordinated") == "true"
+
+        if is_subordinate:
+            if not remote_unit_data:
+                return
+
+            if remote_unit_data.get("state") != "ready":
+                return
+
         # Check which data has changed to emit customs events.
         diff = self._diff(event)
 

lib/charms/opensearch/v0/opensearch_base_charm.py

@@ -696,7 +696,7 @@ def _on_get_password_action(self, event: ActionEvent):
         )
 
     def on_tls_conf_set(
-        self, _: CertificateAvailableEvent, scope: Scope, cert_type: CertType, renewal: bool
+        self, event: CertificateAvailableEvent, scope: Scope, cert_type: CertType, renewal: bool
     ):
         """Called after certificate ready and stored on the corresponding scope databag.
 
@@ -708,9 +708,11 @@ def on_tls_conf_set(
         current_secrets = self.secrets.get_object(scope, cert_type.val)
 
         if scope == Scope.UNIT:
-            truststore_pwd = self.secrets.get_object(Scope.APP, CertType.APP_ADMIN.val)[
-                "truststore-password"
-            ]
+            admin_secrets = self.secrets.get_object(Scope.APP, CertType.APP_ADMIN.val) or {}
+            if not (truststore_pwd := admin_secrets.get("truststore-password")):
+                event.defer()
+                return
+
             keystore_pwd = self.secrets.get_object(scope, cert_type.val)["keystore-password"]
 
             # node http or transport cert

lib/charms/opensearch/v0/opensearch_tls.py

@@ -442,11 +442,11 @@ def store_new_ca(self, secrets: Dict[str, Any]):
         """Add new CA cert to trust store."""
         keytool = f"sudo {self.jdk_path}/bin/keytool"
 
-        admin_secrets = self.charm.secrets.get_object(Scope.APP, CertType.APP_ADMIN.val)
+        admin_secrets = self.charm.secrets.get_object(Scope.APP, CertType.APP_ADMIN.val) or {}
         if self.charm.unit.is_leader():
             self._create_keystore_pwd_if_not_exists(Scope.APP, CertType.APP_ADMIN, "ca")
 
-        if not (secrets.get("ca-cert", {}) and admin_secrets.get("truststore-password", {})):
+        if not ((secrets or {}).get("ca-cert") and admin_secrets.get("truststore-password")):
             logging.error("CA cert not found, quitting.")
             return