Run db sync manually by leader only

Without db_auto_create = False each barbican-worker attempts to run
alembic upgrades on the database whenever they start. This leads to
race conditions that can leave the sate of the database broken
(multiple alembic version that "overlap").

This change runs the barbican-manage db upgrade by the leader only
avoiding the race condition. charms.openstack also handles the
openstack upgrade process with a call to instance.db_sync.

Change-Id: I6b9498059c7057b73b1c3db0e355456c38b0510e
Closes-Bug: #1827690

src/layer.yaml

@@ -1,4 +1,5 @@
 includes:
+  - layer:leadership
   - layer:openstack-api
   - interface:mysql-shared
   - interface:rabbitmq

src/lib/charm/openstack/barbican.py

@@ -145,6 +145,9 @@ class BarbicanCharm(charms_openstack.charm.HAOpenStackCharm):
 
     group = "barbican"
 
+    # This is the command to sync the database
+    sync_cmd = ['sudo', '-u', 'barbican', 'barbican-manage', 'db', 'upgrade']
+
     def get_amqp_credentials(self):
         """Provide the default amqp username and vhost as a tuple.
 

src/reactive/barbican_handlers.py

@@ -60,6 +60,20 @@ def render_stuff(*args):
                                       'secrets.available'))
         barbican_charm.configure_ssl()
         barbican_charm.assess_status()
+    reactive.set_flag('first-render')
+
+
+@reactive.when('leadership.is_leader')
+@reactive.when('charm.installed')
+@reactive.when('shared-db.available')
+@reactive.when('first-render')
+@reactive.when_not('db.synced')
+def run_db_migration():
+    with charm.provide_charm_instance() as barbican_charm:
+        barbican_charm.db_sync()
+        barbican_charm.restart_all()
+        reactive.set_state('db.synced')
+        barbican_charm.assess_status()
 
 
 @reactive.when('secrets.new-plugin')

src/templates/rocky/barbican.conf

@@ -3,10 +3,7 @@ debug = {{ options.debug }}
 bind_host = {{ options.service_listen_info.barbican_worker.ip }}
 bind_port = {{ options.service_listen_info.barbican_worker.port }}
 host_href = {{ options.external_endpoints.barbican_worker.url }}
-
-# Create the Barbican database on service startup. This is `true` by default
-# up to Ussuri and `false` by default from Victoria on:
-db_auto_create = true
+db_auto_create = False
 
 {% include "parts/section-transport-url" %}
 

unit_tests/test_barbican_handlers.py

@@ -37,9 +37,14 @@ class TestRegisteredHooks(test_utils.TestRegisteredHooks):
                                  'amqp.available',),
                 'secrets_plugin_configure': ('secrets.new-plugin',),
                 'cluster_connected': ('ha.connected',),
+                'run_db_migration': ('leadership.is_leader',
+                                     'charm.installed',
+                                     'shared-db.available',
+                                     'first-render',),
             },
             'when_not': {
                 'cluster_connected': ('ha.available',),
+                'run_db_migration': ('db.synced',),
             },
         }
         # test that the hooks were registered via the