tls: add sunbeam cluster refresh manual-tls-certificates-operator com…

[hemanthnakkina]

…mand

• Add MANUAL_CERT_AUTH_CHANNEL constant to versions.py and replace hardcoded "1/stable"/"latest/stable" strings in tls/ca.py, tls/common.py and tls/vault.py
• Add manual-tls-certificates to INFRA_APPS so the generic LatestInChannel refresh skips it
• Add ManualTLSCharmUpgradeStep (steps/manual_tls.py) which:
  • Skips if the app is not deployed
  • Skips if a revision is pinned in manifest and already matches the deployed revision
  • Skips if no revision is pinned and the deployed channel and revision already match the latest available on the manifest channel
  • Uses snapshot_workload_status to accept the pre-refresh workload status or active when waiting
  • Passes channel and revision from manifest to charm_refresh, falling back to MANUAL_CERT_AUTH_CHANNEL
  • Updates terraform tfvars after refresh (manifest takes precedence over override for charm keys)
• Add sunbeam cluster refresh manual-tls-certificates-operator subcommand with optional -m/--manifest flag
• Add unit tests covering all skip/run branches

[Raven-182]

LGTM overall. The only concern I have is allowing switching channels using the manifest. For example, I deployed manual-tls-certificates manually on 1/stable with ubuntu@24.04, but trying to upgrade it to latest/stable fails because latest/stable only supports ubuntu@22.04. This failure will be caught by the exception handling in this step, but should switching channels in this way be allowed at all?

[hemanthnakkina]

LGTM overall. The only concern I have is allowing switching channels using the manifest. For example, I deployed manual-tls-certificates manually on 1/stable with ubuntu@24.04, but trying to upgrade it to latest/stable fails because latest/stable only supports ubuntu@22.04. This failure will be caught by the exception handling in this step, but should switching channels in this way be allowed at all?

Thanks for the review!

In these specific commands for INFRA_APPS we should be supporting switching channels. I will try the other way round and see what happens i.e., switching from latest/stable to 1/stable