Merge ~marcusboden/juju-lint:bug/1999263 into juju-lint:master

[Marcus Boden]

Added check for nova-compute ephemeral devices config

This alerts if the nova-compute config option "ephemeral-device" is set
to /dev/sdX or /dev/vgX, to prevent ephemeral devices on landing on a
root drive.

Closes-Bug: #1999263

I tested the change on ps5 (ephemeral-device is set to /dev/disk/..., so it passed without error) and did some local test with only a nova-compute charm:
https://pastebin.canonical.com/p/N6qPQ8KxCG/

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

This merge proposal is being monitored by mergebot. Change the status to Approved to merge.

[🤖 prod-jenkaas-bootstack (prod-jenkaas-bootstack)]

PASSED: Continuous integration, rev:d974ec7f398904747589e0fa1a3e6b96b5a406a9
https://jenkins.canonical.com/bootstack/job/lp-juju-lint-ci/59/
Executed test runs:
    SUCCESS: https://jenkins.canonical.com/bootstack/job/lp-charm-test-functest/2060/
    None: https://jenkins.canonical.com/bootstack/job/lp-update-mp/1935/

Click here to trigger a rebuild:
https://jenkins.canonical.com/bootstack/job/lp-juju-lint-ci/59//rebuild

review: Approve (continuous-integration)

[Erhan Sunar (esunar)]

review: Approve

[Gabriel Cocenza (gabrielcocenza)]

Hi Marcus.
Thanks for the patch. The change LGTM, but I think it would be beneficial to have a unit test checking this regex. You can take a look at the unit test code[0] to get some inspiration. Moreover, I think that a "custom-message[1]" would be beneficial for users understand the problem. A message like: "dev/sdX or/dev/vgX should not be used as ephemeral-devices because it can encrypt the root drive"

Thanks

[0]https://git.launchpad.net/juju-lint/tree/tests/unit/test_jujulint.py#n1009
[1] https://git.launchpad.net/juju-lint/tree/contrib/includes/openstack.yaml#n30

review: Needs Information

Unmerged commits

d974ec7... by Marcus Boden on 2023-01-20

Added check for nova-compute ephemeral devices config

This alerts if the nova-compute config option "ephemeral-device" is set
to /dev/sdX or /dev/vgX, to prevent ephemeral devices on landing on a
root drive.

Closes-Bug: #1999263

diff --git a/contrib/includes/openstack.yaml b/contrib/includes/openstack.yaml
index 5814fac..df898c5 100644
--- a/contrib/includes/openstack.yaml
+++ b/contrib/includes/openstack.yaml
@@ -29,6 +29,8 @@ openstack config base: &openstack-config-base
       log-level: warning
       custom-message:
         Default 4 workers is too low for production clouds.
+    ephemeral-device:
+      search: "^((?!/dev/vg|/dev/sd).)*$"
   rabbitmq-server:
     cluster-partition-handling:
       eq: "pause_minority"