Merge ~vultaire/charm-prometheus-blackbox-exporter:allow-icmp into charm-prometheus-blackbox-exporter:master
Status: | Work in progress |
---|---|
Proposed branch: | ~vultaire/charm-prometheus-blackbox-exporter:allow-icmp |
Merge into: | charm-prometheus-blackbox-exporter:master |
Diff against target: |
65 lines (+28/-1) 2 files modified
src/config.yaml (+14/-0) src/reactive/prometheus_blackbox_exporter.py (+14/-1) |
Related bugs: |
Reviewer | Review Type | Date Requested | Status |
---|---|---|---|
BootStack Reviewers | Pending | ||
Review via email: mp+427330@code.launchpad.net |
Commit message
Added allow_icmp option
Description of the change
This MR requires the merge of a related change for the prometheus-
Once the above MR is merged, *and* a new snap is released, then this MR will be ready for testing and review.
----
Regarding the actual updates:
1. The snap required an update to allow for pinging. Default AppArmor rules forbid this, but if we connect the snap to the network-control interface, this is allowed.
2. Per upstream docs for the exporter [1], the exporter either requires a setcap rule to be run to allow for pinging, or an appropriate sysctl setting to allow for it. Setcap runs counter to snap design principles and is not supported, so the sysctl setting appears to be appropriate for this.
Note that the new setting is presently one-directional. I feel like this may be adequate.
If we do want to make this a bidirectional setting, here's how we may be able to do it:
* We may be able to revert the sysctl setting; the best method I can think of is to remove the file we create, manually reset the sysctl rule to a conservative value (e.g. "1 0" to globally disable the setting), and then run "sysctl --system" to reload all sysctl files on disk, including any other files which may provide a valid value for it. It's not the cleanest way, but it may effectively work.
* layer-snap doesn't presently provide a disconnect function to break the snap connection to the network-control slot; we could instead use a subprocess call.