Merge ~vultaire/charm-prometheus-blackbox-exporter:allow-icmp into charm-prometheus-blackbox-exporter:master

[Paul Goins]

Added allow_icmp option

This MR requires the merge of a related change for the prometheus-blackbox-exporter snap: https://code.launchpad.net/~vultaire/prometheus-blackbox-exporter-snap/+git/prometheus-blackbox-exporter-snap/+merge/427328

Once the above MR is merged, *and* a new snap is released, then this MR will be ready for testing and review.

----

Regarding the actual updates:

1. The snap required an update to allow for pinging. Default AppArmor rules forbid this, but if we connect the snap to the network-control interface, this is allowed.

2. Per upstream docs for the exporter [1], the exporter either requires a setcap rule to be run to allow for pinging, or an appropriate sysctl setting to allow for it. Setcap runs counter to snap design principles and is not supported, so the sysctl setting appears to be appropriate for this.

Note that the new setting is presently one-directional. I feel like this may be adequate.

If we do want to make this a bidirectional setting, here's how we may be able to do it:

* We may be able to revert the sysctl setting; the best method I can think of is to remove the file we create, manually reset the sysctl rule to a conservative value (e.g. "1 0" to globally disable the setting), and then run "sysctl --system" to reload all sysctl files on disk, including any other files which may provide a valid value for it. It's not the cleanest way, but it may effectively work.

* layer-snap doesn't presently provide a disconnect function to break the snap connection to the network-control slot; we could instead use a subprocess call.

Unmerged commits

f566a97... by Paul Goins on 2022-07-22

Added allow_icmp option

diff --git a/src/config.yaml b/src/config.yaml
index 2f5db13..4104fc3 100644
--- a/src/config.yaml
+++ b/src/config.yaml
@@ -5,6 +5,20 @@ options:
     description: |
         If install_method is set to "snap" this option controlls channel name.
         Supported values are: "stable", "candidate", "beta" and "edge"
+  allow_icmp:
+    default: False
+    type: boolean
+    description: |
+      If enabled, this will allow use of ICMP by the blackbox exporter.
+      Without this, probing via ICMP will fail.
+
+      This is not enabled by default because it requires relaxing several
+      security restrictions - specifically, connecting the network-control
+      plug of the blackbox exporter snap, in addition to setting the
+      net.ipv4.ping_group_range sysctl setting to allow for general use of
+      ICMP Echo packets.
+
+      This setting cannot be disabled once enabled.
   nagios_context:
     default: "juju"
     type: string
diff --git a/src/reactive/prometheus_blackbox_exporter.py b/src/reactive/prometheus_blackbox_exporter.py
index 8058f56..a7e3595 100644
--- a/src/reactive/prometheus_blackbox_exporter.py
+++ b/src/reactive/prometheus_blackbox_exporter.py
@@ -7,7 +7,7 @@ from pathlib import Path
 from zipfile import BadZipFile, ZipFile
 
 from charmhelpers.contrib.charmsupport import nrpe
-from charmhelpers.core import hookenv, host
+from charmhelpers.core import hookenv, host, sysctl
 from charmhelpers.core.templating import render
 
 from charms.layer import snap
@@ -32,6 +32,7 @@ SVC_NAME = "snap.prometheus-blackbox-exporter.daemon"
 PORT_DEF = 9115
 BLACKBOX_EXPORTER_YML_TMPL = "blackbox.yaml.j2"
 CONF_FILE_PATH = "/var/snap/prometheus-blackbox-exporter/current/blackbox.yml"
+SYSCTL_FILE_PATH = "/etc/sysctl.d/90-charm-prometheus-blackbox-exporter.conf"
 
 
 def templates_changed(tmpl_list):
@@ -58,6 +59,18 @@ def upgrade():
     set_state("blackbox-exporter.do-restart")
 
 
+@when("config.changed.allow_icmp")
+@when_not("blackbox-exporter.icmp_configured")
+def enable_icmp():
+    """Update system to allow blackbox exporter to use ICMP."""
+    config = hookenv.config()
+    if config.get("allow_icmp", False):
+        snap.connect("prometheus-blackbox-exporter:network-control", ":network-control")
+        sysctl.create({"net.ipv4.ping_group_range": "0 2147483647"}, SYSCTL_FILE_PATH)
+        set_state("blackbox-exporter.icmp_configured")
+    # Note: Disabling this setting is not presently supported by the charm.
+
+
 def get_modules():
     """Load the modules."""
     config = hookenv.config()