canonical / canonical/mongo-single-kernel-library

Adjust logrotate service so that it doesn't rely on getting the Pebble plan as a non-admin Pebble user

Open
#189 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
1
Forks
2
Avg merge
2d 23h
Merged PRs (30d)
22

Description

The next version of Pebble [will require admin access to get the plan](https://github.com/canonical/pebble/pull/785), so that it's safer to include sensitive data (particularly in environment variables).

That means that [this code that runs `pebble plan`](https://github.com/canonical/mongo-single-kernel-library/blob/81bddf6c855ca99064b7f8348f6efb358a029c89/single_kernel_mongo/utils/helpers.py#L33), as the mongodb user I think, will no longer work (it will error out with an access denied response).

You could add a Pebble identity for the the user that runs the command that gives it admin access, but I think that would be the wrong approach, since it shouldn't need to have full access to Pebble (which is basically unlimited access to the container). Instead, it would be better to pass the content to the service another way, like in a file.

Contributor guide

Open the contributing guide

Research direction

Start at single_kernel_mongo/utils/helpers.py line 33, where the logrotate service runs `pebble plan` as the mongodb user. Check how the service currently receives this content and identify a way to provide it without requiring non-admin plan access. Done means logrotate continues to receive the needed plan content when the next Pebble access restriction is in effect.

Written by the indexing model from the issue text.

Assessment

Tech stack
mongodb, python
Domain
devops
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.