canonical / canonical/mongo-single-kernel-library
Adjust logrotate service so that it doesn't rely on getting the Pebble plan as a non-admin Pebble user
- Dominant language
- Python
- Stars
- 1
- Forks
- 2
- Avg merge
- 2d 23h
- Merged PRs (30d)
- 22
Description
The next version of Pebble [will require admin access to get the plan](https://github.com/canonical/pebble/pull/785), so that it's safer to include sensitive data (particularly in environment variables).
That means that [this code that runs `pebble plan`](https://github.com/canonical/mongo-single-kernel-library/blob/81bddf6c855ca99064b7f8348f6efb358a029c89/single_kernel_mongo/utils/helpers.py#L33), as the mongodb user I think, will no longer work (it will error out with an access denied response).
You could add a Pebble identity for the the user that runs the command that gives it admin access, but I think that would be the wrong approach, since it shouldn't need to have full access to Pebble (which is basically unlimited access to the container). Instead, it would be better to pass the content to the service another way, like in a file.
Contributor guide
Research direction
Start at single_kernel_mongo/utils/helpers.py line 33, where the logrotate service runs `pebble plan` as the mongodb user. Check how the service currently receives this content and identify a way to provide it without requiring non-admin plan access. Done means logrotate continues to receive the needed plan content when the next Pebble access restriction is in effect.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- mongodb, python
- Domain
- devops
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100