Auto-connect request for `valkey`, `valkey-chiseled` and `valkey-charmed`

store-requests privileged-interfaces
1

Hello,

I am requesting auto-connection for three interfaces across the valkey, valkey-chiseled and valkey-charmed snaps. These are required for proper initialization, performance health checks, and metrics exporting.

  • hardware-observe

    • Reason: Required by the valkey-server binary to read /sys/devices/system/clocksource/.../current_clocksource. As an extreme-low-latency data store, Valkey checks this during startup to warn administrators if the system is using a slow virtualized clock instead of a fast hardware counter, which severely degrades throughput.
    • Log:
      apparmor="DENIED" operation="open" class="file" profile="snap.valkey-chiseled.server" name="/sys/devices/system/clocksource/clocksource0/current_clocksource" pid=2983713 comm="valkey-server" requested_mask="r" denied_mask="r"

  • mount-observe

    • Reason: Required by snap-exec (the Snap sandbox execution wrapper), as well as the valkey-cli and other bundled tools. Whenever a snap binary, CLI tool, or hook is launched, the environment reads /proc/[pid]/mountinfo to map out the current mount namespace and verify the sandbox filesystem topology.
    • Log:
      apparmor="DENIED" operation="open" class="file" profile="snap.valkey-chiseled.cli" name="/proc/2940903/mountinfo" pid=2940903 comm="snap-exec" requested_mask="r" denied_mask="r"

  • network-observe

    • Reason: Required by the integrated Prometheus metrics-exporter (Prometheus Redis exporter) in valkey-charmed to read /proc/[pid]/net/netstat. This is standard exporter behavior required to successfully scrape and expose network interface telemetry.
    • Log:
      apparmor="DENIED" operation="open" class="file" profile="snap.valkey-charmed.metrics-exporter" name="/proc/3229994/net/netstat" pid=3229994 comm="prometheus-redi" requested_mask="r" denied_mask="r"

Please let me know if you need any additional details. Thank you!

2

This request has been added to the queue for review by the @reviewers team.

3

Hey @skourta

This all sounds reasonable to me. +1 from my side

4

Hello @skourta :slight_smile:

This is also a +1 from my side, for auto-connecting hardware-observe,mount-observe and network-observe interfaces to the valkey , valkey-chiseled and valkey-charmed snaps.

5

+2 for, 0 against granting auto-connection to hardware-observe,mount-observe and network-observe interfaces. This is now live

It seems that valkey , valkey-chiseled are not using the network-observe interface as of now. Let us know if newer revisions of the snaps requires it.