'classic' confinement for snap "terragrunt"

[cjdc]

To make the review of your request easier, please use the following template to provide all the required details and also include any other information that may be relevant.

---

• name: terragrunt

• description: a thin wrapper for Terraform that provides extra tools

  for working with multiple Terraform modules, remote state, and locking.

• snapcraft: terragrunt/snap/snapcraft.yaml at candidate · snapcrafters/terragrunt · GitHub

• upstream: GitHub - gruntwork-io/terragrunt: Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu/Terraform to scale. · GitHub

• upstream-relation: none

• supported-category: “kubernetes tools requiring arbitrary authentication agents” (similar to terraform)

• reasoning: terragrunt is a wrapper of Terraform/OpenTofu. With strict confinement, the two options would be:

  • ship Terraform/OpenTofu inside this snap: this feels unnecessary and incurs the same concerns previously addressed when making Terraform a classic snap
  • add a content plug in this snap, to be able to rely on the separately installed Terraform/OpenTofu binaries. However, 1) the provider snap(s) do not define such a slot and cannot afaiu, cause it’s a classic snap (terraform), and 2) very much like Terraform, Terragrunt will still dynamically create its own hidden folders (e.g. cache) and may require access to terragrunt files and other resources anywhere in the system

I understand that strict confinement is generally preferred over classic.

I’ve tried the existing interfaces to make the snap to work under strict confinement.

Note that snappy-debug can be used to identify possible required interfaces. See https://snapcraft.io/docs/debug-snaps for more information.

[jslarraz]

Hey @cjdc

Given that Terraform/OpenTofu are classic, terragrunt will need classic even if Terraform/OpenTofu snaps are staged. I think same technical reasons as for Terraform/OpenTofu apply in this case and terragrunt seems to be properly maintained and counts with a relevant user base and contributors.

Could you please clarify whether you are publishing this snap on behalf of snapcrafters or as a personal project? The snapcraft.yaml is under the snapcrafters github repository but the snap belongs to your personal account as of now

Thanks

[cjdc]

@jslarraz ty for replying.

It is being maintained as part of snapcrafters: GitHub - snapcrafters/terragrunt · GitHub.

On the snap store, the snap has indeed been taken over by me, in the past, from another individual contributor, and now moved into the snapcrafters umbrella. snapcrafters is already a collaborator - happy to transfer the ownership too.

[jslarraz]

Hey @cjdc

Thanks for clarifying it. I think transferring the snap ownership to snapcrafters would be a good thing tbh.

As I already said, I think same technical reasons as for Terraform/OpenTofu apply in this case and terragrunt seems to be properly maintained and counts with a relevant user base and contributors. The snap publisher is vetted. This is now live.