Classic Confinement Request for upgrade-cdk

store-requests classic-confinement
1

Request for classic confinement for snap “upgrade-cdk”

  • name: upgrade-cdk

  • description: upgrade-cdk automates the CDK (Charmed Distribution of Kubernetes) upgrade workflow using the Jubilant library.

  • snapcraft: https://github.com/canonical/upgrade-cdk/blob/main/snap/snapcraft.yaml

  • upstream: https://github.com/canonical/upgrade-cdk (Private to Canonical)

  • upstream-relation: I am the upstream author and maintainer

  • supported-category: Juju helpers

  • reasoning: Why classic is needed: upgrade-cdk requires unrestricted filesystem access to below paths:

    • Juju credentials at ~/.local/share/juju (written by the juju snap)
    • Kubernetes config at ~/.kube/config or $KUBECONFIG
    • SSH keys used for “juju scp” opetaions
    • The juju snap binary

    These paths are outside the snap’s home directory and cannot be accessed under strict confinement.

X I understand that strict confinement is generally preferred over classic.

X I’ve tried the existing interfaces to make the snap to work under strict confinement.

2

This request has been added to the queue for review by the @reviewers team.

3

Should that not rather be the “Juju helpers” category ?

4

Was not very clear what juju helpers mean here so chose that option. If I now look at it from your perspective I would agree. Updated the category in the description. Thanks

1 Like
5

Hey @canonikamal

Given the reasoning provided, I think there are alternatives to make it work under strict confinement.

Juju credentials at ~/.local/share/juju (written by the juju snap)

Kubernetes config at ~/.kube/config or $KUBECONFIG

personal-files can be used for this

SSH keys used for “juju scp” opetaions

ssh-keys interface can be used here

The juju snap binary

The juju-bin content slot exposed by the juju snap can be used for this

6

Thanks for the feedback @jslarraz

I’ve updated the snap according to the options shared and it works well with strict confinement now, but the updated revision would still need a manual review for:

human review required due to 'allow-installation' constraint (bool) declaration-snap-v2_plugs_installation (juju-data, personal-files)

human review required due to 'allow-installation' constraint (bool) declaration-snap-v2_plugs_installation (kube-config, personal-files)
7

Raised a privileged access request as guided: Privileged interfaces request: upgrade-cdk (personal-files) So, this one for classic confinement can be archived. Thanks