Classic Confinement Request for upgrade-cdk

store-requests classic-confinement
1

Request for classic confinement for snap “upgrade-cdk”

  • name: upgrade-cdk

  • description: upgrade-cdk automates the CDK (Charmed Distribution of Kubernetes) upgrade workflow using the Jubilant library.

  • snapcraft: https://github.com/canonical/upgrade-cdk/blob/main/snap/snapcraft.yaml

  • upstream: https://github.com/canonical/upgrade-cdk (Private to Canonical)

  • upstream-relation: I am the upstream author and maintainer

  • supported-category: Juju helpers

  • reasoning: Why classic is needed: upgrade-cdk requires unrestricted filesystem access to below paths:

    • Juju credentials at ~/.local/share/juju (written by the juju snap)
    • Kubernetes config at ~/.kube/config or $KUBECONFIG
    • SSH keys used for “juju scp” opetaions
    • The juju snap binary

    These paths are outside the snap’s home directory and cannot be accessed under strict confinement.

X I understand that strict confinement is generally preferred over classic.

X I’ve tried the existing interfaces to make the snap to work under strict confinement.

2

This request has been added to the queue for review by the @reviewers team.

3

Should that not rather be the “Juju helpers” category ?

4

Was not very clear what juju helpers mean here so chose that option. If I now look at it from your perspective I would agree. Updated the category in the description. Thanks

1 Like
5

Hey @canonikamal

Given the reasoning provided, I think there are alternatives to make it work under strict confinement.

Juju credentials at ~/.local/share/juju (written by the juju snap)

Kubernetes config at ~/.kube/config or $KUBECONFIG

personal-files can be used for this

SSH keys used for “juju scp” opetaions

ssh-keys interface can be used here

The juju snap binary

The juju-bin content slot exposed by the juju snap can be used for this