Manual review for prometheus-script-exporter

store-requests privileged-interfaces
1

Hi Team,

For the prometheus-script-exporter snap,

Could you please help with the following errors:

human review required due to ‘allow-installation’ constraint (bool) declaration-snap-v2_plugs_installation (etc-script-exporter, system-files)

human review required due to ‘allow-installation’ constraint (bool) declaration-snap-v2_plugs_installation (proc-sys-kernel-random, system-files)

snapcraft.yaml:

name: prometheus-script-exporter
version: '2.15.1'
summary: Prometheus exporter to execute scripts
license: Apache-2.0
contact: luca.bello@canonical.com
issues: https://github.com/canonical/script-exporter-snap/issues
source-code: https://github.com/canonical/script-exporter-snap
website: https://github.com/ricoberger/script_exporter
description: "Script exporter allows to execute scripts and collect metrics through Prometheus from the output or the exit status."
base: core24
grade: stable
confinement: strict
compression: lzo
platforms:
  amd64:
  arm64:
  ppc64el:
  s390x:
plugs:
  etc-script-exporter:
    interface: system-files
    read:
      - /etc/script-exporter.yaml
  proc-sys-kernel-random:
    interface: system-files
    read:
      - /proc/sys/kernel/random/write_wakeup_threshold
      - /proc/sys/kernel/random/read_wakeup_threshold
      - /proc/sys/kernel/random/poolsize
      - /proc/sys/kernel/random/urandom_min_reseed_secs
apps:
  script-exporter:
    daemon: simple
    command: command-wrapper
    install-mode: disable
    restart-condition: on-failure
    plugs:
      - network-bind
      - time-control
      - hardware-observe
      - mount-observe
      - network-observe
      - system-observe
      - log-observe
      - etc-script-exporter
      - proc-sys-kernel-random
parts:
  wrapper:
    plugin: dump
    source: ./snap/local
    source-type: local
    override-build: |
      cp command-wrapper $CRAFT_PART_INSTALL/
  script-exporter:
    plugin: go
    source: https://github.com/ricoberger/script_exporter
    source-type: git
    source-tag: "v2.15.1"
    build-snaps:
      - go
    build-environment:
      - CGO_ENABLED: 0
    override-build: |
      make build
      cp bin/script_exporter $CRAFT_PART_INSTALL/script_exporter
2

This request has been added to the queue for review by the @reviewers team.

3

Hey @sed-i

human review required due to ‘allow-installation’ constraint (bool) declaration-snap-v2_plugs_installation (etc-script-exporter, system-files)

Could you please clarify what information is expected to be in /etc/script-exporter.yaml? how is it created? what other parties / programs are expected to interact with it?

human review required due to ‘allow-installation’ constraint (bool) declaration-snap-v2_plugs_installation (proc-sys-kernel-random, system-files)

This is not the expected way to access

  - /proc/sys/kernel/random/write_wakeup_threshold
  - /proc/sys/kernel/random/read_wakeup_threshold
  - /proc/sys/kernel/random/poolsize
  - /proc/sys/kernel/random/urandom_min_reseed_secs

system-observe grants read access to all of them but read_wakeup_threshold, which is not documented in kernel docs https://docs.kernel.org/admin-guide/sysctl/kernel.html#random

4

Hey @jslarraz ,

about /etc/script-exporter.yaml: this is the configuration file for script-exporter (see the upstream README). It’s not created by the snap, but rather meant to be written by the user and read by our snap via the command-wrapper, otherwise falling back to a default configuration. Nothing else is supposed to interact with the config file.

About the other point, I’ve realized the proc-sys-kernel-random plug is likely stale code as this snap was made a while ago but not published, so I’m removing that and only leaving system-observe (carried out in #8).

Feel free to ask more questions if you have any!

5

Hey @lucabello

Thanks for the clarification. Then it sounds reasonable to me. +1 from me for granting prometheus-script-exporter read access to /etc/script-exporter.yaml via system-files interface

Thanks

6

+1 from me as well to grant read access to /etc/script-exporter.yaml using etc-script-exporter interface.

7

+2 for, 0 against granting prometheus-script-exporter read access to /etc/script-exporter.yaml via system-files interface. Publisher is vetted. This is now live!