prometheus blackbox_exporter missing new_raw capability

[Jack Heskett]

The ICMP module in blackbox prometheus exporter does not work as expected - ICMP probes return probe_success 0 metric despite responding to ping from the host.

As per https://github.com/prometheus/blackbox_exporter#permissions, the Prometheus blackbox_exporter requires net_raw capability +effective and +permitted to create a socket for the ICMP probe. To resolve, the documentation suggests running "setcap cap_net_raw+ep blackbox_exporter".

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/677156

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/677156
Committed: https://git.openstack.org/cgit/openstack/kolla/commit/?id=b5a4478b0fa9b775a9b5c45545e78e9215a50588
Submitter: Zuul
Branch: master

commit b5a4478b0fa9b775a9b5c45545e78e9215a50588
Author: Scott Solkhon <email address hidden>
Date: Fri Aug 16 16:10:33 2019 +0000

    Add effective and permitted capability to blackbox exporter

    The ICMP probe in the Prometheus blackbox exporter requires
    elevated privileges to function. Linux root user or CAP_NET_RAW
    capability is required. Can be set by executing setcap
    cap_net_raw+ep blackbox_exporter. This change also bumps the version
    of the blackbox exporter to the next minor version to allow for this
    support.

    '+ep' means we're adding the capability as effective and permitted.

    See: https://github.com/prometheus/blackbox_exporter

    Change-Id: I1c3b817712ae10edd45de01382b044af2fb728bd
    Closes-Bug: #1840631
    Co-authored-by: Jack Heskett <email address hidden>

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/stein
Review: https://review.opendev.org/692988

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/kolla 9.0.0.0rc1 release candidate.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/692988
Committed: https://git.openstack.org/cgit/openstack/kolla/commit/?id=8e712fadd3d7e12163455a74a8076791d925de11
Submitter: Zuul
Branch: stable/stein

commit 8e712fadd3d7e12163455a74a8076791d925de11
Author: Scott Solkhon <email address hidden>
Date: Fri Aug 16 16:10:33 2019 +0000

    Add effective and permitted capability to blackbox exporter

    The ICMP probe in the Prometheus blackbox exporter requires
    elevated privileges to function. Linux root user or CAP_NET_RAW
    capability is required. Can be set by executing setcap
    cap_net_raw+ep blackbox_exporter. This change also bumps the version
    of the blackbox exporter to the next minor version to allow for this
    support.

    '+ep' means we're adding the capability as effective and permitted.

    See: https://github.com/prometheus/blackbox_exporter

    Change-Id: I1c3b817712ae10edd45de01382b044af2fb728bd
    Closes-Bug: #1840631
    Co-authored-by: Jack Heskett <email address hidden>
    (cherry picked from commit b5a4478b0fa9b775a9b5c45545e78e9215a50588)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/kolla 8.0.2 release.