proxy config is rendered to /lib/systemd/system/docker.service which breaks non-interactive apt upgrades

[Wouter van Bommel]

If the kubernetes-worker charm is deployed behind a corporate firewall that only allows access via http(s) proxy's. This has to be configured in the model.

If these settings change, then the systemd file for docker (/lib/systemd/system/docker.service) seems to be updated by inserting 3 lines:

Environment="HTTP_PROXY=http://<dummy>:<dummy>"
Environment="HTTPS_PROXY=http://<dummy>:<dummy>"
Environment="NO_PROXY="

But the service is not restarted.

What is expected is that a file would have been created in /etc/systemd/system/docker.service.d with content like shown below, and called e.d. proxy.conf:

[Service]
Environment="HTTP_PROXY=http://<dummy>:<dummy>"
Environment="HTTPS_PROXY=http://<dummy>:<dummy>"
Environment="NO_PROXY="

Obviously the service also needs to restart if this is changed

The current approach (modifying the file under /lib/systemd) has as problem that it will block any non interactive upgrade, as a file is changed that is part of the original package.

[George Kraft (cynerva)]

Docker is now installed by the docker subordinate charm, which appears to correctly restart the service after re-rendering the systemd file[1].

> The current approach (modifying the file under /lib/systemd) has as problem that it will block any non interactive upgrade, as a file is changed that is part of the original package.

Makes sense. I'll leave this issue open so we can address that at least.

[1]: https://github.com/charmed-kubernetes/charm-docker/blob/5caed3afbe55e11779209e0bc517dbf217c3daaa/reactive/docker.py#L206-L211

[Joseph Borg (joeborg)]

Hey Wouter,

Looking at this, I've tried overloading the systemd unit file rather than replacing it. This works, however it seems upstream no longer include $DOCKER_OPTS by default, which we rely on. Obviously, adding this back in gets us back to square 1.

How are you peeps enabling unattended upgrades? Is it a charm or are you just setting it on all the hosts via juju run / ssh?

Cheers,
Joe

[Joseph Borg (joeborg)]

https://github.com/charmed-kubernetes/charm-docker/pull/17

[Joseph Borg (joeborg)]

Got overloaded / drop-in files to work for ExecStart too.