Remove aproxy installation and add proxy support in workload

docs/changelog.md

@@ -1,6 +1,9 @@
 
 <!-- vale Canonical.007-Headings-sentence-case = NO -->
 
+## [#185 Remove aproxy installation and add proxy support in workload](https://github.com/canonical/github-runner-image-builder-operator/pull/185) (2026-01-20)
+* Remove `aproxy` snap installation in the charm and inject proxy values from the model config into the workload process.
+
 ## [#195 feat: otel-collector snap](https://github.com/canonical/github-runner-image-builder-operator/pull/195) (2026-02-11)
 * Install opentelemetry collector snap in the runner image.
 

src/builder.py

@@ -52,7 +52,7 @@
 OPENSTACK_CLOUDS_YAML_PATH = UBUNTU_HOME / "clouds.yaml"
 
 # Bandit thinks this is a hardcoded secret
-IMAGE_BUILDER_SECRET_PREFIX = "IMAGE_BUILDER_SECRET_"  # nosec: B105
+IMAGE_BUILDER_SECRET_PREFIX = "IMAGE_BUILDER_SECRET_"  # nosec: hardcoded_password_string
 
 
 @dataclasses.dataclass
@@ -188,6 +188,7 @@ def _build_init_command(
     """
     cmd = [
         "/usr/bin/sudo",
+        "--preserve-env=http_proxy,https_proxy,no_proxy,HTTP_PROXY,HTTPS_PROXY,NO_PROXY",
         str(GITHUB_RUNNER_IMAGE_BUILDER_PATH),
         "--os-cloud",
         cloud_name,
@@ -528,6 +529,7 @@ def _run(config: RunConfig) -> list[CloudImage]:
             env={
                 "HOME": str(UBUNTU_HOME),
                 **_transform_secrets(secrets=config.image.script_config.script_secrets),
+                **{k: v for (k, v) in os.environ.items() if "proxy" in k.lower()},
             },
         )
         # The return value of the CLI is "Image build success:\n<comma-separated-image-ids>"

src/charm.py

@@ -7,6 +7,7 @@
 
 import json
 import logging
+import os
 
 # We ignore low severity security warning for importing subprocess module
 import subprocess  # nosec B404
@@ -22,7 +23,6 @@
 import builder
 import charm_utils
 import image
-import proxy
 import state
 
 LOG_FILE_DIR = Path("/var/log/github-runner-image-builder")
@@ -102,10 +102,10 @@ def _on_upgrade_charm(self, _: ops.UpgradeCharmEvent) -> None:
     def _on_config_changed(self, _: ops.ConfigChangedEvent) -> None:
         """Handle charm configuration change events."""
         builder_config_state = state.BuilderConfig.from_charm(charm=self)
+        self._setup_proxy_environment(builder_config_state.proxy)
         if not self._is_any_image_relation_ready(cloud_config=builder_config_state.cloud_config):
             return
         # The following lines should be covered by integration tests.
-        proxy.configure_aproxy(proxy=state.ProxyConfig.from_env())  # pragma: no cover
         builder.install_clouds_yaml(  # pragma: no cover
             cloud_config=builder_config_state.cloud_config.openstack_clouds_config
         )
@@ -119,6 +119,7 @@ def _on_config_changed(self, _: ops.ConfigChangedEvent) -> None:
     def _on_image_relation_changed(self, evt: ops.RelationChangedEvent) -> None:
         """Handle charm image relation changed event."""
         builder_config_state = state.BuilderConfig.from_charm(charm=self)
+        self._setup_proxy_environment(builder_config_state.proxy)
         if not evt.unit:
             logger.info("No unit in image relation changed event. Skipping image building.")
             return
@@ -132,7 +133,6 @@ def _on_image_relation_changed(self, evt: ops.RelationChangedEvent) -> None:
                 evt.unit.name,
             )
             return
-        proxy.configure_aproxy(proxy=state.ProxyConfig.from_env())
         builder.install_clouds_yaml(
             cloud_config=builder_config_state.cloud_config.openstack_clouds_config
         )
@@ -158,6 +158,7 @@ def _on_image_relation_changed(self, evt: ops.RelationChangedEvent) -> None:
     def _on_run(self, _: RunEvent) -> None:
         """Handle the run event."""
         builder_config_state = state.BuilderConfig.from_charm(charm=self)
+        self._setup_proxy_environment(builder_config_state.proxy)
         if not self._is_any_image_relation_ready(cloud_config=builder_config_state.cloud_config):
             return
         # The following line should be covered by the integration test.
@@ -171,16 +172,33 @@ def _on_run_action(self, event: ops.ActionEvent) -> None:
             event: The run action event.
         """
         builder_config_state = state.BuilderConfig.from_charm(charm=self)
+        self._setup_proxy_environment(builder_config_state.proxy)
         if not self._is_any_image_relation_ready(cloud_config=builder_config_state.cloud_config):
             event.fail("Image relation not yet ready.")
             return
         # The following line should be covered by the integration test.
         self._run()  # pragma: nocover
 
+    def _setup_proxy_environment(self, proxy_config: state.ProxyConfig | None) -> None:
+        """Set up proxy environment variables.
+
+        Args:
+            proxy_config: The proxy configuration to apply to environment variables.
+        """
+        if proxy_config:
+            os.environ["http_proxy"] = proxy_config.http
+            os.environ["https_proxy"] = proxy_config.https
+            os.environ["no_proxy"] = proxy_config.no_proxy
+            os.environ["HTTP_PROXY"] = proxy_config.http
+            os.environ["HTTPS_PROXY"] = proxy_config.https
+            os.environ["NO_PROXY"] = proxy_config.no_proxy
+
     def _setup_builder(self) -> None:
         """Set up the builder application."""
-        proxy.setup(proxy=state.ProxyConfig.from_env())
         builder_config_state = state.BuilderConfig.from_charm(charm=self)
+
+        self._setup_proxy_environment(builder_config_state.proxy)
+
         builder.initialize(
             app_init_config=builder.ApplicationInitializationConfig(
                 cloud_config=builder_config_state.cloud_config,

src/exceptions.py

@@ -24,10 +24,6 @@ class BuilderRunError(BuilderBaseError):
     """Represents an error while running the image builder."""
 
 
-class ProxyInstallError(BuilderBaseError):
-    """Represents an error while installing proxy."""
-
-
 class GetLatestImageError(BuilderBaseError):
     """Represents an error while fetching the latest image."""
 

src/state.py

@@ -30,7 +30,7 @@
 EXTERNAL_BUILD_NETWORK_CONFIG_NAME = "build-network"
 OPENSTACK_AUTH_URL_CONFIG_NAME = "openstack-auth-url"
 # Bandit thinks this is a hardcoded password
-OPENSTACK_PASSWORD_CONFIG_NAME = "openstack-password"  # nosec: B105
+OPENSTACK_PASSWORD_CONFIG_NAME = "openstack-password"  # nosec: hardcoded_password_string
 OPENSTACK_PROJECT_DOMAIN_CONFIG_NAME = "openstack-project-domain-name"
 OPENSTACK_PROJECT_CONFIG_NAME = "openstack-project-name"
 OPENSTACK_USER_DOMAIN_CONFIG_NAME = "openstack-user-domain-name"
@@ -39,8 +39,8 @@
 RUNNER_VERSION_CONFIG_NAME = "runner-version"
 SCRIPT_URL_CONFIG_NAME = "script-url"
 # Bandit thinks this is a hardcoded password
-SCRIPT_SECRET_ID_CONFIG_NAME = "script-secret-id"  # nosec: B105
-SCRIPT_SECRET_CONFIG_NAME = "script-secret"  # nosec: B105
+SCRIPT_SECRET_ID_CONFIG_NAME = "script-secret-id"  # nosec: hardcoded_password_string
+SCRIPT_SECRET_CONFIG_NAME = "script-secret"  # nosec: hardcoded_password_string
 
 IMAGE_RELATION = "image"
 

tests/integration/test_charm.py

@@ -37,6 +37,7 @@ async def test_image_relation(app: Application, test_charm: Application):
 
 
 @pytest.mark.asyncio
+@pytest.mark.abort_on_fail
 async def test_cos_agent_relation(app: Application):
     """
     arrange: An active charm.
@@ -55,6 +56,7 @@ async def test_cos_agent_relation(app: Application):
 
 
 @pytest.mark.asyncio
+@pytest.mark.abort_on_fail
 async def test_build_image(
     openstack_connection: Connection,
     dispatch_time: datetime,
@@ -70,6 +72,7 @@ async def test_build_image(
 
 # Ignore the "too many arguments" warning, as this is not significant for a test function where
 # the arguments are fixtures and the function is not expected to be called directly.
+@pytest.mark.abort_on_fail
 async def test_charm_another_app_does_not_rebuild_image(  # pylint: disable=R0913,R0917
     app: Application,
     test_charm: Application,
@@ -128,6 +131,7 @@ async def test_charm_another_app_does_not_rebuild_image(  # pylint: disable=R091
 
 
 @pytest.mark.asyncio
+@pytest.mark.abort_on_fail
 async def test_periodic_rebuilt(
     app: Application,
     app_config: dict,
@@ -179,6 +183,7 @@ async def _change_cronjob_to_minutes(unit: Unit, current_hour_interval: int):
 
 
 @pytest.mark.asyncio
+@pytest.mark.abort_on_fail
 async def test_log_rotated(app: Application):
     """
     arrange: A deployed active charm and manually write something to the log file.

tests/unit/factories.py

@@ -104,7 +104,7 @@ class CloudAuthFactory(factory.DictFactory):
 
     auth_url = "http://testing-auth/keystone"
     # We need to use known password for unit testing
-    password = "test-password"  # nosec: B105:hardcoded_password_string
+    password = "test-password"  # nosec: hardcoded_password_string
     project_domain_name = "test-project-domain"
     project_name = "test-project-name"
     user_domain_name = "test-user-domain"

tests/unit/test_builder.py

@@ -186,6 +186,7 @@ def test__initialize_image_builder_error(
             None,
             [
                 "/usr/bin/sudo",
+                "--preserve-env=http_proxy,https_proxy,no_proxy,HTTP_PROXY,HTTPS_PROXY,NO_PROXY",
                 "/home/ubuntu/.local/bin/github-runner-image-builder",
                 "--os-cloud",
                 "test-cloud-name",
@@ -199,6 +200,7 @@ def test__initialize_image_builder_error(
             "test-prefix",
             [
                 "/usr/bin/sudo",
+                "--preserve-env=http_proxy,https_proxy,no_proxy,HTTP_PROXY,HTTPS_PROXY,NO_PROXY",
                 "/home/ubuntu/.local/bin/github-runner-image-builder",
                 "--os-cloud",
                 "test-cloud-name",