alertmanager-github-receiver
alertmanager-github-receiver copied to clipboard
Detect permission problems
According to https://developer.github.com/v3/issues/#create-an-issue:
Only users with push access can set labels for new issues. Labels are silently dropped otherwise.
Scenario:
-
alertmanager-github-receiveris running as a user without permission to push to a repo. - An alert is generated, and the program creates an issue. It tries to add labels to the issue, but no labels are added.
- Alertmanager periodically resends the alert. The next time
alertmanager-github-receiverreceives it, it checks to see if the issue already exists. It searches based on labels first, so it doesn't find the existing issue. -
alertmanager-github-receivercreates a duplicate issue. - It does so again every time alertmanager resends the alert.
It seems like there are a few things we should/could do:
- Warn users that they need to have
pushpermissions for the service account. - Detect insufficient permissions and warn the user.
- Refuse to create duplicate issues.
re: 1) https://github.com/m-lab/alertmanager-github-receiver#create-github-access-token outlines what permissions are needed for the access token. Unfortunately, "push" is not mentioned on the token allocation page. A note in our readme that points to the link you put here would be welcome.
re: 2) yes, if the client doesn't have sufficient permissions it should not create any issues. That addresses 3) also.