[PRA-256] Set driver metrics sink to JmxSink for shell entrypoints (#159) (#161)

* fix: Use JmxSink to avoid crashes in shells with COS

* fix: Remove unneeded openjdk build package (already in stage)

* ci: Update jira sync configuration

* ci: Harden CI with 'contents: read' default permissions

* ci: Remove duplicated permission in release.yaml

Author: Batalex

.github/.jira_sync_config.yaml

@@ -13,5 +13,5 @@ settings:
     closed: done # GitHub issue closed as completed
     not_planned: rejected # GitHub issue closed as not planned
   add_gh_comment: true
-  sync_description: false
-  sync_comments: false
+  sync_description: true
+  sync_comments: true

.github/workflows/ci.yaml

@@ -1,16 +1,22 @@
 name: Build snap and run tests
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 on:
-  workflow_call:
-    outputs:
-      snap-file:
-        description: "The snap output of build process."
-        value: ${{ jobs.build.outputs.snap-file }}
+  pull_request:
+
+permissions:
+  contents: read
 
 jobs:
   build:
     name: Build snap
     uses: canonical/data-platform-workflows/.github/workflows/build_snap.yaml@v48.0.2
+    permissions:
+      actions: read
+      contents: read
 
   test:
     name: "Tests (arch: ${{ matrix.system.arch }}, k8s: ${{ matrix.k8s_version }})"

.github/workflows/on_pull_request.yaml

@@ -7,6 +7,9 @@ on:
       - 3.5/*
       - 4.0/*
 
+permissions:
+  contents: read
+
 jobs:
   release_checks:
     runs-on: ubuntu-22.04
@@ -40,6 +43,9 @@ jobs:
   build:
     name: Build snap
     uses: canonical/data-platform-workflows/.github/workflows/build_snap.yaml@v48.0.2
+    permissions:
+      actions: read
+      contents: read
 
   release:
     name: Release snap
@@ -53,5 +59,5 @@ jobs:
     secrets:
       snap-store-token: ${{ secrets.SNAP_STORE_TOKEN }}
     permissions:
-      actions: read  # Needed for GitHub API call to get workflow version
+      actions: read
       contents: write # Needed to create GitHub release

.github/workflows/release.yaml

@@ -57,7 +57,10 @@ apps:
   spark-shell:
     command: etc/spark8t/launcher.sh $SNAP/bin/spark-shell $SPARK8T_EXTRA_CONF
     environment:
-      SPARK8T_EXTRA_CONF: --conf spark.driver.extraJavaOptions="-Duser.home=$SNAP_USER_DATA" --conf spark.jars.ivy=/tmp
+      SPARK8T_EXTRA_CONF: |
+        --conf spark.driver.extraJavaOptions="-Duser.home=$SNAP_USER_DATA" \
+        --conf spark.jars.ivy=/tmp \
+        --conf spark.metrics.conf.driver.sink.prometheus.class=org.apache.spark.metrics.sink.JmxSink
       _JAVA_OPTIONS: "-Duser.home=$SNAP_USER_DATA -Djavax.net.ssl.trustStore=$SNAP_DATA/etc/ssl/certs/java/cacerts -Djavax.net.ssl.trustStorePassword=changeit"
     plugs:
       - network
@@ -67,7 +70,10 @@ apps:
   pyspark:
     command: etc/spark8t/launcher.sh $SNAP/bin/pyspark $SPARK8T_EXTRA_CONF
     environment:
-      SPARK8T_EXTRA_CONF: --conf spark.driver.extraJavaOptions="-Duser.home=$SNAP_USER_DATA" --conf spark.jars.ivy=/tmp
+      SPARK8T_EXTRA_CONF: |
+        --conf spark.driver.extraJavaOptions="-Duser.home=$SNAP_USER_DATA" \
+        --conf spark.jars.ivy=/tmp \
+        --conf spark.metrics.conf.driver.sink.prometheus.class=org.apache.spark.metrics.sink.JmxSink
       _JAVA_OPTIONS: "-Duser.home=$SNAP_USER_DATA -Djavax.net.ssl.trustStore=$SNAP_DATA/etc/ssl/certs/java/cacerts -Djavax.net.ssl.trustStorePassword=changeit"
     plugs:
       - network
@@ -77,7 +83,10 @@ apps:
   spark-sql:
     command: etc/spark8t/launcher.sh $SNAP/bin/spark-sql $SPARK8T_EXTRA_CONF
     environment:
-      SPARK8T_EXTRA_CONF: --conf spark.driver.extraJavaOptions="-Duser.home=$SNAP_USER_DATA" --conf spark.jars.ivy=/tmp
+      SPARK8T_EXTRA_CONF: |
+        --conf spark.driver.extraJavaOptions="-Duser.home=$SNAP_USER_DATA" \
+        --conf spark.jars.ivy=/tmp \
+        --conf spark.metrics.conf.driver.sink.prometheus.class=org.apache.spark.metrics.sink.JmxSink
       _JAVA_OPTIONS: "-Duser.home=$SNAP_USER_DATA -Djavax.net.ssl.trustStore=$SNAP_DATA/etc/ssl/certs/java/cacerts -Djavax.net.ssl.trustStorePassword=changeit"
     plugs:
       - network
@@ -121,7 +130,6 @@ parts:
     build-packages:
       - ca-certificates
       - ca-certificates-java
-      - openjdk-17-jre-headless
       - wget
     stage-packages:
       - openjdk-17-jre-headless