grafana / mimir

Grafana Mimir provides horizontally scalable, highly available, multi-tenant, long-term storage for Prometheus.
https://grafana.com/oss/mimir/
GNU Affero General Public License v3.0
3.98k stars 503 forks source link

Unable to deploy helm-chart mimir-distributed with ArgoCD when setting any of `rbac.podSecurityContext` to `null` #8059

Open bo0ts opened 4 months ago

bo0ts commented 4 months ago

Describe the bug

We configure rbac for mimir-distributed like this and deploy the chart through argocd.

rbac:
  create: true
  type: scc
  podSecurityContext:
    fsGroup: null
    runAsGroup: null
    runAsUser: null

and end up with the following error when the manifests are rendered by ArgoCD:

Failed to load target state: failed to generate manifest for source 1 of 1: rpc error: code = Unknown desc = Manifest generation error (cached): `helm template . --name-template mimir --namespace grafana --kube-version 1.27 --values <path to cached source>/grafana-mimir/values.yaml <api versions removed> --include-crds` failed exit status 1: Error: execution error at (mimir/charts/mimir-distributed/templates/validate.yaml:251:4): You have selected rbac.type=scc, you must set the values fsGroup, runAsGroup, runAsUser to null in rbac.podSecurityContext Use --debug flag to render out invalid YAML

This is caused by https://github.com/argoproj/argo-cd/issues/15566 and is clearly an issue on the side of ArgoCD.

Could the mimir-distributed helm chart be extended with a switch to disable validation to work around this issue?

To Reproduce

  1. Try to deploy the helm chart mimir-distributed with argocd using the above settings
  2. See the error in argocd.

Environment

bo0ts commented 2 months ago

This is still an issue with the mimir-distributed chart 5.3.0 and ArgoCD 2.10.11.