rancher / prometheus-federator

Apache License 2.0
9 stars 21 forks source link

Ensure that setting global.cattle.psp.enabled=false does not deploy PSP for hardened.yaml Job #55

Closed aiyengar2 closed 1 year ago

aiyengar2 commented 1 year ago

Ran helm template rancher-project-monitoring -n cattle-project-monitoring-system charts/rancher-project-monitoring/0.2.1 | yq e 'select(.kind == "PodSecurityPolicy")' after fixing this and no PSP resources were produced.

Root cause was because the hardened.yaml was being tracked at templates/hardened.yaml as an overlay rather than being tracked in templates/rancher-monitoring/hardened.yaml as a patch on where the upstream rancher-monitoring chart places this logic.

Related Issue: https://github.com/rancher/rancher/issues/40350

Checklist

Please fill out this table to identify which fields need to be modified in your PR.

Under Status, either indicate Does Not Apply or Added to this PR.

Version to be incremented Why should this be modified? Status
version in rancher-project-monitoring package.yaml You modified the contents of the rancher-project-monitoring chart to make changes done
helmProjectOperator.image.tag in prometheus-federator values.yaml Either you modified the rancher-project-monitoring chart or you modified the main.go file done
appVersion in prometheus-federator Chart.yaml You modified the helmProjectOperator.image.tag in the above box done
version in prometheus-federator Chart.yaml Either you modified the appVersion in the above box or you modified the contents of the prometheus-federator chart to make changes done
aiyengar2 commented 1 year ago

CI failures have been addressed. The issue caught by CI was that when global.cattle.psp.enabled was set to false, we were also excluding the default NetworkPolicy deployed onto the namespace, which prevented Grafana (or any component that needed to query the API server) from being able to start up.