Comments (9)
Okay, I will try to reproduce and fix it.
from policy-reporter.
You are welcome, if the issue still exist it would be great if you can provide an example metric item that exists after the resource is removed.
The Helm Chart is up to date, I mean Policy reporter Helm Chart v2.6.0 I think Policy Reporter is on 2.3.0. Sorry for the confusion.
from policy-reporter.
I found the possible reason for your issue in the debouncer logic. I released v2.6.3 of the Helm Chart with a new version of Policy Reporter (v2.3.2) which should fix the issue. I hope this solves your problem. Please let me know if it still not work as expected.
from policy-reporter.
Hey, thanks for reporting. You face this issue in the UI, Metrics or in which situation? I will have a look if some remove logic does not work as expected.
Do you have some basic steps and policy (if its a custom one) to reproduce this issue?
from policy-reporter.
Hey, thx for the quick response. We collect metrics with Prometheus and visualize in Grafana (there I saw old records). We do not use Policy Reporter UI.
In terms of steps, we did not change the policy, only workload. After changing the workload, pass was registered and old Pods (that were terminated) were still showing as failing in Policy Reporter even though those Pods were replaced by new ones (did not exist in cluster).
from policy-reporter.
Okay, thanks. So the issue relates to the metrics provided by policy reporter? I will investigate into this issue.
One Thing, did I understand correctly that your policy validates on Pod level and not against a deployment / deamonset or something similar? Just in case that it matter.
from policy-reporter.
issue relates to the metrics provided by policy reporter
It seems since restart of the Policy Reporter helps.
policy validates on Pod level and not against a deployment / deamonset or something similar
I do not remember correctly, but I'm sure those were Pods as leftovers. Not sure if there were resources like Deployment passing and being removed from failing state. Sorry, can not confirm and it's best I can do at this point.
from policy-reporter.
I tried to reproduce it but it worked as expected. How so you encounter the issue? So the deleted resource is still visible in a Graph / Table or something similar in Grafana or do you see an item of the deleted resource in the metrics endpoint?
What I did to reproduce:
Installed Policy Reporter 2.6.0 and Kyverno 1.6.0
Start a simple nginx:
apiVersion: v1
kind: Pod
metadata:
labels:
run: test
name: test
spec:
containers:
- image: nginx:alpine
name: test
resources: {}
status: {}
Which failed PSP disallow-capabilities-strict
and get an item in the metrics:
policy_report_result{category="Pod Security Standards (Restricted)",kind="Deployment",name="test",namespace="policy-reporter",policy="disallow-capabilities-strict",report="polr-ns-policy-reporter",rule="autogen-require-drop-all",severity="medium",status="fail"} 1
I fixed it with
apiVersion: v1
kind: Pod
metadata:
labels:
run: test
name: test
spec:
containers:
- image: nginx:alpine
name: test
resources: {}
securityContext:
capabilities:
drop:
- "ALL"
It removed the old item and replaced it with:
policy_report_result{category="Pod Security Standards (Restricted)",kind="Pod",name="test",namespace="policy-reporter",policy="disallow-capabilities-strict",report="polr-ns-policy-reporter",rule="require-drop-all",severity="medium",status="fail"} 1
I tried the same with a Deployment and had the same result.
from policy-reporter.
We're on Policy Reporter 2.1.0
. So based on your report we'll plan the move to 2.6.0
. If there will be any further issues we'll reopen the issue. Feel free to close and thank you for quick response :)
Edit: Looking forward to updated Helm chart to use newest Policy Reporter version.
from policy-reporter.
Related Issues (20)
- Problem with sending messages to Telegram HOT 2
- [UI] Standalone UI HOT 56
- Add ability to set request headers in Loki target HOT 2
- Download report html via api HOT 6
- Policy Reporter no longer working after kyverno 1.11.0 upgrade HOT 2
- Cant work with Workload Identity HOT 15
- Splunk as a target HOT 1
- [DOCS] The external-cluster section needs to mention that rest.enabled: true is required HOT 1
- Policy Reporter Targets as CRDs HOT 4
- Include the timestamp HOT 7
- Policy Reporter not aligned with Kyverno HOT 5
- Helm chart won't start due to "Error: unknown flag: --template-dir" HOT 2
- Kyverno Policy Reporter writes extensively on node disk storage in certain ocassions. HOT 2
- strange S3 config error when using SecurityHub as target HOT 3
- Helm: Ingress template has wrong selection for pathType
- Allow for not rendering a Kubernetes Secret HOT 2
- policy-reporter presents incomplete results HOT 7
- Slack Channel Override does not work HOT 4
- Support for new reports.x-k8s.io reports group
- Support for multicluster HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from policy-reporter.