Comments (8)
- please provide Helm chart values for reproducing.
- what exactly does it mean, what exactly you're doing, plz give as much details as possible.
When trying to do a rollout restart of a deployment or daemonset
from kube-mgmt.
Hi We dont use helm for deploying this.
With kube-mgmt 8.5.1 and above we were doing some initial testing, the test was to do a rollout restart of a deployment or a daemonset, when we did this it fails with the generic error message
error: failed to patch: Internal error occurred: failed calling webhook "validating-webhook.openpolicyagent.org": failed to call webhook: the server could not find the requested resource
On review of the opa logs, in the opa container we see this error
error":{"code":"undefined_document","message":"document missing: data.system.main"}
in the kube-mgmt logs everything looks ok.
○ → kl opa-xxxxxxx kube-mgmt
time="2024-01-11T10:58:42Z" level=info msg="Policy/data ConfigMap processor connected to K8s: namespaces=[]"
time="2024-01-11T10:58:42Z" level=info msg="Initial informer sync for v1/namespaces completed, took 120.267923ms"
time="2024-01-11T10:58:42Z" level=info msg="Initial informer sync for traefik.containo.us/v1alpha1/ingressroutes completed, took 120.317211ms"
time="2024-01-11T10:58:42Z" level=info msg="Syncing traefik.containo.us/v1alpha1/ingressroutes."
time="2024-01-11T10:58:42Z" level=info msg="Initial informer sync for networking.k8s.io/v1/networkpolicies completed, took 120.47374ms"
time="2024-01-11T10:58:42Z" level=info msg="Initial informer sync for networking.k8s.io/v1/ingresses completed, took 120.236117ms"
time="2024-01-11T10:58:42Z" level=info msg="Syncing networking.k8s.io/v1/ingresses."
time="2024-01-11T10:58:42Z" level=info msg="Syncing networking.k8s.io/v1/networkpolicies."
time="2024-01-11T10:58:42Z" level=info msg="Syncing v1/namespaces."
time="2024-01-11T10:58:42Z" level=info msg="Loaded 0 resources of kind networking.k8s.io/v1/ingresses into OPA. Took 9.081604ms"
time="2024-01-11T10:58:42Z" level=info msg="Loaded 16 resources of kind traefik.containo.us/v1alpha1/ingressroutes into OPA. Took 9.228135ms"
time="2024-01-11T10:58:42Z" level=info msg="Loaded 39 resources of kind v1/namespaces into OPA. Took 12.220325ms"
time="2024-01-11T10:58:42Z" level=info msg="Loaded 225 resources of kind networking.k8s.io/v1/networkpolicies into OPA. Took 26.521374ms"
If we switch to use the image kube-mgmt:8.5.0 everything is working as expected
from kube-mgmt.
Hello
Unfortunately, I would be able to provide some help if you used kube-mgtm
Helm chart, so the issue can be easy reproducible.
From OPA logs I see no errors os any suspicious things.
Although, I still don't understand what you're doing with rollout restart
of deployments/deamonset and how it's related to OPA :(
So maybe I miss the thing.
from kube-mgmt.
The rollout restart is for ensuring the config maps which we use for our OPA rules get loaded into kube-management
from kube-mgmt.
The rollout restart is for ensuring the config maps which we use for our OPA rules get loaded into kube-management
How exactly rollout restart
should help ConfigMap
loading to kube-mgmt
?
kube-mgmt
watches ConfigMap
itself and loads their content into internal OPA container when ConfigMap
changes.
from kube-mgmt.
Wondering is this the change, which may be causing the issue?
our config maps are loaded into opa namespace, and this now removes the default opa to an empty string
from kube-mgmt.
Yup this difference was the reason for the failure, we have now been able to resolve this.
Do you suggest for support reasons we switch to helm?
from kube-mgmt.
Yup this difference was the reason for the failure, we have now been able to resolve this.
Do you suggest for support reasons we switch to helm?
This project is community driven it has no official support as far as I know.
And I am currenly only one active maintainer, so I personally will only be able to help when kube-mgmt
chat is used.
I just don't have capacity to investigate custom installations.
That's it :)
from kube-mgmt.
Related Issues (20)
- When OPA container restarted kube-mgmt is not re-syncing the policies HOT 2
- opa-kube-mgmt Helm Chart config can't use existing Cert-Manager Issuer or an existing Secret created from Cert-Manager HOT 4
- CVE Vulnerabilities HOT 1
- Add startup probe to kube-mgmt container HOT 12
- Add liveness probe to kube-mgmt container HOT 5
- Do not use ClusterRole and ClusterRoleBinding when .Values.mgmt.namespaces list is empty
- Pre populate data in opa container on startup. HOT 8
- {"code":"undefined_document","message":"document missing: data.system.main"} HOT 4
- OPA, Kubernetes role/rolebinding and strimzi HOT 2
- Breaking change on 6.0.0 or greater HOT 4
- Fix CVEs for golang.org/x/net CVE-2023-39325, CVE-2023-3978, CVE-2023-44487 HOT 2
- High Severity Vulnerability Found in Snyk Scan in v8.5.4 or below HOT 1
- Kube-mgmt syncing issue with ConfigMap kube-root-ca.crt and unexpected logs HOT 4
- Alpine 3.16 is running out of support by May 2023 HOT 1
- Bug: extraVolumes not working if bootstrapPolicies is not enabled HOT 4
- High Vulnerability Found in version `8.5.7` with Snyk scan for the latest image of kube-mgmt
- help to build kube-mgmt locally. HOT 5
- Not possible to add extra container ports HOT 3
- High Risk Vulnerability found in 8.5.7 image HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from kube-mgmt.