From a0fa2349f3f5c5538388e15b85b062de7fe9f250 Mon Sep 17 00:00:00 2001 From: venkatamutyala Date: Fri, 18 Sep 2026 14:02:55 +0000 Subject: [PATCH] fix: disable argo-helm 10.x default NetworkPolicies argo-helm chart 10.0.0 flipped global.networkPolicy.create from false to true. Each generated policy sets policyTypes: [Ingress], making the pod default-deny, and the metrics allow-rules use an empty namespaceSelector with the port named rather than numbered. On a live GlueOps cluster those rules do not take effect: kube-prometheus-stack lost the application-controller, repo-server, applicationset and notifications scrape targets (7 down). Removing the policies recovered all 7 with no pod restart, confirming the policies were the cause. Chart 9.3.7 defaulted to false, so this preserves the behaviour existing clusters already run instead of bundling a default-deny change into the 3.2.12 -> 3.4.9 upgrade. Re-enabling should be a separate change with a supplemental allow-policy for the metrics ports by number. Co-Authored-By: Claude Opus 5 (1M context) --- argocd.yaml.tpl | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/argocd.yaml.tpl b/argocd.yaml.tpl index 0f4bbad..948bde1 100644 --- a/argocd.yaml.tpl +++ b/argocd.yaml.tpl @@ -9,8 +9,26 @@ notifications: # @ignored global: domain: "argocd.placeholder_cluster_environment.placeholder_tenant_key.placeholder_glueops_root_domain" + # Kept off deliberately. argo-helm chart 10.0.0 flipped this default from false to + # true (changelog: "Enable network policies for all components by default"), which + # adds a NetworkPolicy per component. Each one sets policyTypes: [Ingress], so it + # flips that pod to default-deny and only re-opens what it lists — and the metrics + # rules are written as `from: [{namespaceSelector: {}}]` with the port referenced by + # NAME. On a GlueOps cluster those rules do not take effect, so kube-prometheus-stack + # loses the application-controller (8082), repo-server (8084), applicationset (8080) + # and notifications (9001) scrape targets: verified on a live cluster, 7 targets down, + # and all 7 recovered the moment these policies were removed with no pod restart. + # Losing them means no alerting on sync failures or controller health. + # + # Chart 9.3.7 (the version before this one) defaulted to false, so this restores the + # behaviour every existing cluster already runs rather than changing it. Re-enabling + # is worth doing as its own change: repo-server's rule is the one with real value + # (it restricts port 8081 - which holds repo credentials and executes rendering - to + # the four argo-cd components), so the shape to aim for is create: true plus a + # supplemental allow-policy for the metrics ports BY NUMBER, with scrape targets + # verified before rollout. networkPolicy: - create: true + create: false image: repository: "quay.repo.gpkg.io/argoproj/argocd" tag: "placeholder_argocd_app_version"