ServiceMonitor can render without its metrics Service when only prometheus.monitor.enabled is enabled
- Dominant language
- Mustache
- Stars
- 146
- Forks
- 145
- Avg merge
- 6d 5h
- Merged PRs (30d)
- 2
Description
In chart `coredns-1.47.0`, I found a configuration relationship issue while independently validating the released manifests with IaC-Guard-V 0.1.0a9.
With:
```yaml
prometheus:
monitor:
enabled: true
service:
enabled: false
```
the chart renders the ServiceMonitor, but its selector has no matching Service.
The chart documentation presents `prometheus.monitor.enabled` (“create ServiceMonitor for Prometheus operator”) and `prometheus.service.enabled` (“create Service for Prometheus metrics”) as separate settings, and I could not find a documented or schema-enforced dependency between them.
As a control, setting both options to `true` renders the metrics Service and the relationship resolves successfully to TCP 9153.
Validation:
- exact chart release: `coredns-1.47.0`
- exact source: `fd5b836b84e80f6ca5be9b59b77e4d2dd3505467`
- two repeated renders for each configuration were byte-identical
- Helm lint passes
- the existing 15-suite / 24-test chart test run passes
- a minimal helm-unittest regression reproduces the missing-Service case
IaC-Guard-V 0.1.0a9 reports the rendered ServiceMonitor-to-Service relationship as `VIOLATED` for the first configuration and `SATISFIED` when both features are enabled. This claim concerns rendered Helm resources; I did not test live Prometheus or Kubernetes traffic behavior.
Reproduction/evidence:
https://github.com/lokesh0186/iac-guard-v/tree/303588d4597bb0bb55ec335356c31f1e098c5699/examples/public-reproductions/coredns-helm-1.47.0
If `prometheus.monitor.enabled` is intended to require the metrics Service, would it make sense to either:
- automatically render the metrics Service when the monitor is enabled; or
- validate/document that `prometheus.service.enabled=true` is required?
I'm happy to prepare a small regression test/fix once the intended chart behavior is confirmed.
Contributor guide
Research direction
Start with the coredns-1.47.0 chart configuration for prometheus.monitor.enabled and prometheus.service.enabled, then reproduce the missing-Service case with the minimal helm-unittest regression. Compare it with the both-enabled case and the existing 15-suite, 24-test chart run. Confirm the intended dependency before choosing between automatic Service rendering, validation, or documentation; done means the relationship is handled consistently and the regression is covered.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- helm
- Domain
- devops, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100