coredns / coredns/helm

ServiceMonitor can render without its metrics Service when only prometheus.monitor.enabled is enabled

Open
#274 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Mustache
Stars
146
Forks
145
Avg merge
6d 5h
Merged PRs (30d)
2

Description

In chart `coredns-1.47.0`, I found a configuration relationship issue while independently validating the released manifests with IaC-Guard-V 0.1.0a9.

With:

```yaml
prometheus:
monitor:
enabled: true
service:
enabled: false
```

the chart renders the ServiceMonitor, but its selector has no matching Service.

The chart documentation presents `prometheus.monitor.enabled` (“create ServiceMonitor for Prometheus operator”) and `prometheus.service.enabled` (“create Service for Prometheus metrics”) as separate settings, and I could not find a documented or schema-enforced dependency between them.

As a control, setting both options to `true` renders the metrics Service and the relationship resolves successfully to TCP 9153.

Validation:

- exact chart release: `coredns-1.47.0`
- exact source: `fd5b836b84e80f6ca5be9b59b77e4d2dd3505467`
- two repeated renders for each configuration were byte-identical
- Helm lint passes
- the existing 15-suite / 24-test chart test run passes
- a minimal helm-unittest regression reproduces the missing-Service case

IaC-Guard-V 0.1.0a9 reports the rendered ServiceMonitor-to-Service relationship as `VIOLATED` for the first configuration and `SATISFIED` when both features are enabled. This claim concerns rendered Helm resources; I did not test live Prometheus or Kubernetes traffic behavior.

Reproduction/evidence:
https://github.com/lokesh0186/iac-guard-v/tree/303588d4597bb0bb55ec335356c31f1e098c5699/examples/public-reproductions/coredns-helm-1.47.0

If `prometheus.monitor.enabled` is intended to require the metrics Service, would it make sense to either:

- automatically render the metrics Service when the monitor is enabled; or
- validate/document that `prometheus.service.enabled=true` is required?

I'm happy to prepare a small regression test/fix once the intended chart behavior is confirmed.

Contributor guide

Open the contributing guide

Research direction

Start with the coredns-1.47.0 chart configuration for prometheus.monitor.enabled and prometheus.service.enabled, then reproduce the missing-Service case with the minimal helm-unittest regression. Compare it with the both-enabled case and the existing 15-suite, 24-test chart run. Confirm the intended dependency before choosing between automatic Service rendering, validation, or documentation; done means the relationship is handled consistently and the regression is covered.

Written by the indexing model from the issue text.

Assessment

Tech stack
helm
Domain
devops, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.