UNCLASSIFIED - NO CUI

Skip to content

grafana persistence should use ironbank image for init

Enabling persistence for Grafana adds an init container which attempts to use busybox:1.31.1 (not an Ironbank image). This conflicts with the allowedDockerRegistries configured in Gatekeeper by default. I recommend we update the Grafana chart values to use an Ironbank approved image.

Relevant links:

Bigbang values to enable Grafana persistence:

monitoring:
  values:
    grafana:
      persistence:
        enabled: true

Enabling persistence resulted in the following error:

7m26s       Warning   FailedCreate           replicaset/monitoring-monitoring-grafana-58c9d65468              Error creating: admission webhook "validation.gatekeeper.sh" denied the request: [allowed-docker-registries] container <init-chown-data> has an invalid repository for  image  <busybox:1.31.1>, allowed repos are ["registry1.dso.mil", "registry.dso.mil"]

Values which resolved the issue:

monitoring:
  values:
    grafana:
      persistence:
        enabled: true
      initChownData:
        image:
          repository: registry1.dso.mil/ironbank/redhat/ubi/ubi8-minimal
          tag: "8.5"

There may be a more appropriate image to use in place of ubi8-minimal - I just grabbed the first one I thought would work.