redis-ha haproxy network policy not created

[j4nvkvc]

Describe the bug

When redis-ha and the networkPolicy are enabled, the Redis HAProxy network policy is not created. This causes 2 problems:

1. argocd-server cannot reach Redis through argocd-redis-ha-haproxy, as seen in the argocd-server logs:

time="2024-02-19T10:40:52+01:00" level=warning msg="Failed to resync revoked tokens. retrying again in 1 minute: dial tcp 10.233.32.40:6379: i/o timeout"
This makes the cluster appear unsynchronized in the ArgoCD GUI under Settings > Clusters.

2. Prometheus cannot reach HAProxy since HAProxy pods are labeled app=redis-ha-haproxy and the servicemonitor is labeled app=redis-ha.

I tried to find a solution to make it work with the chart, but it seems impossible since the redis chart hardcodes the label with "-haproxy" for this netpol.

Related helm chart

argo-cd

Helm chart version

5.52.2

To Reproduce

enable redis-ha and the keys

networkPolicy:
    create: true

for components and defaultDenyIngress: true in global

Expected behavior

etheir the chart create an additionnal networkpolicy for haproxy or harmonize (if possible) labels for the redis-ha when enabled

Screenshots

No response

Additional context

to workaround the additionnal netpol to create to make it work :

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  annotations:
    meta.helm.sh/release-name: argocd
    meta.helm.sh/release-namespace: argocd
  labels:
    app: redis-ha-haproxy
    app.kubernetes.io/managed-by: Helm
    chart: redis-ha-4.23.0
    heritage: Helm
    release: argocd
  name: argocd-redis-ha-haproxy-network-policy
  namespace: argocd
spec:
  egress:
  - ports:
    - port: 6379
      protocol: TCP
    - port: 26379
      protocol: TCP
    to:
    - podSelector:
        matchLabels:
          app: redis-ha
          release: argocd
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app.kubernetes.io/component: server
          app.kubernetes.io/instance: argocd
    ports:
    - port: 6379
      protocol: TCP
  podSelector:
  - from:
    - namespaceSelector:
        matchLabels:
          app.kubernetes.io/name: prometheus
      podSelector:
        matchLabels:
          prometheus: <ANYMATCHINGLABEL>
    ports:
    - port: 9101
      protocol: TCP
    - port: 9101
      protocol: UDP
    matchLabels:
      app: redis-ha-haproxy
      release: argocd
  policyTypes:
  - Ingress
  - Egress

[oscrx]

This might relate to argoproj/argo-cd#11388

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.