testsuite icon indicating copy to clipboard operation
testsuite copied to clipboard

[BUG] OPA Gatekeeper helm install takes 5min to complete (versioned_tag test)

Open HashNuke opened this issue 3 years ago • 3 comments

Describe the bug

  • The versioned_tag test requires OPA Gatekeeper to be installed. This is installed via the install_opa task as a dependency.
  • The helm install takes about 5min to complete. Upon using the debug flag for the helm install, it is visible that one of the jobs times out.

Further checks revealed that

  • The gatekeeper-update-namespace-label job has an error trying to access a service account that does not exist.
  • The service account that the job is trying to access is gatekeeper-update-namespace.

To Reproduce

  • Run versioned_tag test after installing a CNF.
  • OR directly run the helm command used to install gatekeeper: helm install --set auditInterval=1 opa-gatekeeper gatekeeper/gatekeeper --debug

Expected behavior The gatekeeper install should be faster.

HashNuke avatar Jul 26 '22 04:07 HashNuke

Added issue notes to hackmd doc.

We have two ways to resolve this:

  1. Pass the flag to helm install to disable the gatekeeper-namespace-label-update job.
  2. Send a PR to the gatekeeper helm chart repo to update the order of specs in the namespace-post-install.yml file.

More details are on the hackmd doc.

HashNuke avatar Jul 26 '22 04:07 HashNuke

Acceptance Criteria

  • [x] When installing OPA gatekeeper, it should not take more than 5 minutes to install.
  • [x] Run install_opa and time it using the time command.
  • [x] I can see that the install takes less than 5 minutes.
  • [x] I can see a screenshot of the results here.

agentpoyo avatar Aug 02 '22 19:08 agentpoyo

1582_opa_time

agentpoyo avatar Aug 02 '22 19:08 agentpoyo