aaron/infra-core
1
0
Fork 2
Code Issues Pull requests 12 Projects Releases 1 Packages Wiki Activity Actions

HOMELAB-437: disable bundled node-exporter (PodSecurity baseline blocks it) #79

Merged
aaron merged 1 commit from plane/HOMELAB-437-disable-node-exporter into live 2026-03-26 21:11:03 +00:00
Conversation 0 Commits 1 Files changed 1 +3
aaron commented 2026-03-26 21:10:56 +00:00
Owner
Copy link

Summary

Disables the bundled prometheus-node-exporter in the Temporal Helm chart.

Problem: temporal namespace has PodSecurity baseline:latest which blocks node-exporter DaemonSet pods (requires hostNetwork, hostPID, hostPath, hostPort). DaemonSet stuck at 0/3, causing ArgoCD app health to show Progressing.

Fix: prometheus.prometheus-node-exporter.enabled: false

Why not namespace relabeling to privileged? Relaxing PodSecurity is a worse trade-off than removing a redundant exporter. kube-prometheus-stack already deploys node-exporter cluster-wide.

Note: prometheus.nodeExporter.enabled (temporal chart wrapper) is NOT wired to the sub-chart — correct key is prometheus.prometheus-node-exporter.enabled.

## Summary Disables the bundled `prometheus-node-exporter` in the Temporal Helm chart. **Problem:** `temporal` namespace has PodSecurity `baseline:latest` which blocks node-exporter DaemonSet pods (requires hostNetwork, hostPID, hostPath, hostPort). DaemonSet stuck at 0/3, causing ArgoCD app health to show Progressing. **Fix:** `prometheus.prometheus-node-exporter.enabled: false` **Why not namespace relabeling to privileged?** Relaxing PodSecurity is a worse trade-off than removing a redundant exporter. kube-prometheus-stack already deploys node-exporter cluster-wide. **Note:** `prometheus.nodeExporter.enabled` (temporal chart wrapper) is NOT wired to the sub-chart — correct key is `prometheus.prometheus-node-exporter.enabled`.
HOMELAB-437: disable bundled node-exporter in temporal chart
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
4a7a75eb0b 
temporal namespace uses PodSecurity baseline:latest which blocks node-exporter
(hostNetwork, hostPID, hostPath volumes, hostPort 9100). The bundled DaemonSet
was stuck at 0/3 pods causing ArgoCD to show Progressing health.

kube-prometheus-stack already provides cluster-wide node-exporter coverage,
so the bundled one is redundant.

Key: prometheus.prometheus-node-exporter.enabled (prometheus sub-chart key,
NOT temporal's unused prometheus.nodeExporter.enabled wrapper)
aaron merged commit 8c0fc0e9fa into live 2026-03-26 21:11:03 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
aaron/infra-core!79
No description provided.