Description of problem:
If using a policy as described[1] which has at least two policy-templates , a breach of the sub-policies does get fixed by enforcement but it takes too long for the main policy to be updated.
There is also no documentation on the behaviour in the governance documentation
Version-Release number of selected component (if applicable):
2.6 and 2.7
How reproducible:
all the time
Steps to Reproduce:
- create a policy with two policy-templates [1]
- set it up to affect several clusters
- cause a breach in one or two of the sub-policies
Actual results:
The "Cluster Violations" column on the Governance - Policies tab of the RHACM console regularly appears out of date. When accessing the policy, the details under the "Placement" section will also appear out of date. However, when accessing the 'Result' tab of the policy, all details are up-to-date.
Expected results:
The enforcement of the policies is reflected in the status of the main policy or the main policy has no status at all other than the status of all the sub policies.
Additional info:
- [1] : the policy should have several policy-templates such as
disabled: false policy-templates: - objectDefinition: apiVersion: policy.open-cluster-management.io/v1 kind: ConfigurationPolicy metadata: name: config-mgmt-tiwana-test spec: object-templates: - complianceType: musthave objectDefinition: apiVersion: v1 kind: Namespace metadata: annotations: scheduler.alpha.kubernetes.io/defaultTolerations: '[{"operator":"Exists","effect":"NoSchedule","key":"node-role.kubernetes.io/infra"}]' name: tiwana-test severity: high - objectDefinition: apiVersion: policy.open-cluster-management.io/v1 kind: ConfigurationPolicy metadata: name: config-mgmt-abtest spec: object-templates: - complianceType: musthave objectDefinition: apiVersion: v1 kind: Namespace metadata: annotations: scheduler.alpha.kubernetes.io/defaultTolerations: '[{"operator":"Exists","effect":"NoSchedule","key":"node-role.kubernetes.io/infra"}]' name: abtest severity: high remediationAction: enforce
- it was discussed in the enablement of one previous version that this behaviour is expected and that it couldn't be worked around, but that isn't documented. I would want to make sure we can't work around the behaviour or change how the status when sub-policies are enforced is updated and get the get the documentation updated to mention the behaviour.
- changing the policy between `Enforce` and `Inform` updates the governance page.