Kyverno Policy reports are not shown in UI

[m-yosefpor]

I have deployed the kyverno policy reporter with official helm charts with the following values:

  ui:
    enabled: true
    plugins:
      kyverno: true
    ingress:
      enabled: true
      hosts:
      - host: myhost.example.com
        paths:
        - path: /
  kyvernoPlugin:
    enabled: true

And I can see the policies in UI:

Also I can see the policy warnings in the Logs section:

However, there are no reports in other part of the UI:

[fjogeleit]

Hey, thanks for your Report. Which version of kyverno do you running?

can you please check the logs of the Policy Reporter Pod?

[m-yosefpor]

Hey, thanks for your Report. Which version of kyverno do you running?

can you please check the logs of the Policy Reporter Pod?

Policy reporter chart version: 1.12.0
kyverno chart version: 2.1.0

Policy reporter app version: 1.9.0
Kyverno app version: v1.5.0-rc1
policy-reporter-kyverno-plugin:0.3.2
policy-reporter-ui:0.15.0

policy-reporter logs (repetitive following line):

[INFO] UI PUSH OK
[INFO] UI PUSH OK
[INFO] UI PUSH OK

policy-reporter-kyverno-plugin logs:

[INFO] No separete configuration file found

policy-reporter-ui

http: superfluous response.WriteHeader call from github.com/kyverno/policy-reporter-ui/pkg/api.ResultHandler.func1 (handler.go:88)
http: superfluous response.WriteHeader call from github.com/kyverno/policy-reporter-ui/pkg/api.ResultHandler.func1 (handler.go:88)
http: superfluous response.WriteHeader call from github.com/kyverno/policy-reporter-ui/pkg/api.ResultHandler.func1 (handler.go:88)

[fjogeleit]

Hey, thank you. I released a new version of the Policy Reporter Image. Can you try it out in your installation by setting the image version to 1.10.1.

image:
  tag: 1.10.1

If this doesn't help, can you check if the API calls are successful in the UI and if they contain data?

[fjogeleit]

I also created a new Helm Release 1.12.2, so you can also update the helm chart and do an upgrade

[m-yosefpor]

@fjogeleit thank you very much for the help. I think I've found the issue. Upgrading to 1.12.2 didn't help. The api calls in network call are all 500 http error.

With the following response:

{ "message": "Get "http://policy-reporter:8080/cluster-policy-reports": dial tcp: lookup policy-reporter on 172.30.0.10:53: no such host" }

The issue is I have deployed the helm chart with another release name cloud-policy-reporter instead of policy-reporter, so all svc name are prefixed with cloud- and the lookup is failing. I didn't know it has a dependency to chart release name (and I think it shouldn't have such dependency), and right now it seems the chart release name must be only equal to policy-reporter.

[m-yosefpor]

Yes I can confirm, changing the release name solved the issue.

[fjogeleit]

Okay, great. Thank you for this information and I will investigate how I can improve this.

[fjogeleit]

Currently you can configure the service name of policy-reporter to use a custom release name:

https://github.com/kyverno/policy-reporter/blob/main/charts/policy-reporter/values.yaml#L103

But it's not very intuitive so I will look if I can simplify this

[m-yosefpor]

@fjogeleit yes I came to that after trying to investigate where in the helm chart is causing this. It is not trivial at all and not mentioned in docs as well. I have created a PR to simplify this.

[fjogeleit]

thank you, yes the Project has still some children diseases.