Ignore drift detection on PrometheusRule CR generated by Loki HelmRelease (!5315) · Merge requests · Sylva-projects / sylva-core

What does this MR do and why?

This MR is adding driftdetection.ignore rule on loki HelmRelease, so that the drift on PrometheusRule CR is ignored by the Helm controller. This is because of rancher-monitoring-admission webhook is adding an annotation to PrometheusRule prometheus-operator-validated: true. This annotation will be added to each custom resource named PrometheusRule present in any namespace.

Drift Info

Action: [2025-08-27T19:37:51.238Z] PrometheusRule/loki/loki-loki-alerts changed (1 additions, 0 changes, 0 removals)\nPrometheusRule/loki/loki-loki-rules changed (1 additions, 0 changes, 0 removals)","type":"Warning","object":{"kind":"HelmRelease","namespace":"sylva-system","name":"loki","uid":"61a6559b-9548-410c-b499-14bd10bb69b5","apiVersion":"helm.toolkit.fluxcd.io/v2","resourceVersion":"109208"},"reason":"DriftDetected}

Webhooks from monitoring stack:

$ kubectl get mutatingwebhookconfiguration rancher-monitoring-admission
NAME                           WEBHOOKS   AGE
rancher-monitoring-admission   1          12h
$ kubectl get validatingwebhookconfiguration rancher-monitoring-admission
NAME                           WEBHOOKS   AGE
rancher-monitoring-admission   1          12h

Solution:

In the Loki unit, driftDetection has been configured for prometheusRule resources so that the Helm controller ignores them whenever the annotation prometheus-operator-validated: true is applied to prometheusRule CR within the Loki namespace:

helmrelease_spec:
  driftDetection:
    ignore:
      - paths:
          - /metadata/annotations/prometheus-operator-validated
        target:
          group: monitoring.coreos.com
          kind: PrometheusRule

Related reference(s)

Closes #2746 (closed)

Test coverage

CI configuration

Below you can choose test deployment variants to run in this MR's CI.

Click to open to CI configuration

Legend:

Icon	Meaning	Available values
☁️	Infra Provider	`capd`, `capo`, `capm3`
🚀	Bootstrap Provider	`kubeadm` (alias `kadm`), `rke2`, `okd`, `ck8s`
🐧	Node OS	`ubuntu`, `suse`, `na`
🛠️	Deployment Options	`light-deploy`, `dev-sources`, `ha`, `misc`, `maxsurge-0`, `logging`, `no-logging`
🎬	Pipeline Scenarios	Available scenario list and description

Global config for deployment pipelines

autorun pipelines
allow failure on pipelines
record sylvactl events

Notes:

Enabling autorun will make deployment pipelines to be run automatically without human interaction
Disabling allow failure will make deployment pipelines mandatory for pipeline success.
if both autorun and allow failure are disabled, deployment pipelines will need manual triggering but will be blocking the pipeline

Be aware: after configuration change, pipeline is not triggered automatically. Please run it manually (by clicking the run pipeline button in Pipelines tab) or push new code.

Edited Sep 01, 2025 by Dragos Gerea

Ignore drift detection on PrometheusRule CR generated by Loki HelmRelease