What happened:
The prometheus health checks fail when falcosidekick is not enabled:
- lastTransitionTime: "2026-04-17T18:43:17Z"
lastUpdateTime: "2026-04-17T18:45:48Z"
message: 'There are health issues in Prometheus pod "shoot--local--local/prometheus-shoot-0".
Access Prometheus UI and query for "healthcheck:up" for more details: healthcheck:up{job="prometheus-shoot",
scrape_job="scrapeConfig/shoot--local--local/shoot-falco", task="scrape_pool:empty"}
=> 0'
reason: PrometheusHealthCheckDown
status: "False"
type: ObservabilityComponentsHealthy
This happens because the shoot-falco scrape config is always deployed, even when falcosidekick is not enabled and there isn't anything to scrape in the shoot.
What you expected to happen:
Prometheus healthchecks to not fail.
How to reproduce it (as minimally and precisely as possible):
- Create a
Shoot cluster
- Enable the falco extension and only specify
stdout destination, e.g.:
extensions:
- providerConfig:
apiVersion: falco.extensions.gardener.cloud/v1alpha1
autoUpdate: true
destinations:
- name: stdout
falcoVersion: 0.41.3
kind: FalcoServiceConfig
rules:
standard:
- falco-rules
- Observe that the shoot remains unhealthy with the error shown above
Anything else we need to know:
One way to fix this would be to introduce a falcosidekick.enabled value in the extension-shoot-falco-service-chart-seed chart similar to what is done for the shoot falco chart and only include the definition for the scrape config if falcosidekick.enabled is true.
However, I wonder if it makes sense to deploy the seed extension-shoot-falco-service-seed ManagedResource when falcosidekick is not enabled as it only contains resources necessary for falcosidekick.
What happened:
The prometheus health checks fail when
falcosidekickis not enabled:This happens because the
shoot-falcoscrape config is always deployed, even whenfalcosidekickis not enabled and there isn't anything to scrape in the shoot.What you expected to happen:
Prometheus healthchecks to not fail.
How to reproduce it (as minimally and precisely as possible):
Shootclusterstdoutdestination, e.g.:Anything else we need to know:
One way to fix this would be to introduce a
falcosidekick.enabledvalue in theextension-shoot-falco-service-chart-seedchart similar to what is done for the shootfalcochart and only include the definition for the scrape config iffalcosidekick.enabledis true.However, I wonder if it makes sense to deploy the seed
extension-shoot-falco-service-seedManagedResourcewhenfalcosidekickis not enabled as it only contains resources necessary forfalcosidekick.