Institut-du-Numerique-Responsable/perf-sentinel chart-v0.28.0

perf-sentinel chart v0.28.0

on GitHub

What's new in chart-v0.28.0

appVersion moves to 0.28.0 and image.tag follows it to :0.28.0. No template, values.yaml key or schema changes. Under the default values the rendered perf-sentinel.toml is byte-for-byte what chart-v0.27.0 rendered, 5353 bytes. The other manifest changes are the image, the version labels and checksum/config.

What moves inside the pod

With workload.kind: StatefulSet and workload.statefulset.persistence.enabled: true, the chart already points [daemon.archive] path at the volume, and the daemon now also writes its daily rollups there: one hash-chained line per UTC day in archive-daily-YYYY-MM.ndjson, a few tens of KiB per day, kept rollup_retention_days (400 by default). disclose reads them, so a quarterly disclosure fits on the default 2Gi claim, where the per-window archive held less than a day of a busy daemon. They follow [daemon.archive] path, so no value is added. Without persistence the chart enables no archive, and the daemon writes neither.

The workload.statefulset.persistence.size comment in values.yaml now says that quarterly disclosures read the daily rollups on the same volume, and keeps raising max_files or max_size_mb for a longer per-window drill-down only.

disclose in the image refuses an official period its archive no longer reaches back to, and a disclosure attestation it emits now names the report's canonical content hash, which verify-hash checks. /api/status gains disclosure_archive and /metrics three label-free gauges for the rollup horizon.

The v0.28.0 binary notes describe the changes.

Upgrade impact

• Pods roll on the image. helm upgrade replaces them because appVersion and image.tag move together.
• A StatefulSet with persistence starts writing rollup files on its volume. One file per month plus an archive-daily.partial.json snapshot, owner-only, beside archive.ndjson. The window archive keeps its rotation and its size.
• checksum/config moves, and not because your configuration changed. The rendered perf-sentinel.toml is identical, and the ConfigMap carries helm.sh/chart and app.kubernetes.io/version labels that bump with the chart.
• The image pulls rustls 0.23.46 against RUSTSEC-2026-0346 to RUSTSEC-2026-0349, of which only the ServerHello advisory applies, to the daemon's outbound HTTP client.
• No values.yaml key is added or removed, no template changes, and the shipped PrometheusRule is untouched.

Verifying this chart

Charts signed before the move carry the original account's identity, so the regex accepts both owners:

cosign verify \
  --certificate-identity-regexp '^https://github.com/(robintra|Institut-du-Numerique-Responsable)/perf-sentinel/\.github/workflows/helm-release\.yml@refs/tags/chart-v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/institut-du-numerique-responsable/charts/perf-sentinel:0.28.0

helm pull oci://ghcr.io/institut-du-numerique-responsable/charts/perf-sentinel --version 0.28.0
gh attestation verify perf-sentinel-0.28.0.tgz \
  --repo Institut-du-Numerique-Responsable/perf-sentinel

cosign 3.0 or newer is required, the signature is an OCI 1.1 referrer bundle.

Install

The chart is published as an OCI artifact on GHCR, install it directly with no helm repo add step:

helm install perf-sentinel oci://ghcr.io/institut-du-numerique-responsable/charts/perf-sentinel --version 0.28.0

Upgrade an existing release:

helm upgrade perf-sentinel oci://ghcr.io/institut-du-numerique-responsable/charts/perf-sentinel --version 0.28.0

Read docs/HELM-DEPLOYMENT.md for the ServiceMonitor section, sizing and Ingress postures.

If you are upgrading from chart-v0.23.0 or earlier, read the chart-v0.24.0 notes first: that release raises the default workload.statefulset.persistence.size to 2Gi, which an existing StatefulSet does not pick up on its own. From chart-v0.18.0 or earlier, read the chart-v0.19.0 notes as well: that release adds a grouping label to five metrics and is breaking for an unaggregated alert on any of them. From chart-v0.16.0 or earlier, the chart-v0.17.0 notes change the shipped PrometheusRule.

Full Changelog: chart-v0.27.0...chart-v0.28.0