robintra/perf-sentinel chart-v0.20.0

perf-sentinel chart v0.20.0

on GitHub

What's new in chart-v0.20.0

No template changes, and no values.yaml key added or removed. appVersion moves to 0.20.0, so the image moves and pods roll, and the default config.toml gains commented guidance for two opt-in daemon features, which moves checksum/config with it. Nothing behind those comments is enabled by default, so an install that changes nothing else gets the new daemon and the same behaviour.

The daemon it ships can freeze what was burning

POST /api/incidents receives an Alertmanager webhook and freezes the findings of the window before a restart or a memory event, GET /api/incidents lists them, both behind the opt-in [daemon.incidents] section. The config.toml in values.yaml now says where the table goes and what it needs.

Two things this chart makes you get right in order. An enabled [daemon.incidents] without its key stops the daemon at startup, so the Secret carrying PERF_SENTINEL_INCIDENTS_API_KEY has to exist before the section does. And archive_path belongs on the PVC: the record lives in memory otherwise, and a node-level memory event that kills the observed service often takes a co-located daemon with it, destroying the record that would explain the outage.

A key that reads and cannot write

PERF_SENTINEL_READ_API_KEY sets the new [daemon] read_api_key, which opens GET /api/acks and GET /api/incidents without the power to write and is refused when equal to a write key. It is the key to give Grafana and the Hub, which each carry one header value and had to hold a write key to read a gated route.

Three keys now come from Secrets through extraEnvFrom: PERF_SENTINEL_ACK_API_KEY, PERF_SENTINEL_INCIDENTS_API_KEY and PERF_SENTINEL_READ_API_KEY.

One comment is corrected on the way. The ingress note said the shared PERF_SENTINEL_ACK_API_KEY gates ack writes alone and leaves every read open. GET /api/acks has been gated since 0.9.15.

Four metrics, none of them an alert

perf_sentinel_incidents_total{kind}
perf_sentinel_incidents_rejected_total{reason}
perf_sentinel_incidents_archive_failed_total
perf_sentinel_service_last_span_timestamp_seconds{service}

perf_sentinel_incidents_rejected_total is the only signal that an Alertmanager receiver carries the wrong header or a rule the wrong label: the intake body says so too, but Alertmanager discards it and never retries a 4xx. The last-span gauge is a Unix stamp rather than an age, so time() - gauge survives a daemon restart where every counter resets and a whole fleet reads as stopped.

None ships as an alert, for the same reason as the overflow counters of chart-v0.19.0: a refusal counted is a state the daemon works normally in, and the threshold belongs to your alerting rather than to this chart. The shipped PrometheusRule is unchanged.

Upgrade impact

• Pods roll on the image and on the config. checksum/config moves because the guidance comments sit inside the rendered config.toml, unlike chart-v0.19.0, where the image moved alone. No default value changes with them.
• Nothing new is on by default. [daemon.incidents] is absent, its routes answer 503, and [daemon] read_api_key is unset. A chart-v0.19.0 install upgrades with no value to set.
• An enabled [daemon.incidents] without its key stops the daemon at startup. Create the Secret entry before adding the table, or the pod crash-loops on a config error.
• [daemon.cors] allowed_origins = ["*"] beside an incidents key now fails at load, the way it already failed beside the ack key.
• No values.yaml key is added or removed, no template changes, and the shipped PrometheusRule is untouched. [daemon.incidents] and read_api_key go in the config.toml block of values.yaml, not in a chart value.

Install

The chart is published as an OCI artifact on GHCR, install it directly with no helm repo add step:

helm install perf-sentinel oci://ghcr.io/robintra/charts/perf-sentinel --version 0.20.0

Upgrade an existing release:

helm upgrade perf-sentinel oci://ghcr.io/robintra/charts/perf-sentinel --version 0.20.0

Read docs/HELM-DEPLOYMENT.md for the ServiceMonitor section, sizing and Ingress postures. The daemon image moves on this release, so the v0.20.0 binary notes describe what changes inside the pod.

If you are upgrading from chart-v0.18.0 or earlier, read the chart-v0.19.0 notes first: that release adds a grouping label to five metrics and is breaking for an unaggregated alert on any of them. From chart-v0.16.0 or earlier, read the chart-v0.17.0 notes as well, which drop the shipped PrometheusRule from seven alerts to five.

Full Changelog: chart-v0.19.0...chart-v0.20.0