robintra/perf-sentinel chart-v0.22.0

perf-sentinel chart v0.22.0

on GitHub

What's new in chart-v0.22.0

A metadata-only bump. No template changes, no values.yaml key added or removed, and the rendered perf-sentinel.toml is byte-for-byte what chart-v0.21.0 rendered, same 5047 bytes and the same digest. appVersion moves to 0.22.0 and image.tag follows it to :0.22.0, which is the whole of this release: everything it ships is inside the daemon image.

What moves inside the pod

Every key-gated route of the daemon now accepts Authorization: Bearer <key> beside X-API-Key: both ack verbs, GET /api/acks, and both verbs of /api/incidents. Either one, the same key, the same constant-time comparison, and the same rules about which key opens which verb.

The reason is Kubernetes-shaped, which is why it lands in a chart release at all. POST /api/incidents has been documented since 0.20.0, but the receiver an operator actually generates could not reach it: neither AlertmanagerConfig nor VMAlertmanagerConfig can send an arbitrary header, so neither can send X-API-Key. Both carry a bearer token.

Ready-made alert rules and the matching receiver now ship for both operators, in examples/incident-alerts-prometheus-operator.yaml and its VictoriaMetrics twin. They are examples to copy, not something this chart deploys: the chart's own opt-in PrometheusRule watches the daemon's own health and is untouched.

The v0.22.0 binary notes describe all of it, including the one response string a client can see move.

Upgrade impact

• Pods roll on the image. helm upgrade replaces them because appVersion and image.tag move together.
• checksum/config moves too, and not because your configuration changed. The rendered perf-sentinel.toml is identical, but the ConfigMap carries helm.sh/chart and app.kubernetes.io/version labels that bump with the chart, so the checksum over it differs on every version bump. Nothing in the daemon's configuration is re-read differently.
• No values.yaml key is added or removed, no template changes, and the shipped PrometheusRule is untouched.
• Nothing changes for a deployment that authenticates with X-API-Key. The header is tried first and short-circuits, so bearer is a second way in, never a replacement, and no key needs rotating.
• The body of a 401 on the query API now names both credentials. It reads missing or invalid X-API-Key or Authorization: Bearer, which matters only to a client that matches on that string.

Install

The chart is published as an OCI artifact on GHCR, install it directly with no helm repo add step:

helm install perf-sentinel oci://ghcr.io/robintra/charts/perf-sentinel --version 0.22.0

Upgrade an existing release:

helm upgrade perf-sentinel oci://ghcr.io/robintra/charts/perf-sentinel --version 0.22.0

Read docs/HELM-DEPLOYMENT.md for the ServiceMonitor section, sizing and Ingress postures. If you intend to wire the incident route, docs/QUERY-API.md covers the credential and both operator traps, starting with the namespace matcher each one appends by default, which matches nothing and reports nothing when it does.

If you are upgrading from chart-v0.18.0 or earlier, read the chart-v0.19.0 notes first: that release adds a grouping label to five metrics and is breaking for an unaggregated alert on any of them. From chart-v0.16.0 or earlier, read the chart-v0.17.0 notes as well, which change the shipped PrometheusRule.

Full Changelog: chart-v0.21.0...chart-v0.22.0