robintra/perf-sentinel chart-v0.9.15

perf-sentinel chart v0.9.15

on GitHub

What's new in chart-v0.9.15

This chart release carries no functional template change. It advances appVersion to the current daemon release 0.9.15, a security hardening release, and documents in the chart how to restrict who may acknowledge findings. The chart version and appVersion stay in lockstep at 0.9.15.

Changed

• appVersion advanced from 0.9.14 to 0.9.15, and the artifacthub.io/images tag follows to ghcr.io/robintra/perf-sentinel:0.9.15. The 0.9.15 binary is a security hardening release: a secret embedded in a request URL is stripped at ingestion before it can reach a finding, the query API, the on-disk archive, or an acknowledgment signature, GET /api/acks is gated by [daemon.ack] api_key when set, the report export runs the real quality gate, and verify-hash verifies binary provenance via gh attestation verify. See the v0.9.15 release.
• The chart documents how to restrict who may acknowledge findings on the pod-network bind. The config comments and the post-install notes now spell out the two options: front the API with an SSO proxy for per-group control, only your architects or SRE, or set a shared [daemon.ack] api_key sourced from a Secret through the PERF_SENTINEL_ACK_API_KEY environment variable. The daemon carries no embedded identity model, so per-identity control lives in the proxy.

Behavior

• The rendered manifest set changes only in the ConfigMap config comments, the post-install notes, and the image tag. No default value changes and no configuration key changes its meaning.
• The appVersion bump rolls the pod to the 0.9.15 image. The daemon's behavior changes come from the binary, not the chart.
• One upgrade-time caveat resets some acknowledgment signatures. The 0.9.15 daemon strips query strings, fragments, and userinfo from endpoints at ingestion, which changes the acknowledgment signature of any finding whose endpoint carried one, so an existing acknowledgment on such an endpoint must be re-captured after the upgrade. Route-template endpoints, the common case, are unchanged. A GET /api/acks reader on a daemon with [daemon.ack] api_key set must also start sending the X-API-Key header. See the v0.9.15 release for the full migration. No route disappears and no metric loses a label value.

Install

The chart is published as an OCI artifact on GHCR, install it directly with no helm repo add step:

helm install perf-sentinel oci://ghcr.io/robintra/charts/perf-sentinel --version 0.9.15

Upgrade an existing release:

helm upgrade perf-sentinel oci://ghcr.io/robintra/charts/perf-sentinel --version 0.9.15

Full Changelog: chart-v0.9.14...chart-v0.9.15