perf-sentinel chart v0.9.19

What's new in chart-v0.9.19

This chart release closes the gaps found by auditing the chart against the published Helm, Kubernetes and Artifact Hub conventions. The StatefulSet mode finally renders the headless Service it always referenced, the helm test pod stops borrowing the workload's selector labels, the pod template carries the standard labels every other rendered object already had, and an Artifact Hub annotation that never did anything is removed. Two scope decisions are now written down rather than left implicit: the NetworkPolicy stays ingress-only, and the chart ships no Helm provenance file. appVersion is intentionally held at the current daemon release 0.9.17 because the binary did not change. The chart version advances to 0.9.19 on its own.

Added

• workload.kind=StatefulSet renders the headless Service it requires. spec.serviceName pointed at the regular ClusterIP Service, which gives no per-pod DNS identity, so the StatefulSet mode only ever delivered its PVC while the network identity it promises silently did not exist. The chart now renders <fullname>-headless with clusterIP: None and publishNotReadyAddresses: true, and points spec.serviceName at it. Set workload.statefulset.serviceName to a Service you manage and the chart renders none. This is the one migration in this release, see Behavior below.

Fixed

• The helm test pod no longer carries the workload selector labels. It now carries app.kubernetes.io/name: <name>-test plus app.kubernetes.io/component: test, so the PodDisruptionBudget stops counting it and the Service stops selecting it for the duration of a test run. The Service never actually routed traffic to it, a named targetPort cannot resolve against a pod that declares no ports, so the overlap was harmless in practice. It was accidental rather than intended, and it would have become real the day the Service moved to a numeric targetPort.
• The pod template carries the standard labels. helm.sh/chart, app.kubernetes.io/version and app.kubernetes.io/managed-by were applied to every rendered object except the podTemplate, so pod-level selectors built on them matched nothing while the same labels were visible on the Deployment, the Service and the ConfigMap. This matches the Helm chart best practices and what helm create scaffolds. Selector labels are untouched, so spec.selector stays immutable.

Removed

• The artifacthub.io/official: "true" annotation. It is not one of the 16 Helm annotations Artifact Hub documents and reads, so it never conferred anything, and an inert self-declaration of official status is misleading. That status is requested through an issue on the artifacthub/hub repository once the repository already holds the verified-publisher badge. The deployment guide's Artifact Hub section is updated accordingly, it still described the repositoryID as an unset placeholder long after registration completed.

Changed

• A post-install note fires when networkPolicy.enabled is set with no ingress selector. That fail-closed case denies every ingress, which also blocks the ServiceMonitor scrape and helm test, and it renders and validates cleanly so nothing surfaces it before the cluster does. The note and values.yaml now spell out the failure mode: the pod keeps reporting Ready, because Kubernetes always allows "traffic to and from the node where a Pod is running" and the kubelet probes therefore cross any policy. A misconfigured selector leaves a green pod that receives nothing, which is harder to notice than a CrashLoop. Verified in cluster on k3s/kube-router 1.35 with a deny-all policy in place and a third-party pod confirming the policy was actually enforced.
• The NetworkPolicy stays ingress-only, deliberately. The daemon's outbound destinations (Tempo, Jaeger, Electricity Maps, the energy scrapers) are declared in the operator's config.toml and are not knowable by the chart, so a generic egress block would either be too permissive to protect anything or strict enough to break the default install. NetworkPolicies are additive, an egress policy belongs alongside this one. Documented in values.yaml rather than left as an unexplained absence.
• The chart ships no Helm .prov file, so helm install --verify is unavailable by design. Helm's native provenance requires a long-lived PGP key held as a CI secret, with the rotation, revocation and fingerprint-publication burden that follows. Cosign keyless signing plus the SLSA attestation answer the same question, does this artefact come from the release workflow of this repository, with no static signing key existing anywhere. The deployment guide now says so next to the cosign verify command instead of leaving the absence unexplained.
• The deployment guide no longer advises around PodSecurityPolicy, removed in Kubernetes 1.25 while this chart's floor is 1.24. The passage now names a mutating admission policy, which is what can actually rewrite fsGroup or runAsUser on a pod. Pod Security Admission validates, it never mutates.

Behavior

• Upgrading a StatefulSet release in place will fail. spec.serviceName is immutable, and this release changes it from the ClusterIP Service name to <fullname>-headless. Delete the StatefulSet first, kubectl delete statefulset <name> --cascade=orphan keeps the pods and the PVCs, then run helm upgrade. Deployment and DaemonSet installs, which is the default and the recommended topology, are unaffected and upgrade normally.
• The pod rolls on upgrade even though the image tag does not move. The pod template gains the standard labels, so its hash changes. With appVersion held at 0.9.17 the artifacthub.io/images tag stays ghcr.io/robintra/perf-sentinel:0.9.17 and the same daemon binary runs after the upgrade.
• No daemon behavior changes. No route disappears, no metric loses a label value, no configuration key changes its meaning, and acknowledgment signatures do not reset.
• service.selector and every spec.selector.matchLabels are unchanged, so no selector migration is required for any workload kind.

Install

The chart is published as an OCI artifact on GHCR, install it directly with no helm repo add step:

helm install perf-sentinel oci://ghcr.io/robintra/charts/perf-sentinel --version 0.9.19

Upgrade an existing release:

helm upgrade perf-sentinel oci://ghcr.io/robintra/charts/perf-sentinel --version 0.9.19

Full Changelog: chart-v0.9.18...chart-v0.9.19