perf-sentinel chart v0.9.28

What's new in chart-v0.9.28

Version bump only, no template changes at all. appVersion moves from 0.9.26 to 0.9.28, skipping 0.9.27 which was the chart-only release, so the chart and the application are aligned again. Everything below is what the new daemon image brings to a cluster, and one of those things is a total ingest outage that a Kubernetes deployment was particularly good at hiding.

Fixed

• A collector at its defaults was sending into the void, and the cluster said it was fine. The daemon's OTLP gRPC listener declared no accepted encoding, and the OTel Collector's OTLP exporter compresses with gzip by default, so the daemon answered every export with a non-retryable Unimplemented and the Collector dropped each batch without retrying. In a cluster that failure was invisible from every angle an operator watches: the pod stayed Ready, /health kept answering the probes, and the /metrics counters a ServiceMonitor scrapes stayed flat at zero, which reads as a daemon with nothing to do rather than one refusing everything. The only trace of it lived in the Collector's own logs. Both ports now accept gzip and deflate, so a collector wired to :4317 or to :4318 with its defaults gets through. snappy and zstd are still refused on both and must be changed back to gzip or none.
• A ConfigMap-mounted ack baseline no longer crashes the daemon without saying why. The CI ack loader declines to follow a symlink, a hardening against a link pointing at a sensitive file, and a ConfigMap projects every key as exactly that kind of symlink. Mounting .perf-sentinel-acknowledgments.toml the obvious way therefore produced a CrashLoopBackOff whose message named the file and no cause, on a FROM scratch image with no shell to investigate from. The daemon now prints the cause chain under the startup error, so the log names the symlink refusal. The refusal itself is unchanged, and docs/HELM-DEPLOYMENT.md documents the subPath mount that materialises a real file.

Changed

• [daemon] max_payload_size now bounds decode buffers rather than uploaded bytes. Accepting compression means a small frame on the wire expands to the cap once decoded, so the same memory ceiling is reachable with a fraction of the traffic that used to be required. On a pod with a memory limit, raise [daemon] memory_high_water_pct off its default of 0 before accepting compressed ingest: it is the cgroup-aware admission gate, and at 0 it is inactive. The resources.limits.memory you already run with is otherwise unchanged, the ceiling is the same, only the traffic needed to reach it moved.

Behavior

• The upgrade rolls the pods. The image tag falls back to .Chart.AppVersion when image.tag is empty, which is the default, so the pod spec changes from 0.9.26 to 0.9.28 and a rollout follows. That is the point of this release, unlike 0.9.27 which was metadata-only. Pinning image.tag explicitly keeps the old image and forgoes the fix.
• No template, no value and no default changes. Every workload kind renders as it did under 0.9.27 apart from the image tag. Nothing about the Service, the probes, the ServiceMonitor, the PrometheusRule, the NetworkPolicy or the fragment mounts moves.
• The new acknowledgment warning does not reach a daemon. 0.9.28 reports a CI ack entry that suppressed nothing under an unmatched_acknowledgment warning, which is derived from a batch analysis only. A daemon deployed by this chart never emits it, and /api/findings is unaffected. The two new optional TOML fields, service and source_endpoint, are ignored by the daemon's own path, so a mounted ack file carrying them behaves exactly as before.
• No signature changes. No acknowledgment needs re-capturing, on either the TOML baseline or the daemon's runtime store.

Install

The chart is published as an OCI artifact on GHCR, install it directly with no helm repo add step:

helm install perf-sentinel oci://ghcr.io/robintra/charts/perf-sentinel --version 0.9.28

Upgrade an existing release:

helm upgrade perf-sentinel oci://ghcr.io/robintra/charts/perf-sentinel --version 0.9.28

Verify that the rollout picked up the new image:

kubectl get pod -l app.kubernetes.io/name=perf-sentinel \
  -o jsonpath='{.items[*].spec.containers[*].image}'

Read docs/HELM-DEPLOYMENT.md for the sizing guidance and for the subPath mount an ack baseline needs.

Full Changelog: chart-v0.9.27...chart-v0.9.28