Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 11 additions & 3 deletions charts/operator/Chart.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,16 @@ type: application
# appVersion tracks the operator binary's EKS Pod Identity tenant-runtime model
# (assumeRolePolicyForPodIdentity + PodIdentityAssociation; ClusterName replaces the
# OIDC provider/issuer inputs). The chart folds the eval-runtime (Argo
# WorkflowTemplate/AnalysisTemplate) and operator SLO (PrometheusRule/
# AlertmanagerConfig/CR-state metrics) behind evalRuntime.* / slo.* toggles.
# WorkflowTemplate/AnalysisTemplate) behind evalRuntime.*. It ships no SLO
# manifests — see 0.6.0 below, which removed them.
#
# 0.6.5 is documentation only. The README described an `slo.*` values block that
# 0.6.0 had removed and that values.schema.json now rejects outright, so a reader
# following it got `additional properties 'slo' not allowed` rather than the
# alerting it promised. Chart.yaml's own description asserted the same thing
# three lines above the entry recording the removal. No template, CRD or default
# changed; the version moves because README.md is packaged content and the
# published 0.6.4 would otherwise be overwritten with different bytes.
#
# 0.6.4 carries values.schema.json and the README's Pod Identity correction.
# Both landed while Chart.yaml still said 0.6.3, which was already published —
Expand Down Expand Up @@ -37,7 +45,7 @@ type: application
# dropped on decode and the objective would silently fall back to the
# two-counter shape. A chart may not ship a CRD field its appVersion cannot
# honour — nor, as 0.6.3 records, a workflow parameter.
version: 0.6.4
version: 0.6.5
appVersion: "0.6.0"
# `-0` admits pre-release-tagged versions so the constraint matches managed
# distros that append a suffix (EKS reports e.g. v1.35.4-eks-40737a8).
Expand Down
16 changes: 11 additions & 5 deletions charts/operator/README.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# charts/operator

Helm chart for the eks-agent-platform operator: CRDs + Deployment + RBAC + Service + ServiceMonitor + NetworkPolicy + PDB, plus the operator's own runtime — the eval-runtime (Argo WorkflowTemplate/AnalysisTemplate) and SLO (PrometheusRule/AlertmanagerConfig/CR-state metrics), behind `evalRuntime.*` / `slo.*` toggles.
Helm chart for the eks-agent-platform operator: CRDs + Deployment + RBAC + Service + ServiceMonitor + NetworkPolicy + PDB, plus the eval-runtime (Argo WorkflowTemplate/AnalysisTemplate) behind `evalRuntime.*`.

## Install

Expand Down Expand Up @@ -39,12 +39,18 @@ The Argo Workflows runtime the operator submits EvalSuite runs to (WorkflowTempl
- `evalRuntime.evalReportsBucket` — S3 bucket for eval reports (terraform output, injected per-cluster)
- `evalRuntime.rollouts.enabled` — the AnalysisTemplate; **off by default** (needs the Argo Rollouts CRD)

### operator SLO (`slo.*`)
### operator SLO — not in this chart

The operator's own observability: recording rules + alerts and persona alert routing. Enabled by default; needs the prometheus-operator CRDs. The kube-state-metrics CustomResourceState config that makes the `kube_customresource_*` metrics exist lives in the eks-gitops kube-state-metrics addon (the single source — it's what KSM actually loads); this chart consumes those metrics, it doesn't define them.
There are no `slo.*` values. The PrometheusRule, the AlertmanagerConfig and the
namespace that held them were removed at chart 0.6.0, and `values.schema.json`
now closes the top level, so setting one is not merely ignored — `helm template
--set slo.enabled=true` fails with `additional properties 'slo' not allowed`.

- `slo.operatorNamespace` — the namespace the operator runs in, used in the PromQL metric selectors
- `slo.alerting.enabled` — the AlertmanagerConfig persona routing; **off by default** — its receivers reference six Secrets (`pagerduty-platform`, `slack-webhook-{incidents,finance,ops,eng,platform}`) that must pre-exist; enable per-env in production once provisioned
The operator's alert rules live in eks-gitops as Grafana-managed rules
(`dashboards/base/alerting/agent-operator.yaml`), evaluated against AMP rather
than by a prometheus-operator in-cluster. The `slo:` key that does exist here is
`reconcilers.slo`, which toggles the SLOPolicy reconciler in the binary and is
unrelated.

## Required cluster capabilities

Expand Down
Loading