feat: follow the loki and tempo charts to their new home, and notice next time - #190
Merged
Conversation
…next time
Both observability charts moved out of grafana/helm-charts. One said so; the
other did not, and that is the more interesting half.
─── tempo ───
The chart is flagged `deprecated: true` and its README names the destination:
grafana-community/helm-charts, which carries the full history rather than
restarting. Same chart, same single-binary topology, renumbered at the fork, so
1.24.4 becomes 2.2.3 and the app moves 2.9.0 -> 2.10.7.
tempo-distributed is not the successor. It was deprecated in the same move.
─── loki ───
The OSS chart moved to the same place, forked at 6.55.0. What stayed behind at
grafana/helm-charts is now maintained for Grafana Enterprise Logs only — its
description says "Grafana Enterprise Logs" and its 7.x line is the GEL line.
It carries no deprecation flag. The pin resolved, the chart installed, every
gate stayed green, and Renovate went on offering 7.x patches. The catalog was
tracking a different product and the only field that had changed was the
description.
─── What the migration actually required ───
Rendering both charts against the committed values, per environment, shows the
configuration carries over intact: receivers, storage backend, schema v13,
retention, the compactor block and its retention_enabled pair, and the same
five loki workloads. tempo's manifest diff is an image bump, one newly-explicit
default, and upstream dropping the OpenCensus receiver port nothing here
enabled.
kx needs one real change, which is in that repo: the new loki chart mounts its
own emptyDir at /var/loki when persistence is off, so the workaround kx carried
for exactly that gap now produces two mounts on one path. `helm template` exits
0 on it. Only a per-container mountPath comparison sees it.
─── The check ───
scripts/check-chart-deprecation.py, split by what is and is not a function of
this commit:
offline, in the appsets job, BLOCKING — every pinned chart has a provenance
record and every record names a chart still pinned. Cannot change without
a commit, so it belongs in the merge path.
--live, on a weekly schedule — fetches all 30 pinned charts and fails on a
`deprecated: true` or a description that no longer matches its record.
The split matters. Whether upstream deprecated something overnight is not
something a pull request caused, and gating merges on it reddens changes that
are not at fault — the same reasoning that keeps mirror-check's freshness
question off the blocking path. It is also why the live half is its own
workflow: the merge gate refuses a workflow containing a job it does not watch
and counts a skipped dependency as failure, so a schedule-only job cannot live
in ci.yml.
Recording the description is what catches the loki class. Against the
pre-migration pins the live check reports both failures: tempo as deprecated,
and loki as having changed what it says it is. --self-test breaks the offline
gate five ways and fails unless each is rejected, with the shipped catalog as
the control.
The record sits in scripts/ rather than beside the pins because kubeconform
scans applicationsets/ and reads every file there as a manifest. Exempting it
would have meant weakening a schema gate to make room for a new file.
CI Results
All checks passed. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two charts moved. Only one of them said so.
tempo — flagged, easy to find
grafana/tempoisdeprecated: true, and its README names where it went:The community repo carries the full chart history rather than restarting — same chart, same single-binary topology, renumbered at the fork.
1.24.4→2.2.3, app2.9.0→2.10.7.tempo-distributedis not the successor. It was deprecated in the same move and lives in the community repo too.loki — the one nothing would have caught
The OSS chart moved to the same place, forked at 6.55.0. What stayed behind at
grafana/helm-chartsis now maintained for Grafana Enterprise Logs only:Its description literally reads
Helm chart for Grafana Enterprise Logs.... It carries no deprecation flag. The pin resolved, the chart installed, every gate stayed green, and Renovate kept offering 7.x patches. This catalog was tracking a different product, and the only field that had changed was the description.7.2.0→18.7.5(the OSS lineage, continuous from the fork point).Verification
Rendered both charts against the committed values, every environment, and compared:
TrueTrue/var/loki/compactor/var/loki/compactorfilesystemfilesystemv13 / filesystemv13 / filesystemlocal/var/tempo/traceslocal/var/tempo/tracestempo's whole manifest diff is the image bump, one newly-explicit default (
stream_over_http_enabled: false), and upstream dropping the OpenCensus receiver port that nothing here enabled.task validatepasses — 109 addon×env combinations rendered, 0 failed.kx needs one real change, in that repo. The new loki chart mounts its own emptyDir at
/var/lokiwhen persistence is off — precisely the gap kx's workaround existed to fill — so keeping the workaround gives the main container two mounts on one path, which the API server rejects.helm templateexits 0 on it; only a per-container mountPath comparison sees it. eks-gitops is unaffected because it uses a PVC.The check
scripts/check-chart-deprecation.py, split by what is and isn't a function of this commit:appsetsjob, blocking — every pinned chart has a provenance record and every record names a chart still pinned.--live, weekly schedule — fetches all 30 pinned charts, fails ondeprecated: trueor a description that no longer matches its record.That split is deliberate. Whether upstream deprecated something overnight is not something a PR caused, and gating merges on it reddens changes that aren't at fault — the same reasoning that keeps
mirror-check freshnessoff the blocking path. It's also why the live half is its own workflow: the merge gate refuses a workflow containing a job it doesn't watch, and counts a skipped dependency as failure, so a schedule-only job can't live inci.yml.Proof it catches the real thing
Run against the pre-migration pins:
Both actual failures, including the one with no flag.
--self-testbreaks the offline gate five ways and fails unless each is rejected, with the shipped catalog as a control.The record lives in
scripts/rather than beside the pins because kubeconform scansapplicationsets/and reads every file there as a manifest — it failed exactly that way on the first attempt. Exempting it would have meant weakening a schema gate to make room for a new file.