chore(observability): vendor kubernetes-event-exporter and drop the Bitnami source - #2075
Merged
Merged
Conversation
…itnami source The image already ran a community fork (ghcr.io/civitatis/kubernetes-event-exporter); only the chart itself still came from bitnami's OCI HelmRepository. Neither maintained fork chart (itakurah, ownkube) clears this repo's bar - one has no resources field and an unfixed template bug, the other is an unverified rewrite - and upstream ships no chart at all, so the chart's own rendered output is vendored as plain manifests instead. See ADR-0040. Closes the last item of #1089.
verify-doc-paths.sh failed on the ADR's backticked flux/sources/helmrepo-bitnami.yaml, deleted in the previous commit. Also: ownkube was never rendered/diffed (it's a rewrite, judged on source and maintenance record instead), Valkey and RabbitMQ are not "mid-migration" off Bitnami (Valkey is done per SPEC-012, RabbitMQ's only user was removed with grafana-oncall), the image tag is Renovate-tracked for the first time rather than merely "only" tracked, and logs.md still described chart values (metrics.enabled/serviceMonitor.enabled) that no longer exist.
…anges The exporter reads -conf once at startup with no file watcher, and vendoring the config as a plain ConfigMap (previous commit) dropped the HelmRelease's checksum/config annotation that used to force a new ReplicaSet on a config edit. Switch to Kustomize's configMapGenerator: its content-hashed name still rolls the pod, and the built-in name-reference transformer updates the Deployment's volume automatically. This is the repo's first configMapGenerator, noted inline.
Contributor
🔍 Rendered manifest diff — this PR vs
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The last Bitnami dependency was the
kubernetes-event-exporterchart; the image had already moved toghcr.io/civitatis/kubernetes-event-exporter. No maintained upstream chart exists, so this vendors the chart's rendered output as manifests the repo owns, and deletes thebitnamiHelmRepository. Closes #1089.ADR-0040 records the choice, and why the itakurah fork, the ownkube rewrite and staying on Bitnami each lost.
What changed
observability/base/kubernetes-event-exporter/now holds 8 plain manifests plusconfig.yaml, byte-identical to the Bitnami 3.6.3 render apart from the strippedhelm.sh/chart,managed-by: Helm,app.kubernetes.io/versionandchecksum/config. The Deployment selector matches the live one exactly (app.kubernetes.io/instance+name), so the immutable field can't wedge the apply.configMapGeneratordoes it now: the ConfigMap iskubernetes-event-exporter-<hash>, and the Deployment's volume follows the hash. It's the repo's first generator; a comment inkustomization.yamlsays why. FluxpostBuildsubstitution still applies, since it runs afterkustomize build.flux/sources/helmrepo-bitnami.yamlis deleted; nothing else referenced it.image.*values were read by no manager; thekubernetesmanager's.ya?mlglob covers the Deployment.Rollout: expect a gap of about 3 minutes on each cluster
On merge, kustomize-controller applies the plain objects, then prunes the HelmRelease. helm-controller then uninstalls the release, which deletes the same-named Deployment, Service, RBAC and so on. The Kustomization recreates them on its next interval, 3 minutes later. The generated ConfigMap's hashed name keeps it out of that race.
Events raised during the gap aren't exported, because the exporter drops events older than 5s at startup. Nothing reads this stream in real time: its only alert needs 15 minutes of errors, and no dashboard or LogsQL rule uses it. Running
flux reconcile ks observabilityright after the HelmRelease disappears closes the gap in seconds.A zero-gap handover needs a prior PR: either a
helm.sh/resource-policy: keeppostRenderer, which leaves stale Helm metadata behind, or suspending the release, which orphans the HelmChart and the release Secrets. Neither is worth it for a stateless exporter.After merge, on each cluster:
flux get ks observabilitykubectl -n observability get deploy kubernetes-event-exporter --show-labelsshould show no Helm labels.sh.helm.release.v1.kubernetes-event-exporter.*Secrets should be gone.Follow-ups, now that the repo owns these files
*/*, Secrets included. Narrow it, or setomitLookup.VMServiceScrape, the repo's convention (it already works through the operator's converter).Evidence
Run on this branch, rebased on
main@affdd50b:task ci:validateexits 0:Summary: 2101 resources found in 272 files - Valid: 2101, Invalid: 0, Skipped: 0, and "All gates passed" (Polaris 88).task ci:test:22 passed, 1 skipped, 0 failed.task ci:links,task ci:doc-paths, andtask ci:doc-claims(30/30) exit 0.kustomize build: the ConfigMap and the Deployment volume both namekubernetes-event-exporter-m4mhb72d8m, and${cluster_name}survives for postBuild.