apiVersion: "helm-expt.confighub.com/v1alpha1"
kind: "TargetPrerequisitePlan"
metadata:
  name: "grafana-tempo-1.24.4"
  chart: "grafana/tempo"
  version: "1.24.4"
spec:
  summary: "The s3-query-observability base is render-equivalent, but it is only target-ready when object storage, S3 credentials, the ServiceMonitor CRD, and query ingress policy are staged and observed."
  bases:
    localPersistent:
      status: "self-contained-for-local-proof"
      note: "The local-persistent base uses local single-binary storage, explicit PVC settings, and the standard StorageClass for the local proof target."
    s3QueryObservability:
      status: "target-prerequisite-needed"
      requiredBeforeRender:
        -
          kind: "Value"
          path: "tempo.storage.trace.s3.endpoint"
          purpose: "S3-compatible endpoint Tempo will write traces to"
        -
          kind: "Value"
          path: "tempo.storage.trace.s3.bucket"
          purpose: "Existing object-store bucket for trace blocks"
        -
          kind: "Value"
          path: "tempo.storage.trace.s3.region"
          purpose: "Region used with the selected endpoint and bucket"
        -
          kind: "API"
          name: "monitoring.coreos.com/v1"
          purpose: "Renders the ServiceMonitor object only when the target capability is declared"
      requiredBeforeApply:
        -
          kind: "Secret"
          namespace: "tempo"
          name: "tempo-s3-credentials"
          keys:
            - "access_key"
            - "secret_key"
          purpose: "Credentials referenced by Tempo environment variables"
        -
          kind: "CRD"
          name: "servicemonitors.monitoring.coreos.com"
          purpose: "Target must accept the rendered ServiceMonitor object"
        -
          kind: "ExternalService"
          name: "tempo-object-store"
          purpose: "S3-compatible endpoint and bucket must exist and accept the declared credentials"
      mustObserve:
        - "StatefulSet tempo/tempo is available after object-store credentials are staged"
        - "PVC for tempo storage is Bound"
        - "Tempo can write to the configured endpoint and bucket"
        - "ServiceMonitor tempo/tempo is accepted by the Prometheus Operator target"
        - "query ingress policy matches the target ingress controller and hostname"
      requiredReceipts:
        - "target-fact-receipt"
        - "secret-preflight-receipt"
        - "object-store-preflight-receipt"
        - "servicemonitor-crd-receipt"
        - "runtime-observation-receipt"
  notProvenBy:
    - "render parity alone"
    - "endpoint, bucket, region, or credentials without a reachable object-store service"
    - "a Secret with the expected name but no object-store access"
    - "a ServiceMonitor object without the target CRD and operator behavior"
    - "one local filesystem proof of the local-persistent base"