# grafana/tempo 1.24.4 Weirdness And Mitigations This note records the Helm pain surfaced during catalog review and where the current ConfigHub/cub installer proof absorbs it. ## Support Boundary | Field | Value | | --- | --- | | Catalog status | catalog-supported | | Support level | supported-for-declared-scopes | | Supported scopes | local-test | | Production readiness | production-review-ready | | Variants in this note | local-persistent, s3-query-observability | Production support is not implied by this file. A chart can be supported for local proof/demo use while still needing accepted scan, gate, lifecycle, and operating-policy dispositions plus a final target-scoped support decision. ## Chart Notes - Chart.yaml marks this chart version deprecated, and the proof records that status. - local-persistent uses local Tempo storage and explicit PVC settings. - s3-query-observability switches to S3 storage, nulls local storage to avoid Helm merge residue, records endpoint/bucket/region in the base, and references S3 credentials from a target Secret. - s3-query-observability adds Tempo Query ingress, NetworkPolicy, and ServiceMonitor behind explicit capability and policy checks; the ServiceMonitor CRD is recorded as a target fact. - The chart StatefulSet references serviceName tempo-headless, but these variants render no headless Service; the proof records this as an upstream/runtime risk. - config, structuredConfig, extra volumes/mounts, and tpl-controlled strings are powerful extension surfaces; promoted variants keep them controlled. ## Catalog Mitigations - Supported for local-test and proof-demo usage through real cub installer and ConfigHub receipts. - local-persistent is the simplest local Tempo path, with storage/runtime caveats recorded for review. - s3-query-observability is supported when the S3 endpoint, bucket, region, credential Secret, and Prometheus Operator ServiceMonitor API are staged for the target. - Chart deprecation, storage/backup/rollback policy, target facts, extension slots, runtime service risk, and scan/gate warnings are recorded as production review input. - Production recommendation remains a separate decision; the final decision should choose the maintained successor chart or explicit legacy support and target runtime checks. ## Control Points | Control point | Status | Mitigation / evidence | | --- | --- | --- | | source-lock | handled | source-lock.yaml | | dependency-lock | handled | chart declares no subchart dependencies; the empty closure is recorded explicitly. | | capability-profile | handled | Kubernetes API and version branches are bound to the named Kubernetes capability profile. | | chart-deprecation | noted | The literal grafana/tempo chart is deprecated; the proof records that status and notes the maintained successor chart separately. | | target-facts | variant-controlled | The s3-query-observability variant declares S3 endpoint, bucket, and region as pre-render values, and references credentials from a target Secret instead of embedding access keys in rendered ConfigMaps. | | object-store-runtime-prerequisite | target-fact-required | The S3 variant needs the declared endpoint, bucket, region, and credentials to be real before Tempo becomes ready; the strict live parity lane stages a local S3-compatible target prerequisite. | | capability-profile | variant-controlled | The ServiceMonitor variant records the Prometheus Operator API as an explicit target capability. | | servicemonitor-crd-target-fact | target-fact | The Tempo chart renders a ServiceMonitor when the API is declared, but the Prometheus Operator CRD must already exist in the target cluster. | | stateful-workload | scan-and-review | apps/v1\|StatefulSet\|tempo\|tempo | | query-ingress-policy | variant-controlled | networking.k8s.io/v1\|Ingress\|tempo\|tempo | | network-policy | scan-and-review | networking.k8s.io/v1\|NetworkPolicy\|tempo\|tempo | | servicemonitor-capability | variant-controlled | monitoring.coreos.com/v1\|ServiceMonitor\|tempo\|tempo | | upstream-runtime-risk | scan-and-review | The chart StatefulSet references serviceName tempo-headless, but the chart renders no headless Service in these variants. | | extension-slots | controlled-by-empty-defaults | config, structuredConfig, extra volume/mount, and tpl-controlled strings are controlled in promoted variants. | | installer-support-object | handled | v1\|Namespace\|\|tempo | ## Control Point Index - capability-profile - chart-deprecation - dependency-lock - extension-slots - installer-support-object - network-policy - object-store-runtime-prerequisite - query-ingress-policy - raw-template-extension-slots - servicemonitor-capability - servicemonitor-crd-target-fact - source-lock - stateful-workload - statefulset-runtime-risk - storage-backend-policy - target-facts - upstream-runtime-risk ## Proof Links - Catalog map: [CATALOG.md](CATALOG.md) - Machine index: [artifact-index.yaml](artifact-index.yaml) - Helm plan: [helm-plan.yaml](helm-plan.yaml) - Control points: [control-points.yaml](control-points.yaml) - Chart dossier: [chart-dossier.yaml](chart-dossier.yaml)