This note records the Helm pain surfaced during catalog review and where the current ConfigHub/cub installer proof absorbs it.
Support Boundary
| Field | Value |
|---|---|
| Catalog status | catalog-supported |
| Support level | supported-for-declared-scopes |
| Supported scopes | local-test |
| Production readiness | production-review-ready |
| Variants in this note | local-persistent, s3-query-observability |
Production support is not implied by this file. A chart can be supported for local proof/demo use while still needing accepted scan, gate, lifecycle, and operating-policy dispositions plus a final target-scoped support decision.
Chart Notes
- Chart.yaml marks this chart version deprecated, and the proof records that status.
- local-persistent uses local Tempo storage and explicit PVC settings.
- s3-query-observability switches to S3 storage, nulls local storage to avoid Helm merge residue, records endpoint/bucket/region in the base, and references S3 credentials from a target Secret.
- s3-query-observability adds Tempo Query ingress, NetworkPolicy, and ServiceMonitor behind explicit capability and policy checks; the ServiceMonitor CRD is recorded as a target fact.
- The chart StatefulSet references serviceName tempo-headless, but these variants render no headless Service; the proof records this as an upstream/runtime risk.
- config, structuredConfig, extra volumes/mounts, and tpl-controlled strings are powerful extension surfaces; promoted variants keep them controlled.
Catalog Mitigations
- Supported for local-test and proof-demo usage through real cub installer and ConfigHub receipts.
- local-persistent is the simplest local Tempo path, with storage/runtime caveats recorded for review.
- s3-query-observability is supported when the S3 endpoint, bucket, region, credential Secret, and Prometheus Operator ServiceMonitor API are staged for the target.
- Chart deprecation, storage/backup/rollback policy, target facts, extension slots, runtime service risk, and scan/gate warnings are recorded as production review input.
- Production recommendation remains a separate decision; the final decision should choose the maintained successor chart or explicit legacy support and target runtime checks.
Control Points
| Control point | Status | Mitigation / evidence | |||
|---|---|---|---|---|---|
| source-lock | handled | source-lock.yaml | |||
| dependency-lock | handled | chart declares no subchart dependencies; the empty closure is recorded explicitly. | |||
| capability-profile | handled | Kubernetes API and version branches are bound to the named Kubernetes capability profile. | |||
| chart-deprecation | noted | The literal grafana/tempo chart is deprecated; the proof records that status and notes the maintained successor chart separately. | |||
| target-facts | variant-controlled | The s3-query-observability variant declares S3 endpoint, bucket, and region as pre-render values, and references credentials from a target Secret instead of embedding access keys in rendered ConfigMaps. | |||
| object-store-runtime-prerequisite | target-fact-required | The S3 variant needs the declared endpoint, bucket, region, and credentials to be real before Tempo becomes ready; the strict live parity lane stages a local S3-compatible target prerequisite. | |||
| capability-profile | variant-controlled | The ServiceMonitor variant records the Prometheus Operator API as an explicit target capability. | |||
| servicemonitor-crd-target-fact | target-fact | The Tempo chart renders a ServiceMonitor when the API is declared, but the Prometheus Operator CRD must already exist in the target cluster. | |||
| stateful-workload | scan-and-review | apps/v1\ | StatefulSet\ | tempo\ | tempo |
| query-ingress-policy | variant-controlled | networking.k8s.io/v1\ | Ingress\ | tempo\ | tempo |
| network-policy | scan-and-review | networking.k8s.io/v1\ | NetworkPolicy\ | tempo\ | tempo |
| servicemonitor-capability | variant-controlled | monitoring.coreos.com/v1\ | ServiceMonitor\ | tempo\ | tempo |
| upstream-runtime-risk | scan-and-review | The chart StatefulSet references serviceName tempo-headless, but the chart renders no headless Service in these variants. | |||
| extension-slots | controlled-by-empty-defaults | config, structuredConfig, extra volume/mount, and tpl-controlled strings are controlled in promoted variants. | |||
| installer-support-object | handled | v1\ | Namespace\ | \ | tempo |
Control Point Index
- capability-profile
- chart-deprecation
- dependency-lock
- extension-slots
- installer-support-object
- network-policy
- object-store-runtime-prerequisite
- query-ingress-policy
- raw-template-extension-slots
- servicemonitor-capability
- servicemonitor-crd-target-fact
- source-lock
- stateful-workload
- statefulset-runtime-risk
- storage-backend-policy
- target-facts
- upstream-runtime-risk
Proof Links
- Catalog map: CATALOG.md
- Machine index: artifact-index.yaml
- Helm plan: helm-plan.yaml
- Control points: control-points.yaml
- Chart dossier: chart-dossier.yaml