Skip to content

harden(recipes): direct dependencyRefs from monitoring-CR creators to prometheus-operator-crds #928

Description

@mchmarny

Summary

After #926 split prometheus-operator-crds out as its own release, several components that create monitoring.coreos.com/v1 CRs (PodMonitor / ServiceMonitor / etc.) rely on a multi-hop transitive dependency path rather than declaring a direct dependencyRefs edge. This is brittle.

Concrete example

nvsentinel's registry comment at recipes/registry.yaml:258-264 documents the chain:

nvsentinel depends on gpu-operator, which depends on kube-prometheus-stack, which depends on prometheus-operator-crds

If anyone removes the gpu-operator → kube-prometheus-stack edge in recipes/overlays/base.yaml — plausible since gpu-operator doesn't strictly need kube-prometheus-stack to install, only to scrape metrics — the helm-diff race on nvsentinel's PodMonitor CRD silently returns. No CI test catches it; the failure surfaces only on a fresh-cluster helmfile apply.

Why this matters

The whole thesis of #926 is "let dependencyRefs encode the ordering" — applying that consistently means every component whose templates create monitoring CRs should declare prometheus-operator-crds as a direct dependencyRefs entry. The DAG-flattening makes the extra edge a no-op when the transitive path already exists, but it survives refactors of intermediate nodes.

Acceptance Criteria

  • Audit recipes/overlays/, recipes/mixins/, and recipes/components/*/values.yaml for charts whose templates emit monitoring.coreos.com/v1 resources (PodMonitor, ServiceMonitor, Alertmanager, AlertmanagerConfig, Prometheus, PrometheusRule, Probe, ThanosRuler).
  • Add direct dependencyRefs: [prometheus-operator-crds] to each such component in recipes/overlays/base.yaml (in addition to any existing edges).
  • Update the nvsentinel registry comment in recipes/registry.yaml to remove the "transitively satisfied" wording once the direct edge is in place.
  • Consider a chainsaw or Go test that asserts every component declaring a monitoring.coreos.com/v1 CR (detectable by grepping rendered chart output) has prometheus-operator-crds reachable in its dependencyRefs closure.

Related

Metadata

Metadata

Assignees

Fields

No fields configured for Enhancement.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions