Skip to content

Commit 8854a54

Browse files
scooby87scooby87
committed
Address review: couple tracingCollector.backend to tracingCentral
The Tenant's tracingCentral (which renders the Cilium egress rule) and the monitoring chart's tracingCollector.backend=central (which makes the collector export cross-boundary) were set independently, so backend=central with tracingCentral=false left the collector exporting to tenant-root's vtinsert while the tenant sat in default-deny egress with no allow rule — every span silently dropped at the network layer (the #3181 silent-loss class). Make tracingCentral the single source of truth: the tenant monitoring HelmRelease now derives tracingCollector.backend from it via inline spec.values, in both directions. Inline values are merged last by Flux and win over the cozystack-values Secret, so a backend set directly in the Monitoring app config cannot re-introduce the divergence — central is reachable only with the egress rule, and clearing tracingCentral forces the collector back to local. Add a helm-unittest suite pinning both directions plus the monitoring-off case; mutation-verified (forcing backend=central reds the local-forcing case). Signed-off-by: Alexey Artamonov <[email protected]>
1 parent ea425df commit 8854a54

2 files changed

Lines changed: 79 additions & 0 deletions

File tree

‎packages/apps/tenant/templates/monitoring.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,23 @@ spec:
6161
retryInterval: 30s
6262
remediation:
6363
retries: -1
64+
{{- /* Shared-central tracing couples two settings that must never diverge: the
65+
collector must export cross-boundary (tracingCollector.backend=central)
66+
AND this tenant must carry the Cilium egress rule that permits the hop to
67+
tenant-root's vtinsert (templates/networkpolicy-traces-central.yaml, also
68+
gated on tracingCentral). If they split — backend=central without the
69+
egress rule — every span is silently dropped at the network layer, the
70+
same #3181 silent-loss class this stack treats as blocking. So make
71+
tracingCentral the single source of truth: derive the collector backend
72+
from it here, in both directions. Inline spec.values is merged last and
73+
wins over the cozystack-values Secret, so a backend set directly in the
74+
Monitoring app config cannot re-introduce the divergence — central is
75+
reachable only with the egress rule, and clearing tracingCentral forces
76+
the collector back to local. Flux deep-merges maps, so only .backend is
77+
overridden; enabled/replicas/samplingPercentage from the Secret stay. */}}
78+
values:
79+
tracingCollector:
80+
backend: {{ ternary "central" "local" .Values.tracingCentral }}
6481
valuesFrom:
6582
- kind: Secret
6683
name: cozystack-values

‎packages/apps/tenant/tests/monitoring_tracing_backend_coupling_test.yaml‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
suite: shared-central tracing couples the collector backend to tracingCentral
2+
# The collector's export target (tracingCollector.backend) and the Cilium egress
3+
# rule that permits the cross-boundary hop (networkpolicy-traces-central.yaml)
4+
# must never diverge: backend=central without the egress rule silently drops
5+
# every span at the network layer (the #3181 silent-loss class). tracingCentral
6+
# is the single source of truth — the monitoring HelmRelease derives backend
7+
# from it via inline spec.values, which Flux merges over the cozystack-values
8+
# Secret so a backend set directly in the Monitoring app config cannot
9+
# re-introduce the mismatch. These cases pin both directions.
10+
#
11+
# Restrict rendering to the two coupled templates so an unrelated template
12+
# (e.g. keycloakgroups.yaml, which errors on the platform-injected .Values._cluster
13+
# this suite has no reason to set) cannot fail the suite.
14+
templates:
15+
- templates/monitoring.yaml
16+
- templates/networkpolicy-traces-central.yaml
17+
18+
release:
19+
name: tenant-ktj
20+
namespace: tenant-root
21+
22+
tests:
23+
- it: forces backend=local when tracingCentral is unset (no cross-boundary export without the egress rule)
24+
set:
25+
monitoring: true
26+
asserts:
27+
- template: templates/monitoring.yaml
28+
equal:
29+
path: spec.values.tracingCollector.backend
30+
value: local
31+
# ...and the egress rule is correspondingly absent.
32+
- template: templates/networkpolicy-traces-central.yaml
33+
containsDocument:
34+
apiVersion: cilium.io/v2
35+
kind: CiliumClusterwideNetworkPolicy
36+
name: tenant-ktj-egress-traces-central
37+
not: true
38+
39+
- it: derives backend=central when tracingCentral is set, alongside the egress rule
40+
set:
41+
monitoring: true
42+
tracingCentral: true
43+
asserts:
44+
- template: templates/monitoring.yaml
45+
equal:
46+
path: spec.values.tracingCollector.backend
47+
value: central
48+
# ...and the egress rule that authorises the central hop renders in lockstep.
49+
- template: templates/networkpolicy-traces-central.yaml
50+
containsDocument:
51+
apiVersion: cilium.io/v2
52+
kind: CiliumClusterwideNetworkPolicy
53+
name: tenant-ktj-egress-traces-central
54+
55+
- it: no monitoring release means no backend to diverge (monitoring off)
56+
set:
57+
monitoring: false
58+
tracingCentral: true
59+
asserts:
60+
- template: templates/monitoring.yaml
61+
hasDocuments:
62+
count: 0

0 commit comments

Comments
 (0)