Skip to content

HYPERFLEET-1363 - feat: add Grafana dashboard provisioning to Helm chart - #268

Open
Ruclo wants to merge 1 commit into
openshift-hyperfleet:mainfrom
Ruclo:HYPERFLEET-1363
Open

HYPERFLEET-1363 - feat: add Grafana dashboard provisioning to Helm chart#268
Ruclo wants to merge 1 commit into
openshift-hyperfleet:mainfrom
Ruclo:HYPERFLEET-1363

Conversation

@Ruclo

@Ruclo Ruclo commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

Why

Part of HYPERFLEET-1363 — unify observability values under monitoring: across all HyperFleet component charts and consolidate dashboard provisioning.

Note: This PR moves serviceMonitor under monitoring:. The infra repo (base-adapter.yaml.gotmpl) currently passes serviceMonitor.enabled at the top level — the corresponding infra PR must merge together with this one.

Changes

  • Move serviceMonitor and tracing under monitoring: section
  • Add configmap-dashboard.yaml for Grafana sidecar provisioning (grafana_dashboard: "1")
  • Default serviceMonitor.enabled to false (infra enables via helmfile)
  • Default sampler to parentbased_always_on
  • Update values.schema.json to match new paths
  • Update docs (metrics.md, configuration.md, deployment.md, runbook.md) and Makefile test commands

Test plan

  • make test-helm passes
  • Deploy with infra PR using OBSERVABILITY_ENABLED=true — dashboard appears in Grafana

@openshift-ci
openshift-ci Bot requested review from crizzo71 and jsell-rh August 5, 2026 11:11
@openshift-ci

openshift-ci Bot commented Aug 5, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign crizzo71 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@coderabbitai

coderabbitai Bot commented Aug 5, 2026

Copy link
Copy Markdown
📝 Walkthrough

Summary by CodeRabbit

  • New Features

    • Added conditional Grafana dashboard provisioning via the Helm chart.
  • Changes

    • Consolidated ServiceMonitor and tracing settings under monitoring.
    • ServiceMonitor provisioning is now disabled by default.
    • Updated tracing defaults to parentbased_always_on with an empty sampler argument, and tracing now uses standard OpenTelemetry environment configuration.
    • Bumped Helm chart version to 2.2.0.
  • Documentation

    • Updated configuration, deployment, metrics, and runbook/troubleshooting docs to use the new monitoring.* Helm value paths.

Walkthrough

The Helm chart nests ServiceMonitor and tracing values under monitoring. ServiceMonitor and dashboard provisioning are disabled by default. A conditional ConfigMap renders the Grafana dashboard. Tracing defaults use parentbased_always_on with an empty sampler argument. Telemetry now uses OpenTelemetry environment variables for sampler configuration. The chart version changes to 2.2.0.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant HelmValues
  participant HelmTemplates
  participant Kubernetes
  participant Grafana
  HelmValues->>HelmTemplates: Provide monitoring configuration
  HelmTemplates->>Kubernetes: Render ServiceMonitor and dashboard ConfigMap when enabled
  Kubernetes->>Grafana: Expose dashboard ConfigMap
Loading

Suggested reviewers: crizzo71, jsell-rh


Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error, 1 warning)

Check name Status Explanation Resolution
Sec-02: Secrets In Log Output ❌ Error CWE-532: production logs print arbitrary rendered API bodies at internal/executor/utils.go:151,172,193; dry-run fmt.Print also emits request/response and captured values. Redact or remove API URLs, bodies, responses, captured values, and templated log messages before slog/fmt.Print output; add regression tests for token/password fields.
Docstring Coverage ⚠️ Warning Docstring coverage is 40.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (9 passed)
Check name Status Explanation
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
No Hardcoded Secrets ✅ Passed No PR additions contain hardcoded credentials, private keys, secret assignments, embedded-credential URLs, or valid base64 strings over 32 characters; existing test/docs placeholders are excluded (...
No Weak Cryptography ✅ Passed The patch removes sampler code and adds no cryptography; tracked-source searches found no MD5, DES, RC4, SHA-1, ECB, custom crypto, or secret comparisons.
No Injection Vectors ✅ Passed PR-added lines contain no CWE-78 command execution, CWE-89 query construction, CWE-79 template.HTML, or CWE-502 yaml.Unmarshal pattern; dashboard input uses a hardcoded chart path.
No Privileged Containers ✅ Passed Production containers run as non-root UID 65532. Security contexts enforce allowPrivilegeEscalation: false, drop ALL capabilities, seccomp RuntimeDefault. No privileged:true, hostPID, hostNetwork,...
No Pii Or Sensitive Data In Logs ✅ Passed Full PR diff adds no logging calls; changed telemetry logs only exporter names, protocol, and shutdown status, with no PII, session IDs, bodies, or credential-bearing hostnames (CWE-532).
Title check ✅ Passed The title accurately identifies the primary change: adding Grafana dashboard provisioning to the Helm chart.
Description check ✅ Passed The description directly explains the observability configuration changes, dashboard provisioning, defaults, documentation updates, and test plan.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
✨ Simplify code
  • Create PR with simplified code

Comment @coderabbitai help to get the list of available commands.

@hyperfleet-ci-bot

hyperfleet-ci-bot Bot commented Aug 5, 2026

Copy link
Copy Markdown

Risk Score: 1 — risk/low

Signal Detail Points
PR size 349 lines (>200) +1
Sensitive paths none +0

Computed by hyperfleet-risk-scorer

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 7

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@charts/Chart.yaml`:
- Line 5: Update the chart version from 2.2.0 to 3.0.0 in Chart.yaml to mark the
serviceMonitor.* and tracing.* to monitoring.* values migration as a
backward-incompatible API change.

In `@charts/values.yaml`:
- Around line 368-372: Update the serviceMonitor.enabled description in
charts/values.yaml (lines 368-372) to state that it defaults to disabled, then
regenerate the chart documentation so charts/README.md (lines 130-131) reflects
the corrected description.

In `@docs/adapter-authoring-guide.md`:
- Line 1772: Update the RabbitMQ example in the adapter authoring guide to use
the chart’s exchangeType key under broker.rabbitmq instead of exchange_type.
Keep the surrounding example unchanged and align the documented configuration
with the key that the chart actually reads.
- Around line 1782-1785: Update the RabbitMQ configuration example near the
adapter deployment command to remove the password from the `broker.rabbitmq.url`
`--set` argument. Demonstrate referencing a Kubernetes Secret-backed chart value
for the RabbitMQ credential while preserving the existing broker URL and
deployment configuration.
- Line 1770: Update the RabbitMQ URL example in the adapter authoring guide to
use the amqps:// scheme, and document the required CA or client-certificate
configuration alongside it. Keep the existing host, port, credentials, and
virtual-host placeholders intact.

In `@docs/deployment.md`:
- Around line 340-343: Update the monitoring.tracing deployment example to use
an https:// OTLP endpoint and document the required CA settings for TLS
validation; do not leave the example using an unencrypted http:// endpoint.

In `@docs/metrics.md`:
- Line 7: Update the ServiceMonitor configuration comment in values.yaml near
monitoring.serviceMonitor to state that provisioning is disabled by default,
matching enabled: false and the documentation. Leave the configuration value and
other ServiceMonitor options unchanged.
🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 452b468f-1c92-4425-98ec-ef110a8cf2f3

📥 Commits

Reviewing files that changed from the base of the PR and between 4f1f579 and 98481e4.

📒 Files selected for processing (13)
  • Makefile
  • charts/Chart.yaml
  • charts/README.md
  • charts/templates/configmap-dashboard.yaml
  • charts/templates/deployment.yaml
  • charts/templates/servicemonitor.yaml
  • charts/values.schema.json
  • charts/values.yaml
  • docs/adapter-authoring-guide.md
  • docs/configuration.md
  • docs/deployment.md
  • docs/metrics.md
  • docs/runbook.md
🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

  • openshift-hyperfleet/architecture (manual)
  • openshift-hyperfleet/hyperfleet-api (manual)
  • openshift-hyperfleet/hyperfleet-sentinel (manual)
  • openshift-hyperfleet/hyperfleet-adapter (manual)
  • openshift-hyperfleet/hyperfleet-broker (manual)

Comment thread charts/Chart.yaml
description: HyperFleet Adapter - Event-driven adapter services for HyperFleet cluster provisioning
type: application
version: 2.1.0
version: 2.2.0

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift

Release this values API change as a major chart version.

This PR moves serviceMonitor.* and tracing.* under monitoring.*. Existing values files that use the old keys will silently stop enabling monitoring or tracing. Preserve the old keys with a compatibility shim, or release this change as 3.0.0 and document the migration. Semantic Versioning requires a major increment for backward-incompatible public API changes. (semver.org)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@charts/Chart.yaml` at line 5, Update the chart version from 2.2.0 to 3.0.0 in
Chart.yaml to mark the serviceMonitor.* and tracing.* to monitoring.* values
migration as a backward-incompatible API change.

Comment thread charts/values.yaml Outdated
Comment thread docs/adapter-authoring-guide.md Outdated
Comment thread docs/adapter-authoring-guide.md
Comment thread docs/adapter-authoring-guide.md Outdated
Comment thread docs/deployment.md
Comment thread docs/metrics.md
@Ruclo
Ruclo force-pushed the HYPERFLEET-1363 branch from 98481e4 to ecc9b38 Compare August 5, 2026 11:47
@coderabbitai

coderabbitai Bot commented Aug 5, 2026

Copy link
Copy Markdown

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

…ng section

Consolidate all observability configuration under a single monitoring:
section for consistency across HyperFleet charts.

- Move serviceMonitor and tracing from top-level to monitoring section
- Add configmap-dashboard.yaml for Grafana sidecar provisioning
- Default serviceMonitor.enabled to false (infra enables via helmfile)
- Default sampler to parentbased_always_on
@Ruclo
Ruclo force-pushed the HYPERFLEET-1363 branch from ecc9b38 to 3ca8958 Compare August 5, 2026 11:50

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@charts/README.md`:
- Line 130: Update the monitoring.serviceMonitor description in
charts/values.yaml to state that the ServiceMonitor defaults to disabled, then
regenerate charts/README.md so the documented description matches the
enabled:false default.
- Around line 129-148: The ServiceMonitor documentation has an incorrect default
description. Update the annotation for monitoring.serviceMonitor.enabled in
charts/values.yaml to state “Defaults to disabled,” then regenerate
charts/README.md so the generated description matches the false default.
🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 15c6be4a-ba8e-48a6-a98d-6199ec0a94a8

📥 Commits

Reviewing files that changed from the base of the PR and between 4f1f579 and ecc9b38.

📒 Files selected for processing (12)
  • Makefile
  • charts/Chart.yaml
  • charts/README.md
  • charts/templates/configmap-dashboard.yaml
  • charts/templates/deployment.yaml
  • charts/templates/servicemonitor.yaml
  • charts/values.schema.json
  • charts/values.yaml
  • docs/configuration.md
  • docs/deployment.md
  • docs/metrics.md
  • docs/runbook.md
🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

  • openshift-hyperfleet/architecture (manual)
  • openshift-hyperfleet/hyperfleet-api (manual)
  • openshift-hyperfleet/hyperfleet-sentinel (manual)
  • openshift-hyperfleet/hyperfleet-adapter (manual)
  • openshift-hyperfleet/hyperfleet-broker (manual)
🚧 Files skipped from review as they are similar to previous changes (9)
  • docs/configuration.md
  • charts/templates/deployment.yaml
  • charts/values.schema.json
  • Makefile
  • docs/deployment.md
  • docs/runbook.md
  • charts/Chart.yaml
  • docs/metrics.md
  • charts/values.yaml

Comment thread charts/README.md
Comment thread charts/README.md Outdated
@coderabbitai

coderabbitai Bot commented Aug 5, 2026

Copy link
Copy Markdown

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

@coderabbitai

coderabbitai Bot commented Aug 5, 2026

Copy link
Copy Markdown

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
pkg/telemetry/otel_test.go (1)

19-24: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

Clear sampler variables and test the SDK default.

clearOtelEnv leaves OTEL_TRACES_SAMPLER and OTEL_TRACES_SAMPLER_ARG unchanged. Add both variables to this helper, then add a case with both variables unset to verify the parentbased_always_on default.

Suggested change
 func clearOtelEnv(t *testing.T) {
 	t.Setenv(envOtelExporterOtlpEndpoint, "")
 	t.Setenv(envOtelExporterOtlpTracesEndpoint, "")
 	t.Setenv(envOtelExporterOtlpProtocol, "")
 	t.Setenv(envOtelExporterOtlpTracesProtocol, "")
+	t.Setenv("OTEL_TRACES_SAMPLER", "")
+	t.Setenv("OTEL_TRACES_SAMPLER_ARG", "")
 }

As per path instructions, new exported functions and critical logic paths SHOULD have tests.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/telemetry/otel_test.go` around lines 19 - 24, Update clearOtelEnv to
unset the OTEL_TRACES_SAMPLER and OTEL_TRACES_SAMPLER_ARG environment variables
alongside the existing OTEL settings. Add a test case covering both sampler
variables unset and verify the SDK applies the parentbased_always_on default.

Source: Path instructions

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@pkg/telemetry/otel_test.go`:
- Around line 19-24: Update clearOtelEnv to unset the OTEL_TRACES_SAMPLER and
OTEL_TRACES_SAMPLER_ARG environment variables alongside the existing OTEL
settings. Add a test case covering both sampler variables unset and verify the
SDK applies the parentbased_always_on default.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 2abfb4ab-6671-485c-aa46-a9dd4c940ab7

📥 Commits

Reviewing files that changed from the base of the PR and between 4f1f579 and 49d5e80.

📒 Files selected for processing (14)
  • Makefile
  • charts/Chart.yaml
  • charts/README.md
  • charts/templates/configmap-dashboard.yaml
  • charts/templates/deployment.yaml
  • charts/templates/servicemonitor.yaml
  • charts/values.schema.json
  • charts/values.yaml
  • docs/configuration.md
  • docs/deployment.md
  • docs/metrics.md
  • docs/runbook.md
  • pkg/telemetry/otel.go
  • pkg/telemetry/otel_test.go
🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

  • openshift-hyperfleet/architecture (manual)
  • openshift-hyperfleet/hyperfleet-api (manual)
  • openshift-hyperfleet/hyperfleet-sentinel (manual)
  • openshift-hyperfleet/hyperfleet-adapter (manual)
  • openshift-hyperfleet/hyperfleet-broker (manual)
🚧 Files skipped from review as they are similar to previous changes (11)
  • charts/templates/deployment.yaml
  • docs/runbook.md
  • charts/values.schema.json
  • docs/configuration.md
  • docs/metrics.md
  • pkg/telemetry/otel.go
  • charts/README.md
  • docs/deployment.md
  • charts/values.yaml
  • charts/Chart.yaml
  • Makefile

@Ruclo

Ruclo commented Aug 5, 2026

Copy link
Copy Markdown
Contributor Author

@coderabbitai resume

@coderabbitai

coderabbitai Bot commented Aug 5, 2026

Copy link
Copy Markdown
✅ Action performed

Reviews resumed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant