charts/avalanche 0.10.0: namespace-scoped observer RBAC + pod-recording filter (QA-1057) by matt-snowplow · Pull Request #345 · snowplow-devops/helm-charts

Matt Banbury (matt-snowplow) · 2026-07-15T13:49:05Z

Syncs the avalanche chart from qa-helm-charts (QA-811 staging repo) into canonical helm-charts. QA-1057.

Changes (chart 0.8.0 → 0.10.0)

observerKubernetes.rbac.scope: cluster | namespace — in namespace mode the chart emits a namespaced Role/RoleBinding (dropping the cluster-only nodes/namespaces/metrics.k8s.io/nodes rules the observer never reads) and forces config.namespace to the release namespace, instead of the cluster-scoped ClusterRole/ClusterRoleBinding. Least-privilege.
observerKubernetes.config.podNameInclude / podNameExclude — the API (Kubernetes) observer records only matching pods. On a shared namespace (DS4's com-snplow-qa-aws-prod1) this limits recording to the pipeline-under-test + co-located avalanche pods instead of every pod — parity with the CloudWatch observer (QA-1047).

Compatibility

Defaults (cluster scope, empty podNameInclude) render byte-for-byte the previous 0.8.0 output — existing consumers unaffected.
The podNameInclude filter is implemented in the observer binary; requires avalanche observer image ≥ v0.9.0.

Verification

Both features verified end-to-end on DS4 (chart staged via qa-helm-charts 0.9.0/0.10.0 + the v0.9.0 observer image): namespaced Role created with 0 forbidden errors, and Timestream recorded only the run's pods. helm lint clean; cluster-mode render diff vs 0.8.0 is empty (bar the version label).

Repo CHANGELOG: 0.3.46.

🤖 Generated with Claude Code

…ng filter (QA-1057) Sync from qa-helm-charts (QA-811 staging). Two additions: - observerKubernetes.rbac.scope: cluster | namespace — namespace mode emits a namespaced Role/RoleBinding (dropping cluster-only nodes/namespaces/ metrics.k8s.io-nodes rules) + forces config.namespace to the release namespace, instead of the cluster-scoped ClusterRole/ClusterRoleBinding. - observerKubernetes.config.podNameInclude / podNameExclude — the API observer records only matching pods (parity with the CloudWatch observer, QA-1047). Defaults unchanged (cluster scope, empty include). podNameInclude needs the avalanche observer image >= v0.9.0. Repo CHANGELOG: 0.3.46. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Updates the charts/avalanche Helm chart to support least-privilege, namespace-scoped RBAC for the Kubernetes API observer and adds pod-name include/exclude filters to limit which pods are recorded during test runs.

Changes:

Add observerKubernetes.rbac.scope (cluster|namespace) and render Role/RoleBinding in namespace scope (otherwise keep ClusterRole/ClusterRoleBinding).
Force the API observer config.namespace to .Release.Namespace when RBAC is namespace-scoped.
Add observerKubernetes.config.podNameInclude / podNameExclude and emit these into the observer configmap when set.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
charts/avalanche/values.yaml	Adds new values for RBAC scoping and pod recording filters; updates chart docs/comments.
charts/avalanche/templates/observer-kubernetes-rbac.yaml	Implements namespace-scoped RBAC output (Role/RoleBinding) alongside existing cluster-scoped RBAC.
charts/avalanche/templates/configmap.yaml	Forces namespace in namespace-scope mode and passes pod include/exclude config to the observer.
charts/avalanche/Chart.yaml	Bumps chart version to 0.10.0.
CHANGELOG	Adds release note entry for 0.3.46 documenting the avalanche chart update.

Comments suppressed due to low confidence (1)

charts/avalanche/values.yaml:678

The API observer comment still says it "Requires the ClusterRole". With observerKubernetes.rbac.scope=namespace, the chart now renders a namespaced Role/RoleBinding instead, so this comment is now inaccurate.

    # Native Kubernetes API observer: reads pod / deployment / event / resource
    # metrics from the in-cluster K8s API + metrics-server. Requires the
    # ClusterRole defined in observer-kubernetes-rbac.yaml.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Matt Banbury (matt-snowplow) · 2026-07-16T06:24:21Z

 {{- if .Values.observerKubernetes.api.enabled }}
+{{- if eq (.Values.observerKubernetes.rbac.scope | default "cluster") "namespace" }}
+---


Done in 1683748 — removed the pkg/observer/kubernetes reference from the comment.

…avalanche-repo path from comment - fail-fast on any observerKubernetes.rbac.scope other than "cluster"/"namespace" so a typo can't silently fall back to broader cluster-scoped RBAC. - remove the pkg/observer/kubernetes reference (an avalanche-repo path) from the namespace-RBAC comment; it doesn't exist in this repo. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

…review Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

charts/avalanche/values.yaml:678

The comment under observerKubernetes.api still says the API observer “Requires the ClusterRole…”, but with observerKubernetes.rbac.scope: namespace the chart now renders a namespaced Role/RoleBinding instead. Updating this avoids misleading operators when they switch scopes.

    # Native Kubernetes API observer: reads pod / deployment / event / resource
    # metrics from the in-cluster K8s API + metrics-server. Requires the
    # ClusterRole defined in observer-kubernetes-rbac.yaml.

Matt Banbury (matt-snowplow) · 2026-07-16T07:11:50Z

@@ -1,3 +1,7 @@
+Version 0.3.46 (2026-07-15)
+---------------------------
+charts/avalanche-0.10.0: Scope the Kubernetes observer to the pods under test (QA-1057). Adds observerKubernetes.rbac.scope (cluster|namespace): in namespace mode the chart emits a namespaced Role/RoleBinding (dropping the cluster-only nodes / namespaces / metrics.k8s.io/nodes rules the observer never uses) and forces config.namespace to the release namespace, instead of the cluster-scoped ClusterRole/ClusterRoleBinding — least-privilege. Also adds observerKubernetes.config.podNameInclude / podNameExclude so the API observer records only matching pods: on a shared namespace (e.g. com-snplow-qa-aws-prod1) this limits recording to the pipeline-under-test and co-located avalanche pods instead of every pod, parity with the CloudWatch observer (QA-1047). Defaults (cluster scope, empty include) are byte-for-byte the previous behaviour; the podNameInclude filter requires the avalanche observer image >= v0.9.0. (QA-1057)


Fixed — dropped the duplicate opening reference; kept the single trailing (QA-1057) to match the surrounding entries.

…eview) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

charts/avalanche/values.yaml:678

The comment under observerKubernetes.api still says the API observer “requires the ClusterRole”, but with the new observerKubernetes.rbac.scope=namespace path the chart emits a namespaced Role/RoleBinding instead. This is now misleading for chart users choosing least-privilege mode.

    # Native Kubernetes API observer: reads pod / deployment / event / resource
    # metrics from the in-cluster K8s API + metrics-server. Requires the
    # ClusterRole defined in observer-kubernetes-rbac.yaml.

…pe (PR #345 review) The observerKubernetes.api comment said "Requires the ClusterRole"; with rbac.scope=namespace the chart emits a namespaced Role/RoleBinding instead. Reworded to cover both scopes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Matt Banbury (matt-snowplow) · 2026-07-16T07:28:49Z

Addressed the low-confidence suppressed comment on values.yaml:678 in 0aa9c87 — the observerKubernetes.api comment now covers both RBAC modes (ClusterRole/ClusterRoleBinding for rbac.scope=cluster, namespaced Role/RoleBinding for rbac.scope=namespace) instead of only mentioning the ClusterRole.

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

Snowplow CLA bot (snowplowcla) added the cla:yes label Jul 15, 2026

Matt Banbury (matt-snowplow) requested a review from Copilot July 15, 2026 13:52

Copilot started reviewing on behalf of Matt Banbury (matt-snowplow) July 15, 2026 13:52 View session

Copilot AI reviewed Jul 15, 2026

View reviewed changes

Matt Banbury (matt-snowplow) requested a review from Copilot July 16, 2026 06:28

Copilot started reviewing on behalf of Matt Banbury (matt-snowplow) July 16, 2026 06:28 View session

Copilot AI reviewed Jul 16, 2026

View reviewed changes

Comment thread CHANGELOG Outdated

charts/avalanche: fix CHANGELOG typo (metrics.k8s.io/nodes) — PR #345 …

fdcab64

…review Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Matt Banbury (matt-snowplow) requested a review from Copilot July 16, 2026 07:00

Copilot started reviewing on behalf of Matt Banbury (matt-snowplow) July 16, 2026 07:00 View session

Matt Banbury (matt-snowplow) marked this pull request as draft July 16, 2026 07:02

Copilot AI reviewed Jul 16, 2026

View reviewed changes

charts/avalanche: CHANGELOG — drop duplicate (QA-1057) ref (PR #345 r…

443b2e9

…eview) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Matt Banbury (matt-snowplow) requested a review from Copilot July 16, 2026 07:15

Copilot started reviewing on behalf of Matt Banbury (matt-snowplow) July 16, 2026 07:15 View session

Copilot AI reviewed Jul 16, 2026

View reviewed changes

Matt Banbury (matt-snowplow) requested a review from Copilot July 16, 2026 07:27

Copilot started reviewing on behalf of Matt Banbury (matt-snowplow) July 16, 2026 07:28 View session

Copilot AI reviewed Jul 16, 2026

View reviewed changes

Matt Banbury (matt-snowplow) marked this pull request as ready for review July 16, 2026 08:49

Matt Banbury (matt-snowplow) requested a review from armin-snowplow July 16, 2026 08:49

armin-snowplow approved these changes Jul 16, 2026

View reviewed changes

Andy Hay (Andy-Hay) approved these changes Jul 16, 2026

View reviewed changes

Andy Hay (Andy-Hay) merged commit d8733b5 into main Jul 16, 2026
8 checks passed

Andy Hay (Andy-Hay) deleted the QA-1057 branch July 16, 2026 21:19

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

charts/avalanche 0.10.0: namespace-scoped observer RBAC + pod-recording filter (QA-1057) - #345

charts/avalanche 0.10.0: namespace-scoped observer RBAC + pod-recording filter (QA-1057)#345
Andy Hay (Andy-Hay) merged 5 commits into
mainfrom
QA-1057

Matt Banbury (matt-snowplow) commented Jul 15, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Matt Banbury (matt-snowplow) Jul 16, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Matt Banbury (matt-snowplow) Jul 16, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Matt Banbury (matt-snowplow) commented Jul 16, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

Matt Banbury (matt-snowplow) commented Jul 15, 2026

Changes (chart 0.8.0 → 0.10.0)

Compatibility

Verification

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Matt Banbury (matt-snowplow) Jul 16, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Matt Banbury (matt-snowplow) Jul 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Matt Banbury (matt-snowplow) commented Jul 16, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants