CP-37371: Use distroless Prometheus image by default

helm/Chart.yaml

@@ -8,7 +8,7 @@ kubeVersion: ">= 1.21.0-0"
 maintainers:
   - name: CloudZero
     email: support@cloudzero.com
-appVersion: "v3.7.3"
+appVersion: "v3.10.0"
 dependencies:
   - name: kube-state-metrics
     version: "5.36.*"

helm/templates/_helpers.tpl

@@ -1389,6 +1389,23 @@ prometheus.yml
 {{- end -}}
 {{- end -}}
 
+{{/*
+Resolve the Prometheus image tag.
+
+Resolves the tag from components.prometheus.image.tag, falling back to
+Chart.AppVersion with "-distroless" appended to use the official distroless
+image variant (no shell, minimal attack surface).
+
+Note: the deprecated server.image.tag compat override is handled by
+generateImage's compat layer at the call site, not here.
+
+Usage: {{ include "cloudzero-agent.Values.components.prometheus.image.tag" . }}
+Returns: string (e.g., "v3.10.0-distroless", "v3.7.3")
+*/}}
+{{- define "cloudzero-agent.Values.components.prometheus.image.tag" -}}
+  {{- .Values.components.prometheus.image.tag | default (printf "%s-distroless" .Chart.AppVersion) -}}
+{{- end -}}
+
 {{/*
 Get the appropriate Prometheus agent mode flag based on version and mode
 
@@ -1401,17 +1418,16 @@ The cloudzero-agent.Values.components.agent.mode helper already handles all the
 complex mode derivation logic, so we just check if it returns "agent" or "federated"
 and then determine the appropriate version-specific flag.
 
-Uses the same tag fallback chain as image generation:
-server.image.tag -> components.prometheus.image.tag -> Chart.AppVersion
+Uses the same tag fallback chain as image generation via
+cloudzero-agent.Values.components.prometheus.image.tag
 
 Usage: {{ include "cloudzero-agent.prometheusAgentFlag" . }}
 Returns: string (either "--agent", "--enable-feature=agent", or empty string)
 */}}
 {{- define "cloudzero-agent.prometheusAgentFlag" -}}
   {{- $mode := include "cloudzero-agent.Values.components.agent.mode" . -}}
   {{- if or (eq $mode "agent") (eq $mode "federated") -}}
-    {{- /* Use same fallback chain as image generation: server.image.tag -> components.prometheus.image.tag -> Chart.AppVersion */ -}}
-    {{- $tag := .Values.server.image.tag | default .Values.components.prometheus.image.tag | default .Chart.AppVersion -}}
+    {{- $tag := include "cloudzero-agent.Values.components.prometheus.image.tag" . -}}
     {{- if hasPrefix "v2." $tag -}}
       --enable-feature=agent
     {{- else -}}

helm/templates/agent-daemonset.yaml

@@ -127,8 +127,7 @@ spec:
               readOnly: true
         {{- end }}
         - name: {{ template "cloudzero-agent.name" . }}-server
-          {{/* This is a little special because we want to fall back on the .Chart.AppVersion */}}
-          {{- include "cloudzero-agent.generateImage" (dict "defaults" .Values.defaults.image "image" .Values.components.prometheus.image "compat" (dict "repository" .Values.server.image.repository "tag" (.Values.server.image.tag | default .Values.components.prometheus.image.tag | default .Chart.AppVersion) "digest" .Values.server.image.digest "pullPolicy" .Values.server.image.pullPolicy)) | nindent 10 }}
+          {{- include "cloudzero-agent.generateImage" (dict "defaults" .Values.defaults.image "image" .Values.components.prometheus.image "compat" (dict "repository" .Values.server.image.repository "tag" (include "cloudzero-agent.Values.components.prometheus.image.tag" .) "digest" .Values.server.image.digest "pullPolicy" .Values.server.image.pullPolicy)) | nindent 10 }}
           env:
             - name: NODE_NAME
               valueFrom:
@@ -145,6 +144,9 @@ spec:
             {{- $agentFlag := include "cloudzero-agent.prometheusAgentFlag" . }}
             {{- if $agentFlag }}
             - {{ $agentFlag }}
+            - --storage.agent.path=/data
+            {{- else }}
+            - --storage.tsdb.path=/data
             {{- end }}
           ports:
             - containerPort: 9090

helm/templates/agent-deploy.yaml

@@ -153,8 +153,14 @@ spec:
         {{- if ne (include "cloudzero-agent.Values.components.agent.mode" .) "clustered" }}
         # Prometheus server container
         - name: {{ template "cloudzero-agent.name" . }}-server
-          {{/* This is a little special because we want to fall back on the .Chart.AppVersion */}}
-          {{- include "cloudzero-agent.generateImage" (dict "defaults" .Values.defaults.image "image" .Values.components.prometheus.image "compat" (dict "repository" .Values.server.image.repository "tag" (.Values.server.image.tag | default .Values.components.prometheus.image.tag | default .Chart.AppVersion) "digest" .Values.server.image.digest "pullPolicy" .Values.server.image.pullPolicy)) | nindent 10 }}
+          {{- include "cloudzero-agent.generateImage" (dict
+            "defaults" .Values.defaults.image
+            "image" .Values.components.prometheus.image
+            "compat" (dict
+              "repository" .Values.server.image.repository
+              "tag" (include "cloudzero-agent.Values.components.prometheus.image.tag" .)
+              "digest" .Values.server.image.digest
+              "pullPolicy" .Values.server.image.pullPolicy)) | nindent 10 }}
           {{- if .Values.server.env }}
           env:
 {{ toYaml .Values.server.env | indent 12}}
@@ -182,6 +188,9 @@ spec:
             {{- $agentFlag := include "cloudzero-agent.prometheusAgentFlag" . }}
             {{- if $agentFlag }}
             - {{ $agentFlag }}
+            - --storage.agent.path={{ .Values.server.persistentVolume.mountPath }}
+            {{- else }}
+            - --storage.tsdb.path={{ .Values.server.persistentVolume.mountPath }}
             {{- end }}
             - --log.level={{ .Values.server.logging.level | default "info" }}
           ports: