Perch on Kubernetes: The Helm Chart as It Stands

Status: pre-production. Perch is pre-production with its Phase 11 cutover still ahead (nestr-tools CLAUDE.md:40 @b8f0585); the landing FAQ says the same (“Perch is pre-production”, nestr.tools, read 2026-10-25). No running cluster was found or checked for this card.

ELI5

Perch is a monitoring neighbourhood you install with one Helm command. The chart builds the big shared buildings (Prometheus, Alertmanager, Loki, Grafana, Jaeger, Thanos). The small specialist shops drawn in older plans (bridge, cost and SLO services) are not in the chart. And the address book still lists another company’s houses.

Technical Deep Dive

Source: nestr-tools/perch helm/Chart.yaml:1-12, helm/templates/ (file list and kinds), helm/values.yaml:6-8,20-23,30-36,39-58,74-140,143-145,227-229,260-280,305-335 @f9ec790; nestr-tools docs/decisions/2026-07-01-decommission-kustomize-overlays.md, 2026-07-02-fold-orphaned-controls-into-helm.md (closed) @b8f0585; read 2026-10-25.

What the chart renders

Chart nestr-perch 1.0.0, namespace perch-system. Its own description still reads “observability platform for Materi”.

Bundled dashboards: pellets-supply-chain.json and pellets-transparency-log.json only, which is I-5’s order (PEL panels before golden signals).

flowchart TB
  subgraph chart["helm/ renders"]
    P["prometheus x2"]
    AM["alertmanager x3"]
    L["loki x2"]
    PT["promtail daemonset"]
    G["grafana x2"]
    J["jaeger"]
    T["thanos query, store, compact"]
  end
  subgraph raw["perch/k8s/ raw manifests only"]
    BR["bridge"]
    CS["cost-monitor, slo-tracker, policy-enforcer, trace-correlator"]
  end
  P -- "nestr-pellets-registry job" --> REG["pellets-registry.nestr-system:8080"]
  P -- "nestr-policy-enforcer job" --> PE["policy-enforcer :8081"]
  P -. "engine target empty" .-> ENG["Railway engine"]

Scrape targets

nestrScrapeTargets renders one job per non-empty entry: pelletsRegistry (pellets-registry.nestr-system.svc.cluster.local:8080) and policyEnforcer. engine is ""; the values comment says to set it once the engine serves supply-chain metrics, which it now does via the metricstore (nestr-008), but the engine runs on Railway outside any cluster. The serviceMonitors block still lists Materi services (api, shield, relay, printery, aria, manuscript in materi-production), and no template in the chart renders a ServiceMonitor kind.

timeline
  title Perch deploy path
  2026-06-03 : Phase 11 closed, custom services last changed
  2026-07-01 : Dead kustomize overlays and deploy.sh deleted, Helm is canonical
  2026-07-02 : Orphaned netpol, PDB and quota manifests folded into Helm
  2026-10-25 : Still pre-production, no cluster evidenced

Key Terms

• nestrScrapeTargets → values map that becomes Prometheus jobs named nestr-<name>.
• perch/k8s/ → raw kubectl manifests, kept by the 2026-07-01 decision; the only home of bridge and the custom services.
• I-5 → Perch ships PEL-DIFF, PEL-REP and PEL-LOG panels before generic dashboards.

Q&A

Q: Which workloads does the Helm chart render, and which Perch components does it not? A: Prometheus, Alertmanager, Loki, Promtail, Grafana, Jaeger and Thanos, plus network policies, PDBs and quotas. It does not render the bridge or the four custom services; those exist only as raw manifests in perch/k8s/.

Q: What does the chart scrape for nestr out of the box? A: The pellets-registry at pellets-registry.nestr-system.svc.cluster.local:8080 and the policy-enforcer. The engine target is empty, and the Materi ServiceMonitor values are not rendered by any template.

Q: What happened to the kustomize overlays? A: The 2026-07-01 decision deleted the two non-buildable kustomization.yaml overlays and their deploy.sh scripts, kept perch/k8s/, and made the Helm chart the canonical deploy path; the 2026-07-02 decision folded the orphaned production controls into the chart.

Examples

kubectl create ns perch-system && helm install perch ./helm -n perch-system --dry-run renders the stack. Pointing it at the hosted registry is not a values change alone: the job targets a plain in-cluster address, while registry.nestr.tools is HTTPS on Railway. Its /metrics is public and on 2026-10-25 reported pellets_registry_translog_tree_size 0, so a dashboard wired to it today would show an empty log.