How to configure COS for strict reproducibility

To limit variance in COS deployments, the COS Terraform module can be pinned in a variety of ways.

Pinning the Terraform module

To restrict variance in the Terraform layer, the COS Terraform module source can be pinned to a tag. Consult the Terraform module versioning documentation for specifics.

Pinning charm revisions and resource images

To restrict variance in the Juju layer of the deployment, the COS Terraform module offers per-component revision and resources configuration. Pinning the values of these fields ensures that the deployed Juju applications remain unchanged, until they are explicitly targeted for an upgrade.

Pin a component

To pin the alertmanager component, the charm revision and resources.alertmanager-image can be specified:

module "cos" {
  source     = "git::https://github.com/canonical/observability-stack.git//terraform/cos"
  alertmanager = {
    resources = {
      alertmanager-image = "ubuntu/alertmanager:0.28.0-24.04_stable"
    }
    revision = 211
  }
}

and the charm is deployed accordingly:

juju status --format=json | jq -r '.applications["alertmanager"]["charm-rev"]'

211

with the hash of the specified image: 0.28.0-24.04_stable reflected in the charm’s alertmanager container:

kubectl describe pod -n cos alertmanager-0 | grep -A 50 "Containers" | grep -A 3 "alertmanager:"

  alertmanager:
    Container ID:  containerd://f6ac72ebc579dc96afea6600f29ab77a6fe6cc6c17fe94ff47aae0173bed8108
    Image:         ubuntu/alertmanager@sha256:c87440d8da4f693a15de287cf49368904dfdfb59ecb2a60c6dada294fb931158
    Image ID:      docker.io/ubuntu/alertmanager@sha256:c87440d8da4f693a15de287cf49368904dfdfb59ecb2a60c6dada294fb931158

Update a pinned component

To upgrade the Alertmanager component, update the charm revision and resources.alertmanager-image:

module "cos" {
  source     = "git::https://github.com/canonical/observability-stack.git//terraform/cos"
  alertmanager = {
    resources = {
      alertmanager-image = "ubuntu/alertmanager:0.31-24.04_stable"
    }
    revision = 212
  }
}

and the charm is updated accordingly:

juju status --format=json | jq -r '.applications["alertmanager"]["charm-rev"]'

212

with the hash of the specified image: 0.31-24.04_stable imagereflected in the charm’s alertmanager container:

kubectl describe pod -n cos alertmanager-0 | grep -A 50 "Containers" | grep -A 3 "alertmanager:"

  alertmanager:
    Container ID:  containerd://7639eeeaa144b2aabe0fe8657443ccee455a42a253eb23766c5bd22538eac09c
    Image:         ubuntu/alertmanager@sha256:c7bb054a27fdad7412fcb401b1fde27598e4e65f1671d080f07b5fddfbe7d986
    Image ID:      docker.io/ubuntu/alertmanager@sha256:c7bb054a27fdad7412fcb401b1fde27598e4e65f1671d080f07b5fddfbe7d986

Unpinning a component

If you decide that the alertmanager component should no longer be pinned, simply remove its configuration:

module "cos" {
  source     = "git::https://github.com/canonical/observability-stack.git//terraform/cos"
}

and the next terraform apply will deploy alertmanager with:

• the latest revision in the current track

• the associated image (uploaded in the CharmHub store) for that revision