Observability

  • Changed

    • Upgrade grafana chart: 13.5.1 => 14.1.0
    • Set sidecar sizeLimit defaults to "" to match the upstream values schema.
    • Fix appVersion: 13.2.0 => 13.2.4
  • Fixed

    • The memcached and memcached-exporter images resolve to gsoci.azurecr.io/giantswarm/.

    Changed

    • Breaking: Loki now uses the thanos objstore client (loki.loki.storage.use_thanos_objstore: true). Configure the store in loki.loki.storage.object_store (type, s3, azure, gcs). Loki ignores loki.loki.storage.s3 and loki.loki.storage.azure. Set use_thanos_objstore: false to keep the previous client.
      • S3 needs object_store.s3.endpoint, for example s3.eu-west-1.amazonaws.com.
      • Azure Workload Identity: drop useFederatedToken and leave object_store.azure.account_key empty.
      • Bucket and container names still come from loki.loki.storage.bucketNames. Stored data stays readable: object paths do not change.
    • Disable the chunks and results caches by default.

    Added

    • Add gatewayRoute.internalRoute, an in-cluster copy of additionalRules. Disabled by default.
  • Fixed

    • Package the matching architecture-specific binary in container images, fixing ARM64 startup failures.
    • [Helm] Fixed noisy Helm diffs caused by .Release.Revision changing on every upgrade. Release revision is already tracked in Helm release metadata.
  • Added

    • Add SBOM Advisories dashboard to the Giant Swarm Security organization: images still failing an sbom-advisory-operator advisory (eMudhra CA compromise by default), grouped by the fix.
  • Changed

    • !Breaking change: Turn apps.<appName>.dependsOn from a list into a map from dependency name to true/false, so that a provider can turn off a single dependency (for example kyverno-crds on clusters without the security bundle) instead of overriding the whole list.

    Added

    • KSM custom resource state: Add status_parent_accepted and status_parent_resolved_refs gauges for Gateway API HTTPRoute, one series per parent with the condition reason as label.
    • KSM custom resource state: Add target_info and status_ancestor_accepted metrics for Envoy Gateway SecurityPolicy, BackendTrafficPolicy, ClientTrafficPolicy and EnvoyExtensionPolicy.
  • Changed

    • Change the missing X-Scope-OrgID response body from Bad Request to Missing X-Scope-OrgID header in the Loki, Mimir, Tempo and Basic Auth headers-check filters. The status stays 401.
    • Fail the render when loki.enabled, mimir.enabled or tempo.enabled is true and auth.jwt.providers is empty.

    Removed

    • Remove the Loki OTLP gRPC route and loki.write.grpc. Loki serves OTLP over HTTP only.

    Fixed

    • The helm.sh/chart label is valid for long chart versions: the 63-character cut trims the whole trailing run of -, . and _.
  • Added

    • Add AWS NLB Metrics dashboard to the Envoy Gateway folder.
    • Add Log export dashboard to the Observability folder.
  • Added

    • Added the Grafana image renderer configuration, disabled by default.
    • Added a CiliumNetworkPolicy for the image renderer.
    • Documented image rendering in the chart README.

    Changed

    • Updated values.schema.json for the imageRenderer values.
    • Upgrade grafana chart: 12.11.2 => 13.2.7
    • Upgrade postgresql-cnpg: 18.4 => 18.6

    Fixed

    • The helm.sh/chart label is valid for long chart versions: the 63-character cut trims the whole trailing run of -, . and _.
    • Trim trailing . from the helm.sh/chart label, to fix build.
  • Added

    • Add crossplane.aws.iam.enabled, rendering a Crossplane IAM Role for IRSA even while alloy.enabled is false. Off by default.

    Changed

    • Upgrade Alloy upstream chart from 1.12.1 to 1.13.0 (CHANGELOG)
      • This bumps the version of Alloy from 1.19.2 to 1.20.0 (CHANGELOG).
      • Alloy Breaking changes
        • [otelcol.processor.k8sattributes] Default label and annotation keys use the singular form (k8s.pod.label.<key>). container.image.tags replaces container.image.tag. deployment_name_from_replicaset is removed.
        • [otelcol.processor.transform] Base64Decode is removed. set(target, nil) sets target to nil.
        • See Alloy v1.20.0 release notes
      • Update prometheus-config-reloader from v0.91.0 to v0.94.0.
      • Add controller.dnsConfig and service.trafficDistribution values.

    Fixed

    • The helm.sh/chart label is valid for long chart versions: the 63-character cut trims the whole trailing run of -, . and _.
  • Removed

    • Remove the agent_platform sub-chart and its LLM usage dashboard.