Observability - Giant Swarm Changes and Releases

grafana-app release v2.41.0

Thu, 01 Oct 2026 12:20:07 +0000

Added

Added the Grafana image renderer configuration, disabled by default.
Added a CiliumNetworkPolicy for the image renderer.
Documented image rendering in the chart README.

Changed

Updated values.schema.json for the imageRenderer values.
Upgrade grafana chart: 12.11.2 => 13.2.7
Upgrade postgresql-cnpg: 18.4 => 18.6

Fixed

The helm.sh/chart label is valid for long chart versions: the 63-character cut trims the whole trailing run of -, . and _.
Trim trailing . from the helm.sh/chart label, to fix build.

alloy-app release v0.24.0

Tue, 29 Sep 2026 14:42:36 +0000

Added

Add crossplane.aws.iam.enabled, rendering a Crossplane IAM Role for IRSA even while alloy.enabled is false. Off by default.

Changed

Upgrade Alloy upstream chart from 1.12.1 to 1.13.0 (CHANGELOG)
- This bumps the version of Alloy from 1.19.2 to 1.20.0 (CHANGELOG).
- Alloy Breaking changes
  - [otelcol.processor.k8sattributes] Default label and annotation keys use the singular form (k8s.pod.label.<key>). container.image.tags replaces container.image.tag. deployment_name_from_replicaset is removed.
  - [otelcol.processor.transform] Base64Decode is removed. set(target, nil) sets target to nil.
  - See Alloy v1.20.0 release notes
- Update prometheus-config-reloader from v0.91.0 to v0.94.0.
- Add controller.dnsConfig and service.trafficDistribution values.

Fixed

The helm.sh/chart label is valid for long chart versions: the 63-character cut trims the whole trailing run of -, . and _.

dashboards release v4.31.0

Thu, 24 Sep 2026 08:59:49 +0000

Removed

Remove the agent_platform sub-chart and its LLM usage dashboard.

mimir-app release v0.30.1

Thu, 17 Sep 2026 07:59:56 +0000

Added

Allow InPlaceOrRecreate and InPlace as verticalAutoscaling.updateMode values in values.schema.json.

Changed

Set the ruler’s VPA updateMode to Initial (was Recreate).

observability-bundle release v3.5.0

Wed, 16 Sep 2026 07:28:10 +0000

Changed

Update alloy apps to 0.23.1 (Alloy v1.19.2).
Update prometheus-operator-crd to 24.0.0 (Prometheus Operator CRDs v0.94.0).
Update kube-prometheus-stack to 24.0.0 (chart 91.2.3, Prometheus Operator v0.94.0).

Added

Point kube-prometheus-stack’s control-plane ServiceMonitors at the alloy-metrics token Secret.

Fixed

KSM custom resource state: Set the Gateway API TCPRoute and UDPRoute collectors to v1, which is the version the API server serves.

kube-prometheus-stack-app release v24.0.0

Tue, 15 Sep 2026 16:29:50 +0000

Changed

Upgraded chart dependency to kube-prometheus-stack-91.2.3 (from 88.6.3, via 90.0.0)
- prometheus-operator (and prometheus-config-reloader) from v0.93.1 to v0.94.0
- grafana subchart from 12.11.2 to 13.2.4, which switches the Grafana image from 13.2.0 to 13.2.1-distroless, enables readOnlyRootFilesystem on the Grafana container (with a new /tmp emptyDir) and sets plugins.preinstall_auto_update = false
- k8s-sidecar (Grafana dashboard/datasource sidecar) from 2.10.1 to 2.11.2
- kube-state-metrics subchart from 8.4.1 to 8.4.2 (KSM image unchanged at v2.20.0)
- prometheus-node-exporter subchart from 4.56.3 to 4.57.0 (we keep nodeExporter.enabled: false, no impact)
- Alertmanager, Prometheus, Thanos and kube-webhook-certgen images are unchanged.
Breaking (chart 90.0.0): the control-plane ServiceMonitors (kubelet, kube-apiserver, kube-controller-manager, kube-scheduler, kube-etcd, kube-proxy, coredns) no longer use bearerTokenFile/tlsConfig.caFile. They now authenticate through a kubernetes.io/service-account-token Secret (<release>-prometheus-token, newly created by the chart) and read the CA from the kube-root-ca.crt ConfigMap. This makes the ServiceMonitors work with arbitraryFSAccessThroughSMs.deny and with Grafana Alloy’s prometheus.operator.servicemonitors component (>= v1.19.0), which silently dropped every control-plane target before.
Breaking (chart 91.0.0 / operator v0.94.0): the Prometheus Operator ClusterRole no longer grants wildcard (*) verbs. Verbs are now explicit per resource group, and the operator only gets get/list/watch on the monitoring.coreos.com CRs plus writes on their /status and /finalizers subresources.
prometheusOperator.admissionWebhooks.matchConditions changed type from a map ({}) to a list ([]). We do not set it, so no impact.
Fixed the chart appVersion, which was still v0.92.0, to match the bundled Prometheus Operator (v0.94.0).
Added global.controlPlaneScrapeAuth to configure the Secret the control-plane ServiceMonitors authenticate with.
Dropped the scrape credential for coreDns, kubeEtcd and kubeProxy.
Removed insecureSkipVerify from the kubeControllerManager and kubeScheduler ServiceMonitors.

Note: release the matching prometheus-operator-crd app (CRDs chart 32.0.0, Prometheus Operator v0.94.0) before this one. The CRDs shipped by this chart live in charts/crds/crds/ and are therefore only applied by Helm on install, never on upgrade.

prometheus-operator-app release v24.0.0

Tue, 15 Sep 2026 16:29:50 +0000

Changed

Upgraded chart dependency to kube-prometheus-stack-91.2.3 (from 88.6.3, via 90.0.0)
- prometheus-operator (and prometheus-config-reloader) from v0.93.1 to v0.94.0
- grafana subchart from 12.11.2 to 13.2.4, which switches the Grafana image from 13.2.0 to 13.2.1-distroless, enables readOnlyRootFilesystem on the Grafana container (with a new /tmp emptyDir) and sets plugins.preinstall_auto_update = false
- k8s-sidecar (Grafana dashboard/datasource sidecar) from 2.10.1 to 2.11.2
- kube-state-metrics subchart from 8.4.1 to 8.4.2 (KSM image unchanged at v2.20.0)
- prometheus-node-exporter subchart from 4.56.3 to 4.57.0 (we keep nodeExporter.enabled: false, no impact)
- Alertmanager, Prometheus, Thanos and kube-webhook-certgen images are unchanged.
Breaking (chart 90.0.0): the control-plane ServiceMonitors (kubelet, kube-apiserver, kube-controller-manager, kube-scheduler, kube-etcd, kube-proxy, coredns) no longer use bearerTokenFile/tlsConfig.caFile. They now authenticate through a kubernetes.io/service-account-token Secret (<release>-prometheus-token, newly created by the chart) and read the CA from the kube-root-ca.crt ConfigMap. This makes the ServiceMonitors work with arbitraryFSAccessThroughSMs.deny and with Grafana Alloy’s prometheus.operator.servicemonitors component (>= v1.19.0), which silently dropped every control-plane target before.
Breaking (chart 91.0.0 / operator v0.94.0): the Prometheus Operator ClusterRole no longer grants wildcard (*) verbs. Verbs are now explicit per resource group, and the operator only gets get/list/watch on the monitoring.coreos.com CRs plus writes on their /status and /finalizers subresources.
prometheusOperator.admissionWebhooks.matchConditions changed type from a map ({}) to a list ([]). We do not set it, so no impact.
Fixed the chart appVersion, which was still v0.92.0, to match the bundled Prometheus Operator (v0.94.0).
Added global.controlPlaneScrapeAuth to configure the Secret the control-plane ServiceMonitors authenticate with.
Dropped the scrape credential for coreDns, kubeEtcd and kubeProxy.
Removed insecureSkipVerify from the kubeControllerManager and kubeScheduler ServiceMonitors.

Note: release the matching prometheus-operator-crd app (CRDs chart 32.0.0, Prometheus Operator v0.94.0) before this one. The CRDs shipped by this chart live in charts/crds/crds/ and are therefore only applied by Helm on install, never on upgrade.

alloy-app release v0.23.1

Tue, 15 Sep 2026 15:13:07 +0000

Added

Optional serviceAccountTokenSecret.enabled to render a long-lived service account token Secret.

alloy-app release v0.23.0

Mon, 14 Sep 2026 14:41:37 +0000

Changed

Upgrade Alloy upstream chart from 1.10.0 to 1.12.1 (CHANGELOG)
- This bumps the version of Alloy from 1.17.0 to 1.19.2 (CHANGELOG), which includes several CVE fixes.
- Alloy Breaking changes
  - [prometheus.operator.servicemonitors] ServiceMonitor endpoints referencing bearerTokenFile, tlsConfig.caFile, tlsConfig.certFile or tlsConfig.keyFile are now rejected. Set allow_arbitrary_file_access = true to keep the previous behaviour.
  - [otelcol.receiver.otlp] The HTTP server now defaults to idle_timeout = "1m", read_header_timeout = "1m" and write_timeout = "30s" instead of "0s".
  - See Alloy v1.18.0 and v1.19.0 release notes
- [beyla.ebpf] Beyla now runs as a subprocess, which raises the memory used by the Alloy container.

Fixed

Allow verticalPodAutoscaler.updatePolicy to be set, including the in-place update modes.

dashboards release v4.30.0

Wed, 09 Sep 2026 14:24:07 +0000

Added

Add an agent_platform sub-chart (Team Bumblebee) and its first dashboard, Giant Swarm / Agent Platform / LLM usage: tokens, estimated cost and latency for every model call that goes through the Agent Platform’s agentgateway LLM listener, broken down by agent, agent namespace and model. It reads the GenAI metrics the agentgateway data plane emits. Empty until an installation enables llmRouting in the Agent Platform values and points its agents at the listener.
Add a Cost accounting row to the LLM usage dashboard, for attributing spend rather than watching it: totals for the selected time range, cost per bucket stacked by agent and by model over a selectable Cost bucket period, and per-model and per-agent-and-model tables with column totals.

Changed

Move the private Falco dashboard to the new Giant Swarm Security organization and rename it to Anomaly Detection, to include other data sources.

Removed

Drop the Security: Falco Dashboard and Falco public dashboard boards, so no Falco dashboards remain outside the Giant Swarm Security organization.

alloy-app release v0.22.0

Wed, 09 Sep 2026 08:47:32 +0000

Added

Add RBAC to allow alloy-metrics to read the alloy-vcenter-credentials secret when running vSphere or VCD clusters.
Add serviceWhenDisabled.enabled, keeping the Service rendered while alloy.enabled is false. Off by default.

observability-bundle release v3.4.0

Thu, 03 Sep 2026 11:22:48 +0000

Changed

Values: Update Prometheus Operator CRD and Kube Prometheus Stack to v23.0.0.

kube-prometheus-stack-app release v23.0.0

Thu, 03 Sep 2026 08:35:17 +0000

Changed

Chart: Upgrade kube-prometheus-stack to v88.6.3, including:
- prometheus-operator to v0.93.1
- kube-state-metrics to v8.4.1
- prometheus-node-exporter to v4.56.3
- grafana to v12.11.2

prometheus-operator-app release v23.0.0

Thu, 03 Sep 2026 08:35:17 +0000

Changed

Chart: Upgrade kube-prometheus-stack to v88.6.3, including:
- prometheus-operator to v0.93.1
- kube-state-metrics to v8.4.1
- prometheus-node-exporter to v4.56.3
- grafana to v12.11.2

loki-app release v0.48.0

Thu, 03 Sep 2026 07:35:57 +0000

Fixed

Keep the provider-kubernetes identity RBAC on uninstall, so the crossplane Objects can drop their finalizers instead of hanging.

Added

Add gatewayRoute.requestMirror, an optional RequestMirror filter on gatewayRoute.additionalRules, plus the ReferenceGrant a cross-namespace backendRef needs. Disabled by default.

observability-platform-api release v0.5.0

Mon, 31 Aug 2026 13:39:56 +0000

Added

Add loki.write.requestMirror, an optional RequestMirror filter on the Loki write route. Disabled by default.
Add opt-in Basic Auth read routes for Mimir and Loki on a dedicated hostname (basicAuth.*, disabled by default).

grafana-app release v2.40.0

Mon, 24 Aug 2026 13:56:05 +0000

Added

Brand Grafana with the Giant Swarm logo mark and favicon, by mounting the assets in helm/grafana/branding over the ones the Grafana image ships. Set grafana.extraConfigmapMounts to [] to get Grafana’s own branding back.
Add make branding-verify (run by the verify-branding CI job) and make branding-update, which keep the hashed logo path in sync with the Grafana image and generate the pod annotation that rolls the deployment when a branding asset changes.

Changed

Upgrade grafana chart: 12.10.3 => 12.11.2
Upgrade grafana (appVersion): 13.1.2 => 13.2.0

loki-app release v0.47.0

Mon, 24 Aug 2026 09:05:40 +0000

Changed

Upgrade upstream loki helm chart from v13 (13.7.2) to v18 (18.10.1). Loki app version goes from 3.7.2 to 3.7.6.
Breaking: loki.networkPolicy.flavor is gone. Upstream dropped Cilium network policy support, so this chart renders the CiliumNetworkPolicy resources itself, switched by the new top-level ciliumNetworkPolicy.enabled (default true). Set it to false where you used flavor: kubernetes. The standard NetworkPolicy resources now render alongside them.
The ServiceMonitor is no longer gated on the prometheus-operator CRD being present: set loki.monitoring.serviceMonitor.enabled: false on clusters without it.
The built-in MinIO subchart is deprecated upstream: loki.minio.enabled now also needs loki.ignoreMinioDeprecation: true, and goes away on 2026-10-31.

silence-operator release v0.21.0

Tue, 18 Aug 2026 14:07:00 +0000

Added

Add startsAt, endsAt, and duration fields to the v1alpha2 Silence CRD for explicit silence scheduling. duration accepts weeks (w), days (d), hours (h), minutes (m), and seconds (s), each at most once and ordered largest to smallest: "7d", "2w", "1d12h". endsAt and duration are mutually exclusive. When neither is set, the valid-until annotation is used as a fallback.

Changed

Regenerate .github/workflows/zz_generated.*.yaml via devctl to use the centralized reusable workflow, removing the Node-20 mindsers/changelog-reader-action dependency.
Update Go dependencies, which resolves CVE-2026-63209 (github.com/klauspost/compress) and CVE-2026-56852 (golang.org/x/text) and removes their .nancy-ignore entries.

Fixed

Quote the = scalars in the generated matchType CRD schema so the rendered chart parses under PyYAML (unblocks the HelmTemplateValidator step added in app-build-suite 2.2.0).
Fix various CVEs by updating dependencies:
Skip failing CI jobs using private secrets for external contributions from fork
Replace deprecated controller-runtime scheme.Builder with apimachinery runtime.NewSchemeBuilder
Fix gosec, goconst and errcheck linter errors in tests

loki-app release v0.46.1

Wed, 12 Aug 2026 13:40:54 +0000

Changed

Upgrade upstream loki helm chart from v13.5.0 to v13.7.2. Loki app version goes from 3.7.1 to 3.7.2 (CVE fixes, ruler panic fix, S3 SDK bump).
k8s-sidecar bumped 2.7.1 → 2.7.3.

loki-app release v0.46.0

Wed, 12 Aug 2026 09:27:59 +0000

Added

Support for Azure Workload Identity

Changed

Move the AWS and Azure deployment instructions out of the README into docs/deploying-on-aws.md and docs/deploying-on-azure.md.

Fixed

Add a kubernetes-flavor NetworkPolicy granting the backend pods egress to the kube-apiserver (TCP 443/6443) to fix standalone platforms and CI tests.
Fix ABS config to not override AppVersion in Chart.yaml

grafana-app release v2.39.0

Fri, 07 Aug 2026 09:01:32 +0000

Changed

Fix ABS config to not override AppVersion in Chart.yaml
Upgrade grafana chart: 12.3.0 => 12.10.3
Upgrade grafana (appVersion): 13.0.1 => 13.1.2
Upgrade postgresql-cnpg: 18.3 => 18.4 — the rolling DB upgrade can cause ~5min of Grafana downtime.

Removed

The upstream chart no longer creates a Role/RoleBinding when grafana.rbac.namespaced is false (our default). Those objects were empty, sidecar permissions come from the ClusterRole.

observability-bundle release v3.3.1

Thu, 06 Aug 2026 15:03:49 +0000

Changed

Values: Generate schema for Alloy PodLogs CRDs.
Values: Add Cilium as dependency for Alloy apps & Kube Prometheus Stack.
Values: Update Alloy apps to v0.21.2.

Removed

Values: Remove unused catalog.

dashboards release v4.29.1

Thu, 06 Aug 2026 14:13:52 +0000

Added

Add a nav bar between the four Envoy Gateway dashboards, like the Cilium ones have.

Changed

Give Envoy Gateway | Clusters a readable uid. Links to its old random uid stop resolving.
Rename the cluster variable on Cilium Agent logs to cluster_id, matching the other Cilium dashboards so the selection carries across links.
Rename workload_cluster to cluster_id on the Envoy Gateway dashboards, so the selection carries when moving between them. On Clusters its label is K8s Cluster, to tell it apart from the Envoy cluster selector.
Hide the datasource selector on the Cilium and Envoy Gateway dashboards and point it at the default datasource, instead of the exported uids that only resolved in the Grafana a board came from.

Removed

Drop the Cluster selector from Envoy Gateway | Clusters. Every panel also matched on the namespace, resource and rule selectors, which compose the same Envoy cluster name.

Fixed

Give Cilium | Agent its own uid instead of reusing the retired Cilium metrics dashboard’s, which kept it from being created.
Give Envoy Gateway | Control Plane its own uid instead of reusing the retired Global dashboard’s, which kept it from being created.

alloy-app release v0.21.2

Thu, 06 Aug 2026 12:56:21 +0000

Changed

Chart: Install Vertical Pod Autoscaler independent of API availability.

alloy-app release v0.21.1

Thu, 06 Aug 2026 09:18:44 +0000

Fixed

Setting alloy.enabled: false now disables the whole chart on its own and renders nothing. Previously it only dropped the upstream Alloy chart, and the Giant Swarm templates (NetworkPolicy, Kyverno PolicyException, VerticalPodAutoscaler, PodLogs, extra env Secret) failed to render with no template "alloy.chart" associated with template "gotpl" unless networkPolicy.flavor and kyvernoPolicyExceptions.enabled were also overridden.

Added

Add a make test-chart target and a test-chart workflow that render the chart with every ci/*-values.yaml file and assert it renders nothing when disabled and all of its objects when enabled. Unlike ct lint, these use a current Helm, which is required to catch template rendering errors.

dashboards release v4.29.0

Wed, 05 Aug 2026 12:09:55 +0000

Added

Add the Envoy Gateway | Overview dashboard: a lean single-pane health view (traffic, latency, error rate, saturation) that avoids duplicating the detail boards.
Add a downstream request-latency heatmap to Envoy Gateway | Clusters.
Add an Envoy Gateway controller logs panel to the Control Plane dashboard.
Publish the Flux Logs dashboard to Shared Org / GitOps. It covers the Flux controllers on the management cluster; workload-cluster Flux logs are not ingested yet, because the flux-system namespace there has no tenant assignment and Alloy drops untenanted pod logs.
Add scripts/update-flux-dashboards.sh (make update-flux-dashboards), which syncs the Flux dashboards from fluxcd/flux2-monitoring-example and re-applies our patches. It runs in the monthly dashboard-update workflow and fails loudly if a patch stops applying.
Add Organization and Cluster selectors to both Flux dashboards. They are deployed to the management cluster’s Grafana, whose Mimir holds metrics for every workload cluster, so until now every panel aggregated across a customer’s whole fleet.
Replace the Cilium dashboards with a set of four: Cilium | Overview for triage, Cilium | Agent, Cilium | Datapath & Policy and Cilium | Operator. Rows load collapsed and the per-agent panels use topk, so the entry point is no longer a 355 kB dashboard that fires 75 queries at once.
Add Cilium | Operator. The cilium-operator PodMonitor has always been enabled, but none of its metrics were graphed: identity garbage collection, workqueues, unmanaged pods and LB-IPAM.

Changed

Consolidate the Envoy / Gateway API dashboards down to four: Overview, Clusters, Access Logs and Control Plane. The Control Plane board (formerly Global) absorbs the config push status panels, and Logs is renamed to Access Logs.
Synced Flux dashboards from fluxcd/flux2-monitoring-example@7ab65dc.
Anchor the etcd-health dashboard cluster selector to etcd_server_id instead of up, so clusters with a managed control plane (aks, eks) no longer appear as empty options.

Removed

Remove the redundant Envoy Gateway | Proxy Global and Envoy Gateway | Configuration dashboards, folded into the boards above.

Fixed

Fix the Flux Cluster Stats dashboard, which showed no data at all: every panel queried gotk_reconcile_condition, a metric the Flux controllers no longer expose. It now uses gotk_resource_info, the same metric our Flux alerting rules use, and gains upstream’s Suspended Objects panel.
De-duplicate gotk_resource_info on the Flux Cluster Stats dashboard. On management clusters both flux-ksm and kube-state-metrics export identical series, so the resource counts read exactly double.
Scope the Flux Control Plane dashboard to the Flux namespace. Its controller_runtime_* panels matched any operator exposing the same controller label values (for example controller="helmrelease" is also emitted by dex-operator and team-stamper).
Widen the Flux Control Plane range windows from [1m] to [$__rate_interval]. With our 60s scrape interval a one-minute window cannot hold two samples, so the reconciliation and API-request panels were empty. The ops/min panels use rate(...) * 60 so they stay per-minute rather than reporting the count over the whole (range-dependent) window.
Point the Flux Cluster Stats targets at the $datasource variable. Seven of them were pinned to a prometheus datasource uid that does not exist here, and the target-level datasource overrides the panel.
Restrict the Flux namespace selector on Flux Control Plane to the Flux controller pods. It was derived from a generic controller-runtime metric, so on a management cluster it also offered external-secrets, giantswarm and kube-system, and the dashboard could open on another operator’s data.
Fix the worker count expression on the Nodes Overview dashboard.
Fix the monthly dashboard-update workflow, which called a make update-mixin target that no longer exists (it was renamed to update-all-mixin), so the automation failed instead of opening a PR.

Removed

Remove the Cilium Metrics and Cilium performance dashboards, replaced by the set above. 16 of their panels queried metrics Cilium no longer exposes (the kvstore and BPF syscall sections, the L7 proxy counters and the policy trigger panels), and Cilium performance duplicated the Overview.

mimir-app release v0.30.0

Tue, 28 Jul 2026 11:12:25 +0000

Changed

Upgrade mimir-distributed chart to version 6.1.0.

Fixed

Remove the unused enterprise/legacyLabels branches from the mimir.labels, mimir.podLabels and mimir.selectorLabels helpers, aligning them with upstream. The mimir-distributed 6.1.0 chart dropped the default enterprise block from its values, which made these helpers fail with a nil-pointer error during templating.

Removed

Remove the prometheus.io/service-monitor: "false" label from the gateway service, reverting the 0.29.1 bugfix. It is no longer needed as the mimir-distributed 6.1.0 chart removes the gateway serviceMonitor upstream.

tempo-app release v0.18.0

Tue, 28 Jul 2026 11:12:14 +0000

Changed

Fix ABS config to not override AppVersion in Chart.yaml
Upgrade Tempo Vulture chart from 0.12.10 to 0.13.0
- Bumps the tempo-vulture image from 2.10.5 to 3.0.2, which is the only change in the chart
- Pins -tempo-metrics-backoff-duration=0s: the TraceQL metrics check went from disabled to enabled (every 10s) upstream, and it cannot pass here because we do not enable the metrics-generator local-blocks processor
- Drops support for the -rhythm-rf1-after flag (unused here) and starts honouring -tempo-push-tls, which was previously ignored (we leave it disabled)
Upgrade Tempo chart from 2.23.0 to 2.26.2
- Upgrades Tempo from 2.10.5 to 2.10.7
- Bumps the memcached image from 1.6.42-alpine to 1.6.43-alpine
- Bumps the rollout-operator sub-dependency from 0.49.0 to 0.50.0 (not enabled here)
- The metrics-generator now gets a livenessProbe (/ready, 60s initial delay), which it did not have when running as a StatefulSet (chart 2.25.4)
- Ingester and metrics-generator moved onto the shared pod template; container ports are reordered and the ingester grpc port is now declared via ingester.extraPorts. Rendered output is otherwise unchanged, so this is a rolling restart only
- Adds (disabled by default) ingest/Kafka write path with the experimental block-builder and live-store components, plus ingester.enabled to turn the ingester off (chart 2.24.0)
- Adds a dnsConfig value on every component with defaults/tempo fallback, deprecating dnsConfigOverides (chart 2.26.1)
- Adds distributor.shutdownDelay for graceful load-balancer draining, disabled by default (chart 2.26.0)

mimir-app release v0.29.1

Thu, 23 Jul 2026 15:12:46 +0000

Fixed

disabled gateway metrics servicemonitor. Had been added in 0.29.0 but not working.

mimir-app release v0.29.0

Thu, 23 Jul 2026 14:10:12 +0000

Changed

Fix ABS config to not override AppVersion in Chart.yaml
Upgrade chart to version 6.0.6
Upgrade mimir to 3.1.4

observability-bundle release v3.3.0

Thu, 02 Jul 2026 09:16:44 +0000

Added

Add KSM metrics for Gateway API ListenerSet and ReferenceGrant resources.

Changed

Update Gateway API KSM configs to v1 for Gateway, GatewayClass, HTTPRoute, GRPCRoute, TLSRoute and BackendTLSPolicy.

dashboards release v4.28.0

Wed, 01 Jul 2026 09:53:27 +0000

Changed

Update Kafka dashboards to reload variable on time range changes and use shared crosshair.

dashboards release v4.27.0

Wed, 01 Jul 2026 09:01:13 +0000

Added

Add new Audit Volume dashboard to observe size of audit logs by cluster.

observability-bundle release v3.2.0

Mon, 29 Jun 2026 18:16:04 +0000

Changed

Update kube-prometheus-stack and prometheus-operator-crd to 22.0.0
Update alloy-app to 0.21.0

kube-prometheus-stack-app release v22.0.0

Mon, 29 Jun 2026 13:08:02 +0000

Changed

Upgraded chart dependency to kube-prometheus-stack-87.3.0 (from 85.2.1)
- prometheus-operator to 0.92.0 (via 0.91.0)
- alertmanager image tag from v0.32.1 to v0.33.0
- prometheus image tag from v3.11.3-distroless to v3.12.0-distroless
- grafana subchart from 12.3.3 to 12.7.1
- kube-state-metrics subchart from 7.4.0 to 7.5.1
- kube-webhook-certgen image tag from 1.8.3 to 1.8.4
- Refreshed bundled default Prometheus alerting/recording rules and Grafana dashboards.
- prometheus.prometheusSpec.containers and initContainers are now rendered through tpl (87.3.0), so templated values inside them are evaluated. We do not set these values, so no impact.

Note: Update the matching-major prometheus-operator-crd app (to the v0.92.0 CRDs) before/alongside this upgrade. The PrometheusTopologySharding and PrometheusShardRetentionPolicy feature gates are now enabled by default in v0.92.0.

prometheus-operator-app release v22.0.0

Mon, 29 Jun 2026 13:08:02 +0000

Changed

Upgraded chart dependency to kube-prometheus-stack-87.3.0 (from 85.2.1)
- prometheus-operator to 0.92.0 (via 0.91.0)
- alertmanager image tag from v0.32.1 to v0.33.0
- prometheus image tag from v3.11.3-distroless to v3.12.0-distroless
- grafana subchart from 12.3.3 to 12.7.1
- kube-state-metrics subchart from 7.4.0 to 7.5.1
- kube-webhook-certgen image tag from 1.8.3 to 1.8.4
- Refreshed bundled default Prometheus alerting/recording rules and Grafana dashboards.
- prometheus.prometheusSpec.containers and initContainers are now rendered through tpl (87.3.0), so templated values inside them are evaluated. We do not set these values, so no impact.

Note: Update the matching-major prometheus-operator-crd app (to the v0.92.0 CRDs) before/alongside this upgrade. The PrometheusTopologySharding and PrometheusShardRetentionPolicy feature gates are now enabled by default in v0.92.0.

alloy-app release v0.21.0

Mon, 29 Jun 2026 12:26:18 +0000

Changed

Upgrade Alloy upstream chart from 1.8.2 to 1.10.0 (CHANGELOG)
- This bumps the version of Alloy from 1.16.1 to 1.17.0 (CHANGELOG), which includes several CVE fixes and a fix for cluster nodes failing to join when TLS is enabled.
- Adds opt-in controller.autoscaling.horizontal.externalHPA (externally-managed HPAs, e.g. KEDA) and service.externalTrafficPolicy values. Neither is enabled in our defaults.

observability-bundle release v3.1.0

Mon, 29 Jun 2026 11:42:29 +0000

Changed

HelmReleases: honor the App platform priority field (1-150, default 25) on extraConfigs entries. spec.valuesFrom now reproduces the App platform merge order — all configMaps before all secrets (a secret always overrides a configMap), each kind ordered by priority around the user-config layer — preserving the App CR merge semantics after the migration. (giantswarm#36096)

dashboards release v4.26.0

Thu, 25 Jun 2026 15:19:04 +0000

Added

Add CODEOWNERS for each team sub chart

Changed

Rename team sub-charts to the capability they represent (team_atlas → observability, team_tenet → kubernetes, team_phoenix → cloud, team_shield → security, team_cabbage → networking, team_honeybadger → app_platform)

kube-prometheus-stack-app release v21.0.1

Thu, 25 Jun 2026 07:54:38 +0000

Added

Add app.circleci.com/circle-project-reponame label to the KSM Pods labels allowed list.

Changed

Fix ABS config to not override AppVersion in Chart.yaml

prometheus-operator-app release v21.0.1

Thu, 25 Jun 2026 07:54:38 +0000

Added

Add app.circleci.com/circle-project-reponame label to the KSM Pods labels allowed list.

Changed

Fix ABS config to not override AppVersion in Chart.yaml

dashboards release v4.25.1

Tue, 23 Jun 2026 16:18:53 +0000

Added

Add Teleport dashboard for Teleport (on EKS), deployed only when provider.kind is teleport.

dashboards release v4.25.0

Mon, 22 Jun 2026 15:04:34 +0000

Added

Add CI checks to validate dashboards supported version (v1 or v2)
Add CI checks to validate dashboards have an “owner” tag
Make Observability dashboards public
Move Observability related dashboards under Observability folder

Changed

Update Cluster Overview dashboard with organization selector
Update generated configmap names to use the same pattern
Rename Cloud folder to Cloud Provider
Improved dashboard validation scripts
Replace “Shared Org/Kubernetes” dashboards copy with a symlink
Move dashboards from public_dashboards to their respective team under the “Shared Org” organization folder
Move dashboards from private_dashboards to their respective team under the “Giant Swarm” organization folder
- Replace “Giant Swarm/Kubernetes” with “Giant Swarm/Kubernetes-dev” folder
Fixed owner tag for all dashboards
Add Envoy Logs dashboard to Team Cabbage

Fixed

Fixed Alloy Metrics Targets datasource
Fixed broken folder annotation for organization-root dashboards

observability-bundle release v2.9.1

Fri, 19 Jun 2026 14:44:56 +0000

Changed

Update alloy-app to 0.20.1

observability-bundle release v3.0.1

Tue, 16 Jun 2026 15:42:20 +0000

Changed

Update alloy-app to 0.21.0

alloy-app release v0.20.1

Tue, 16 Jun 2026 10:19:36 +0000

Changed

Fix ABS config to not override AppVersion in Chart.yaml

Removed

Remove redundant L7 rule from the CiliumNetworkPolicy. The removed rule allowed DNS queries to any DNS domain so removing it has no effect.

dashboards release v4.24.0

Thu, 04 Jun 2026 14:54:49 +0000

Added

feat: Add Kubernetes mixins dashboard to the public Shared Org (#900)

observability-bundle release v3.0.0

Thu, 04 Jun 2026 09:45:15 +0000

Changed

Migrate sub-apps from App CRs to Flux HelmRelease CRs.
Remove ‘cluster-values’ ConfigMap reference from HelmReleases.
Add new alloy-podlogs-crds chart.
Update alloy-app to 0.20.0

alloy-app release v0.20.0

Thu, 04 Jun 2026 08:34:08 +0000

Added

Add alloy-podlogs-crds chart to manage the PodLogs CRD independently of the alloy chart’s crds subchart.