Observability

  • Added

    • Add KSM metrics for Gateway API ListenerSet and ReferenceGrant resources.

    Changed

    • Update Gateway API KSM configs to v1 for Gateway, GatewayClass, HTTPRoute, GRPCRoute, TLSRoute and BackendTLSPolicy.
  • Changed

    • Update Kafka dashboards to reload variable on time range changes and use shared crosshair.
  • Added

    • Add new Audit Volume dashboard to observe size of audit logs by cluster.
  • Changed

    • Update kube-prometheus-stack and prometheus-operator-crd to 22.0.0
    • Update alloy-app to 0.21.0
  • Changed

    • Upgraded chart dependency to kube-prometheus-stack-87.3.0 (from 85.2.1)
      • prometheus-operator to 0.92.0 (via 0.91.0)
      • alertmanager image tag from v0.32.1 to v0.33.0
      • prometheus image tag from v3.11.3-distroless to v3.12.0-distroless
      • grafana subchart from 12.3.3 to 12.7.1
      • kube-state-metrics subchart from 7.4.0 to 7.5.1
      • kube-webhook-certgen image tag from 1.8.3 to 1.8.4
      • Refreshed bundled default Prometheus alerting/recording rules and Grafana dashboards.
      • prometheus.prometheusSpec.containers and initContainers are now rendered through tpl (87.3.0), so templated values inside them are evaluated. We do not set these values, so no impact.

    Note: Update the matching-major prometheus-operator-crd app (to the v0.92.0 CRDs) before/alongside this upgrade. The PrometheusTopologySharding and PrometheusShardRetentionPolicy feature gates are now enabled by default in v0.92.0.

  • Changed

    • Upgraded chart dependency to kube-prometheus-stack-87.3.0 (from 85.2.1)
      • prometheus-operator to 0.92.0 (via 0.91.0)
      • alertmanager image tag from v0.32.1 to v0.33.0
      • prometheus image tag from v3.11.3-distroless to v3.12.0-distroless
      • grafana subchart from 12.3.3 to 12.7.1
      • kube-state-metrics subchart from 7.4.0 to 7.5.1
      • kube-webhook-certgen image tag from 1.8.3 to 1.8.4
      • Refreshed bundled default Prometheus alerting/recording rules and Grafana dashboards.
      • prometheus.prometheusSpec.containers and initContainers are now rendered through tpl (87.3.0), so templated values inside them are evaluated. We do not set these values, so no impact.

    Note: Update the matching-major prometheus-operator-crd app (to the v0.92.0 CRDs) before/alongside this upgrade. The PrometheusTopologySharding and PrometheusShardRetentionPolicy feature gates are now enabled by default in v0.92.0.

  • Changed

    • Upgrade Alloy upstream chart from 1.8.2 to 1.10.0 (CHANGELOG)
      • This bumps the version of Alloy from 1.16.1 to 1.17.0 (CHANGELOG), which includes several CVE fixes and a fix for cluster nodes failing to join when TLS is enabled.
      • Adds opt-in controller.autoscaling.horizontal.externalHPA (externally-managed HPAs, e.g. KEDA) and service.externalTrafficPolicy values. Neither is enabled in our defaults.
  • Changed

    • HelmReleases: honor the App platform priority field (1-150, default 25) on extraConfigs entries. spec.valuesFrom now reproduces the App platform merge order — all configMaps before all secrets (a secret always overrides a configMap), each kind ordered by priority around the user-config layer — preserving the App CR merge semantics after the migration. (giantswarm#36096)
  • Added

    • Add CODEOWNERS for each team sub chart

    Changed

    • Rename team sub-charts to the capability they represent (team_atlasobservability, team_tenetkubernetes, team_phoenixcloud, team_shieldsecurity, team_cabbagenetworking, team_honeybadgerapp_platform)
  • Added

    • Add app.circleci.com/circle-project-reponame label to the KSM Pods labels allowed list.

    Changed

    • Fix ABS config to not override AppVersion in Chart.yaml