Release Notes | observability

The module lifecycle stage: General Availability

The module has requirements for installation

v1.1.4

Changes

System metrics of the module components now carry the d8_source="dkp" label. This prevents duplicate time series and failing rule evaluations when a user exporter exposes metrics with the same names.
The module namespace is now checked against the restricted Pod Security Standards profile. Violations are reported as warnings only and do not block workloads. The module now requires Deckhouse 1.74 or newer.

Enhancements

Added PostgreSQL connection setup instructions to the service monitoring documentation, including how to reserve connections for the monitoring role on PostgreSQL 16 and newer.

Bug fixes

Removed the default value of the evaluation interval for propagated metrics rules groups.
Added RBAC v1 permissions for users on ObservabilityLogsRulesGroup and ClusterObservabilityLogsRulesGroup resources.
Fixed an error that caused the metrics collection agent to repeatedly attempt to update its own components in the cluster.

Security

Notification channel credentials are now masked in API responses. Reading them requires a dedicated permission, so users who may only view a channel no longer see its credentials.
Notification channel addresses are now validated: a channel can only point at an address that is a legitimate notification target. Addresses inside the cluster and in the private network remain allowed.
In the httpConfig section of notification channels, the fields that reference a file inside the container are deprecated and no longer applied: basicAuth.passwordFile, authorization.credentialsFile, oauth2.clientSecretFile, caFile, certFile and keyFile in both tlsConfig sections, and files in httpHeaders. Use values and secrets to pass header contents. The followRedirects field is no longer applied either — redirects are never followed. Existing resources remain valid, but the values of these fields are ignored, so a channel that relied on them needs to be reconfigured.
Hardened validation of module configuration parameters.
Fixed various vulnerabilities.

v1.1.0

Features

Added high-availability mode support to observability-controller
Added Logs ruler service allowing to build prometheus metrics based on logs
Added alert status field selector to alert-kube-api.
Added scrape interval configuration to opagent

Changes

Added source=“deckhouse” label to all system metrics
Added information about rolebinding and CAR using to module documentation
Opagent configuration changed to monitor only managed services by default.

Bug fixes

Fixed broken links in module documentation
Fixed a bug that caused delays in the appearance of new namespaces in the monitoring Explore data and Dashboards
Fixed a bug in module documentation specified that lightweight logs service is disabled by default
Fixed dashboards to properly show metrics if opagent restarts.
Fixed a bug causing alertmanager to fail if publicDomainTemplate is blank.
Fixed a bug causing opagent to stop collecting metrics on containerd restart.

v1.0.8

Bug fixes

Fixed a bug that caused cluster silencers to not work properly after alertmanager restart.

v1.0.7

Changes

PrometheusUnavailable alert changed severity to S3 and for clause for alert changed to 5 minutes.

v1.0.6

Security

Fixed various vulnerabilities in third-party libraries.

Bug fixes

Fixed components placement on a master-only k8s clusters

v1.0.5

Bug fixes

Module resources deploy order is now deterministic and works properly with nelm

v1.0.4

Changes

The observability module is now fully compatible with the Deckhouse CSE

v1.0.3

Changes

Opagent collects metrics for managed services only by default.

Bug fixes

Fixed an issue that caused opagent to stop collecting metrics after containerd restart.

v1.0.2

Security

Fixed vulnerability related to CVE-2026-40181 in react-router 6.30.2

v1.0.1

Changes

Module images are now built using the container-base images and the pm package manager

v1.0.0

Changes

Changes Observability module stage from Preview to General Availability

Enhancements

Improved Russian CRD documentation and removed obsolete CRDs
Added TCP/TLS in Alertmanager Gossip sync protocol.

Features

Added lightweight logs in module Observability. It allows to select lightweight-logs datasource in Explore Data to explore all namespace pods logs in one place. It supports filtering logs by labels and annotations.
Managed services monitoring support: it adds managed PostgreSQL or Memcache services monitoring dashboards to Explore Data section of a project.
Added additional labels support for DKP alerts. This way project alerts may have additional custom labels allowing users to filter them in external system using those labels.
Added eXpress messenger support in Alertmanager. Now it may be used when setting up notifications channel.
Added auth config to notifications webhook channel
Added ability to enable/disable Polk annotations in alerts notifications

Bug fixes

Fixed write path for external metrics access in module documentation
Fixed an issue that sometimes allowed upmeter probes test alerts to pass to general alerts list.
Drop finalizers from the Deckhouse-deployed resources on module disable
Remove the default value for the interval field in the metrics rule groups specs.
Enables watch config for opagent daemonset to properly reload SA token
Alertmanager Telegram and Slack notifier messages splitting for oversized alert groups

v0.9.8

Bug fixes

Fixed templates to check if required modules are enabled instead of checking if their CRDs

v0.9.7

Bug fixes

Fixed access to the prometheus remote write endpoint

v0.9.6

Bug fixes

Fix CVEs related to CVE-2026-42151, CVE-2026-42154, CVE-2026-44903, CVE-2025-15558, CVE-2025-47914, CVE-2025-58181, CVE-2026-32952, stdlib (Go 1.25.10) and CVEs in bundled base images. Additional CVEs in github.com/prometheus/prometheus, github.com/grafana/tempo, github.com/getkin/kin-openapi, github.com/grafana/grafana-plugin-sdk-go and github.com/grafana/grafana are addressed via VEX statements as not exploitable.

v0.9.5

Bug fixes

Removed the default value for the interval field in the metrics rule groups specs.

v0.9.4

Bug fixes

Enabled watch config for opagent daemonset to properly reload SA token. That issue caused D8KubernetesStaleTokensDetected alerts for opagent.

v0.9.3

Bug fixes

Fixed Prometheus discovery with global HA mode disabled.

v0.9.2

Bug fixes

Fixed console dashboard panel links.

v0.9.1

Bug fixes

Fixed vulnerabilities related to CVEs

v0.9.0

Features

Added logs multitenancy support. Now explore data only shows current project / cluster logs. It allows to setup users access to specific namespaces logs only.

Changes

High availability mode improved to keep firing and resolved alerts while module services rollouts and updates
Replaced dashboard uniq UID validation with an alert that notifies about UID conflicts
Improved module services authorization.
Observability module documentation updated

Bug fixes

Fixed naming convention validation for label names, annotation keys, and metrics names in observability rules to reject incompatible resources at apply time
Fixed an issue caused projects monitoring status alerts and rules not displaying properly
Fixed issues causing 401 responses affected dashboards with lots of panels and remote write metrics requests.

v0.8.2

Bug Fixes

Fixed a bug in the Email notification channel where the “Require TLS” setting was ignored.

v0.8.1

Bug fixes

Fixed vulnerabilities related to CVEs (CVE-2026-33186, CVE-2026-24051, CVE-2025-15558, CVE-2026-25679, CVE-2025-68470)

v0.8.0

Features

Alerting high availability — when Deckhouse Kubernetes Platform runs in high availability mode it also runs alerting in HA mode for better availability.
Improved Prometheus availability monitoring — DeadMansSwitch and PrometheusUnavailable alerts were updated for more reliable monitoring of Prometheus availability.
Propagated notification policies — You can configure alert notification delivery per project using propagated notification policies together with propagated notification channels.

Bug Fixes

Fixed empty rule group status in metrics rule groups caused by resource version conflicts.
Fixed module enablement failing when the global publicDomainTemplate setting was left blank.
Fixed PromQL queries using negative regexp matcher (!~) incorrectly returning “No data”.
Fixed incorrect graph rendering in Grafana when multiple conditions were applied to the same label in a PromQL query.
Fixed errors when using a rule group custom resource with no rules defined.
Cluster rule expressions now support an empty namespace for metrics selection.

Enhancements

Deckhouse modules’ Prometheus rules are now stored in the d8-observability namespace.
Alerts from Prometheus rules that do not specify cluster/namespace scope are now listed under the corresponding namespace’s alerts instead of system alerts. This affects only rules not defined via ClusterObservabilityMetricsRulesGroup or ObservabilityMetricsRulesGroup.
FAQ section on configuring external Grafana access to metrics was clarified.

Release v0.7.23

Bug fixes

Fixed an issue caused some Grafana datasource plugins (ClickHouse) to fail to connect to databases.
User roles permissions fixes

Release v0.7.22

Bug fixes

Bump Go version to 1.25.6 to fix known vulnerabilities in stdlib

Release v0.7.21

Changes

Observability alerts API service turned on for Kubernetes v1.32+

Release v0.7.20

Changes

Expanded the Prometheus rules API

Release v0.7.19

Changes

Observability webhook was moved to the control plane nodes. The component is now treated as critical for the cluster stability.

Release v0.7.18

Changes

Removed internal module labels from prometheus recording rules.

Release v0.7.17

Changes

Temporarily removed namespaces enforcing for cluster rules

Release v0.7.16

Bug fixes

Fixed an issue which caused namespace deletion stuck.

Release v0.7.15

Changes

Apiservice v1alpha1.alerts.observability.deckhouse.io turned off for Kubernetes v 1.32

Release v0.7.14

Bug fixes

Fixed an issue which caused tenant alertmanager configuration load to fail.

Changes

It now creates PrometheusRules in d8-observability namespace. Creating prometheus rules CRs in d8-monitoring namespace caused it to trigger D8CustomPrometheusRuleFoundInCluster alert.

v0.6.0

Features

Added dark theme support for the dashboard visualization components. While the main UI has previously supported dark mode, this update extends theme awareness to full support in dashboards and graphs.
Introduced a new kiosk mode for dashboards. When enabled, all navigation elements and menus are hidden, allowing dashboards to be displayed in full-screen mode — ideal for use on wall-mounted displays or TV screens.

Security

Fixed vulnerabilities related to CVEs (CVE-2025-30153, CVE-2025-47912, CVE-2025-58183, CVE-2025-58185, CVE-2025-58186, CVE-2025-58187, CVE-2025-58188, CVE-2025-58189, CVE-2025-61723, CVE-2025-61724, CVE-2025-61725)

v0.5.6

Changes

Changed module statuses from experimental to preview.

Bug Fixes

Fixed an issue related to authorization token caching that caused incorrect triggering of the built-in alert: D8KubernetesStaleTokensDetected.

v0.5.5

Security

Fixed vulnerabilities related to CVEs

v0.5.4

Changes

Prepared for container v2 — added mount points to images as part of the transition groundwork, no impact on current usage.

v0.5.3

Bug Fixes

Fixed incorrect link mutations in dashboards — previously, some dashboard links could be displayed incorrectly due to a mutation issue.

v0.5.2

Bug Fixes

Fixed an issue related to authorization token caching that caused incorrect triggering of the built-in alert: D8KubernetesStaleTokensDetected.