What's Changed
Features
- feat: surface agent, session and exporter config knobs in the Helm chart by @gma1k in #355
- feat: trigger diagnostic sessions on agent-detected alerts by @gma1k in #362
- feat: support multiple TracerConfigs as isolated agent fleets by @gma1k in #382
- feat: resolve each session Job's TracerConfig per node by @gma1k in #384
- feat: add graduation machinery for CRD version cutover by @gma1k in #475
- feat: add always-on workload metrics plane by @gma1k in #486
- feat: add OTel semantic conventions and OTLP metric export by @gma1k in #489
- feat: add workload service map and un-gate all BPF probes by @gma1k in #494
- feat: aggregate metrics in the kernel instead of per-event by @gma1k in #496
- feat: add continuous inspections, saturation metrics and exemplars by @gma1k in #497
- feat: measure Go database/sql connection acquisition time by @gma1k in #498
- feat: add Go pool utilization metrics and user-supplied BTF by @gma1k in #503
- feat: correlate slow requests with symbolised stack frames by @gma1k in #505
- feat: close the continuous apm gaps and enable them by default by @gma1k in #510
- feat: turn every tracerconfig agent toggle on unless set to false by @gma1k in #511
- feat: add podtrace status for a backend-free cluster view by @gma1k in #512
- feat: add on-cpu profiler, flame graphs and p99 request cpu attribution by @gma1k in #513
- feat: attribute request cpu across every protocol and harden capture by @gma1k in #514
- feat: charge event-loop cpu to the connection a loop is serving by @gma1k in #517
- feat: start a session for a chosen issue and open its report with it by @gma1k in #518
- feat: add a per-request critical path and a slow-dns inspection by @gma1k in #519
- feat: add filesystem metrics to the plane and a slow-fs inspection by @gma1k in #522
- feat: add a dns failure rule and count dns lookups by answer by @gma1k in #523
- feat: add a tls failure rule and count go and netty tls handshakes by @gma1k in #524
- feat: link active issues to their likely root cause across workloads by @gma1k in #525
Bug Fixes
- fix: parse boolean env vars via ParseBool so redaction cannot fail open by @gma1k in #368
- fix: append /v1/traces to OTLP endpoints without a path by @gma1k in #373
- fix: fix the Go module path and harden the supply chain by @gma1k in #379
- fix(ci): report dco-check on release-please branches by @gma1k in #380
- fix: confine uprobe target resolution to the traced workload by @gma1k in #389
- fix: skip merge commits in the DCO sign-off check by @gma1k in #393
- fix: stop paired-map leak that silently disables the eBPF tracer by @gma1k in #395
- fix: mount host cgroupfs read-only to close release_agent escap by @gma1k in #402
- fix: constrain TracerConfig agent image to a trusted allowlist by @gma1k in #403
- fix: stop the operator caching and cluster-wide-writing every Secret by @gma1k in #404
- fix: guard tracer map writers against a concurrent Stop by @gma1k in #406
- fix: publish tracer cgroup paths atomically to end read race by @gma1k in #408
- fix: give each event-tee consumer its own copy to end a data race by @gma1k in #409
- fix: size QUIC CRYPTO reassembly from received data, not claimed offset by @gma1k in #410
- fix: bound QPACK dynamic table and sweep idle HTTP/3 connections by @gma1k in #411
- fix: bound HPACK late-join window by bytes, cap field length by @gma1k in #412
- fix: clamp gRPC status and bound the error_code metric label by @gma1k in #414
- fix: cap tracked traces and spans-per-trace to bound the trace map by @gma1k in #418
- fix: confine kubelet-derived cgroup walk roots to the cgroup base by @gma1k in #419
- fix: restore systemd cgroup walk and stop stale h2/h3 record bytes by @gma1k in #420
- fix: clear all side maps on the cgroup-prefilter early-out by @gma1k in #421
- fix: surface kernel event drops in agent metrics and status by @gma1k in #422
- fix: guard exporter egress against SSRF, cleartext, and redirects by @gma1k in #423
- fix: bound CR names stamped into label values to 63 chars by @gma1k in #424
- fix: harden setup scripts/CI and tracer lifecycle races by @gma1k in #425
- fix: rescope Trivy to vuln/secret and fix code-scanning findings by @gma1k in #426
- fix: honor human bool env values and range-check float config by @gma1k in #428
- fix: close PII redaction gaps and CSV formula injection by @gma1k in #429
- fix: harden BPF attribution, bounds, and telemetry integrity by @gma1k in #430
- fix: close operator tenancy gaps and bound session/map lifecycles by @gma1k in #431
- fix: correct BPF L7 parser desyncs and wire the gRPC port knob by @gma1k in #432
- fix: harden agent runtime, resource use, and exporter/alert paths by @gma1k in #433
- fix: harden trace export, metrics, and diagnose resource bounds by @gma1k in #435
- fix: harden pod specs, redact reports, and close filter/tee gaps by @gma1k in #436
- fix: harden L7 decoders, redaction, alerting, and CLI lifecycle by @gma1k in #438
- fix: harden GCS credential loading and unblock lint on go 1.27 by @gma1k in #444
- fix: repair the first-run experience and uninstall cleanup by @gma1k in #495
- fix: correct process names and pool figures in the diagnose report by @gma1k in #500
- fix: report pool peak connections and connection age consistently by @gma1k in #502
- fix: harden bpf attribution, tls capture and restart tracing by @gma1k in #528
- fix: harden uprobe target resolution and untrusted elf parsing by @gma1k in #530
- fix: harden l7 decoder state, memory bounds and drop accounting by @gma1k in #531
- fix: harden operator tenancy, session lifecycle and agent shutdown by @gma1k in #532
- fix: harden metrics plane label safety, tenancy and L7 attribution by @gma1k in #534
- fix: harden diagnose stack symbolisation, sampling and report accuracy by @gma1k in #536
- fix: harden cli spawn, target selection and cluster access by @gma1k in #537
- fix: harden exporter egress, credentials and delivery reporting by @gma1k in #538
- fix: harden chart defaults, release pipeline and e2e coverage by @gma1k in #540
Performance
Documentation
- docs: point FOSSA badges at the CI project locator by @gma1k in #354
- docs: reconcile CRD inventory in STABILITY.md (four to six) by @olamilekan000 in #415
- docs: define API versioning and CRD graduation policy by @gma1k in #455
- docs: define the exported metrics surface as a contract by @gma1k in #482
- docs: document clang 18+ and libbpf 0.8+ build prerequisites by @ArijHabbechi in #521
- docs: describe continuous apm in the readme and update dependencies by @gma1k in #527
Tests
- test: fully cover alert-triggered sessions and gate envtest in CI by @gma1k in #374
- test: build fake google api key at runtime in redactor test by @gma1k in #539
CI / Build
- ci: replace sticky release-as override with one-shot footer trigger by @gma1k in #350
- ci: scan licenses and dependencies with the FOSSA CLI and exclude the intentional GPL-2.0 bpf/ by @gma1k in #353
- ci: add version, build, tests and coverage badges to README by @gma1k in #363
- ci: stabilise chainsaw and skip it for release-please PRs by @gma1k in #375
- ci: require DCO sign-off on every commit by @gma1k in #377
- build: remove dead BPF pid/tid stores, gate warnings, fix sudo hygiene by @gma1k in #441
- ci: disable codeql trap caching to fix cpp analysis on ubuntu 26.04 by @gma1k in #509
- build: check for clang 18+ before compiling the eBPF objects by @gma1k in #520
Maintenance
- chore: fix issue-form labels, add config.yml and community docs by @gma1k in #364
- chore: pin golangci-lint in make lint and document code style by @gma1k in #367
- chore: auto-maintain Artifact Hub scanned image digests by @gma1k in #405
- chore: gofmt the repo and gate formatting in CI by @gma1k in #440
- chore: update go to 1.27.0 and golangci-lint to 2.13.0 by @gma1k in #446
- chore: tidy go.mod and gate tidiness in CI by @gma1k in #447
- chore: run go mod tidy in renovate updates to satisfy the CI tidiness gate by @gma1k in #451
- refactor: unify CRD field naming before v1beta1 graduation by @gma1k in #459
- chore(renovate): require dashboard approval for k8s ecosystem Go major bumps by @gma1k in #491
- chore(renovate): replace k8s major approval gate with a structured-merge-diff version hold by @gma1k in #493
- chore: update dependencies, toolchain pins and generated client by @gma1k in #508
New Contributors
- @ArijHabbechi made their first contribution in #521
Full Changelog: v0.14.0...v0.15.0