0.162.0
🛑 Breaking changes 🛑
auto-instrumentation: Block automatic NodeJS instrumentation upgrades across 0.79.0 because of breaking HTTP, network, and database semantic convention changes. (#2542)
To upgrade, manually set spec.nodejs.image to an image using instrumentation 0.79.0 or higher. See #2542 for migration details.
🚀 New components 🚀
-
auto-instrumentation: Add support for auto-instrumentation in PHP applications. (#932)
Auto-instrumentation in PHP applications is disabled by default in operator. Users can enable it by setting the
--enable-php-instrumentationorENABLE_PHP_AUTO_INSTRUMENTATIONenvironment variable totruein operator
and setting up the annotationsinstrumentation.opentelemetry.io/inject-phpandinstrumentation.opentelemetry.io/otel-php-api-version.
For more information, please refer to the documentation. -
auto-instrumentation: Add initial version of autoinstrumentation for ruby (#3762)
Ruby auto-instrumentation is disabled by default. Enable it with--enable-ruby-instrumentation=true.
💡 Enhancements 💡
collector: Inject the cluster TLS profile's supported groups ascurve_preferencesinto generated collector configurations. (#6893)
Receivers and extensions with atlsblock inspec.confignow getcurve_preferencesdefaulted from the
cluster's TLS security profilegroups, following the same defaults-only rule asmin_versionand
cipher_suites: values set by the user are never overridden.
Groups without a collectorcurve_preferencesspelling are logged at operator startup and not injected.
🧰 Bug fixes 🧰
-
operator, target allocator, opamp, auto-instrumentation: Remove the distrusted emSign root CAs from the operator, target allocator, OpAMP bridge, and Python auto-instrumentation images. (#5802)
The operator, target allocator, and OpAMP bridge images require Alpineca-certificates20261020-r0 or later.
The Python auto-instrumentation image requirescertifi2026.10.19 or later and is published as0.66b1-3.
The updated CA bundle removes the distrusted eMudhra emSign roots, includingemSign ECC Root CA - G3.
Images are built with Go 1.27.3, which includes thecrypto/x509security fixes released on 2026-10-19. -
collector: Include the requesting user's UID and extra fields in the SubjectAccessReviews used to check RBAC privilege escalation. (#5659)
Authorizers that rely on these fields, such as AKS with Azure RBAC for Kubernetes Authorization, denied the check
for users who held the required permissions. -
collector, target allocator: Use pointer for TargetAllocator Telemetry field so omitempty works correctly with encoding/json (#5695)
Go's encoding/json does not omit zero-value structs with omitempty. The non-pointer
TelemetryConfig field caused targetAllocator.telemetry to always be serialized during
server-side apply, even when not set, breaking consumers that use a CRD version without
this field. -
collector: Keepservice.telemetryunchanged when the operator cannot parse it, instead of replacing it with the default Prometheus reader. (#5734)
The collector accepts telemetry settings the operator does not parse, such asresource.attributes.
Such a configuration now gets an admission warning, and no default metrics reader is added to it.