Skip to content
Release Radar

OpenTelemetry Operator

Monitoring & Observability

Kubernetes operator for the OpenTelemetry Collector and auto-instrumentation

open-telemetry/opentelemetry-operatorWebsiteDocumentation
v0.159.028 days after v0.158.0
View on GitHub

Part of OpenTelemetry

Release history

v0.159.0

CompareGitHub

0.159.0

πŸ›‘ Breaking changes πŸ›‘

  • target allocator: Add none as an explicit filter strategy and preserve explicitly configured empty strategies. (#5444) The Go type of TargetAllocatorSpec.FilterStrategy changed to a pointer so typed clients can distinguish an unset strategy from an explicitly configured value. The legacy empty value remains accepted as an alias for disabling filtering, but new configurations should use none. The Target Allocator now rejects any other value of filter_strategy on startup, and normalizes the empty value to none when loading its configuration.

πŸ’‘ Enhancements πŸ’‘

  • collector: Add resizePolicy to the OpenTelemetryCollector CR to control how the primary container responds to in-place resource resizes. (#5501)

  • opampbridge: Add explicit proxy configuration for OpAMP Bridge server connections. (#5351)

  • target allocator: Add an allocation_strategy_config section to the target allocator configuration, allowing the per-node fallback strategy to be set via allocation_strategy_config.per_node.fallback_strategy.name. (#5183) The top-level allocation_fallback_strategy option is now deprecated in favor of the new strategy-specific configuration. When both are set, the strategy-specific option takes precedence.

  • target allocator: Add API fields to configure the TargetAllocator's OTLP self-telemetry export. (#5047) Adds spec.targetAllocator.telemetry.metrics.readers on the OpenTelemetryCollector CR and spec.telemetry.metrics.readers on the TargetAllocator CR. The schema mirrors the OTel declarative configuration spec. The operator renders these fields into the TargetAllocator ConfigMap consumed by the binary-side OTLP self-telemetry support. When the operand.networkpolicy feature gate is enabled, the TargetAllocator's generated NetworkPolicy now leaves egress unrestricted if self-telemetry export is configured, since its destination can be an arbitrary (often external) endpoint that can't be scoped with a NetworkPolicy IPBlock/selector.

🧰 Bug fixes 🧰

  • collector: Report a Ready=False status condition and a Warning event on the OpenTelemetryCollector when the referenced TargetAllocator cannot be fetched or the collector manifests cannot be built, instead of only logging the error in the operator. (#4296)

  • collector: Detect changes to the immutable StatefulSet podManagementPolicy field so the collector StatefulSet is recreated instead of failing reconciliation with a forbidden update error. (#4203)

  • operator: Resolve the operator's own Deployment through pod owner references instead of a hardcoded name, so the operator NetworkPolicy no longer crashes the operator or selects no pods when installed with custom names (e.g. via the Helm chart). (#5493)

  • operator: Add API server discovery fallback to env vars and guard CSV controller on non-OLM clusters. (#5493) When EndpointSlice discovery fails, the operator now falls back to KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT environment variables for API server discovery. The CSV webhook controller is skipped on clusters without OLM (operators.coreos.com CRDs not present).

  • opamp: Rebuild the OpAMP Bridge's applied-keys tracking from cluster state on startup, so a remote config that drops a collector after a bridge restart correctly deletes it. (#5445)

Components

0.158.0

πŸ’‘ Enhancements πŸ’‘

  • operator, collector, target allocator: Enable operator, collector, target allocator network policies by default. (#5394) Feature gate operator.networkpolicy and operand.networkpolicy are promoted to beta, and enabled by default. These feature gates create network policies for the operator and operand components.

  • auto-instrumentation: Apache and nginx instrumentations forward Spec env vars to attach init containers so kubelet can expand $(VAR) references in exporter endpoints. (#5333)

  • collector: promote the operator.collector.usedefaulttelemetryshape feature gate to stable, so the operator-injected Prometheus telemetry reader always uses collector defaults for without_type_suffix, without_units, and without_scope_info (#5075) The gate is now stable and can no longer be disabled. Users wanting the pre-v0.154.0 metric name shape should explicitly set without_type_suffix, without_units, and without_scope_info to false in their collector configuration. The gate will be removed in a future release.

  • collector: moves operator.golang.flags to stable setting GOMEMLIMIT and GOMAXPROCS automatically (#5455)

🧰 Bug fixes 🧰

  • collector: Fix the automatic-upgrade routine binding two Prometheus readers to the same port when a collector already uses service.telemetry.metrics.readers. (#5416) When an OpenTelemetryCollector already configured service.telemetry.metrics.readers (added by earlier defaulting), the automatic version-upgrade routine still backfilled the older, deprecated address field for it. The 0.122.0 upgrade step then migrated address into a new reader, leaving two readers bound to the same host:port. The collector then failed to start with "address already in use". The 0.111.0 step now skips backfilling address when readers is already configured, and the 0.122.0 step now skips adding a reader for address if an equivalent one already exists.
  • collector: Add PersistentVolume and PersistentVolumeClaim RBAC rules for k8s_cluster receiver automatic RBAC generation. (#5421)
  • auto-instrumentation: Default OTEL_METRICS_EXPORTER to otlp for Node.js auto-instrumentation so metrics are exported without extra configuration. (#3768) The Node.js SDK only initializes its metrics pipeline when a metric reader is configured, and the webhook was not setting one. As a result, metrics silently stopped being exported for anyone relying on the previous default behavior. The webhook now sets OTEL_METRICS_EXPORTER=otlp by default, matching the existing behavior for Python auto-instrumentation, unless the user already set it.

Components

0.157.0

πŸ’‘ Enhancements πŸ’‘

  • target allocator: Allow enabling mTLS between the target allocator and the collector using user-provided certificate Secrets, without requiring cert-manager. (#3982) When spec.targetAllocator.mtls.useCertManager is set to false, the new mtls.tls block references user-provided certificates. The CA certificate may be sourced from either a Secret or a ConfigMap (certificateAuthorityCertificate.secret / .configMap). The target allocator's server certificate and the collector's client certificate each reference their certificate and private key independently, so the certificate and key may live in different Secrets. Data keys default to tls.crt, tls.key and ca.crt and can be overridden per reference. The CA reference is required in this mode.

  • operator: Add support for Kubernetes 1.36 (#5354)

🧰 Bug fixes 🧰

  • target allocator: Seed Prometheus's scrape labels (job, __scheme__, __metrics_path__, __scrape_interval__, __scrape_timeout__, __param_*) before relabel filtering, so keep/drop rules referencing them make the same decisions as Prometheus instead of silently dropping or over-allocating targets (#5246) The seeded labels also feed the target identity hash, matching Prometheus's post-relabel label partition more closely. With the relabel-config filter strategy enabled, existing targets are re-allocated once on upgrade because their hashes change. The served (pre-relabel) target labels are unchanged.

Components

0.157.0

πŸ’‘ Enhancements πŸ’‘

  • auto-instrumentation: The autoinstrumentation-dotnet image now bundles the correct native profiler for the platform it is pulled for, fixing arm64 support (the image was already published for arm64 but always contained amd64 binaries). (#3270)
  • operator-opamp-bridge: Adds support for the OpAMP capability AcceptsRestartCommand to the operator's OpAMP bridge, allowing the operator to restart the collector when requested by an OpAMP server. (#5306)
  • operator-opamp-bridge: Add an opentelemetry.io/opamp.bridge.mode non-identifying OpAMP AgentDescription attribute so servers can distinguish operator and standalone bridge clients. (#5423)
  • operator-opamp-bridge: Report the operator-opamp-bridge's own build version as service.version in its OpAMP AgentDescription, instead of always sending an empty string. (#5360)
  • collector: Add support for setting sessionAffinity and sessionAffinityConfig on the Services created for the Collector (#4455)
  • target allocator: Support exporting the TargetAllocator's self-telemetry metrics via OTLP, in addition to the Prometheus /metrics endpoint. (#5047) Configure it under spec.targetAllocator.telemetry.metrics.otlp (OpenTelemetryCollector CR) or spec.telemetry.metrics.otlp (TargetAllocator CR), with endpoint, protocol (grpc/http), temporality, headers, TLS and export interval/timeout. Metrics registered directly on the Prometheus registry (Prometheus service discovery, Go runtime and process collectors) are bridged into the OTLP export so the Prometheus endpoint and OTLP expose the same metric set.

🧰 Bug fixes 🧰

  • cluster-observability: Fix dependencies required by the bundled agent and cluster Collector configurations (#3821, #3818) Follow-ups to the initial ClusterObservability framework so generated Collectors start cleanly across supported distributions:

    • Use K8s Collector distribution for the agent and cluster Collectors, defaulting to the operator's Collector version and supporting the --clusterobservability-collector-image override. Apply matching version labels and canonical component IDs.
    • Inject K8S_NODE_NAME, which the bundled kubelet_stats receiver uses for its endpoint.
    • Report cluster Collector readiness from its StatefulSet so ClusterObservability does not remain Pending after the workload is ready.
    • Mount the host root at /hostfs for host_metrics and exclude virtual and container-runtime filesystems that cannot be scraped reliably.
    • On OpenShift, run the agent under the generated spc_t SCC so file_log can read root-owned container logs under /var/log/pods.
    • On OpenShift, verify kubelet TLS with the platform serving CA.
    • Point generated Instrumentation resources to the agent's OTLP/HTTP port because auto-instrumentation SDKs commonly use http/protobuf.

  • collector: Fix OpenShift collector dashboard (#5342) The collector v0.155.0 renamed the deprecated otelcol_processor_accepted_*/dropped_*/refused_* metrics to otelcol_processor_memory_limiter_* (https://github.com/open-telemetry/opentelemetry-collector/issues/11203). The dashboard queries have been updated to use the new metric names.

  • collector: Register the snake-case spellings of several renamed receivers (kubelet_stats, k8s_objects, resource_detection, fluent_forward, tcp_log, udp_log, ssh_check, cloud_foundry, http_check, flink_metrics) alongside their original spellings when generating RBAC and service ports from a Collector CR, so either spelling produces the same result. (#5317) These components were renamed to snake_case in opentelemetry-collector-contrib (#47957 kubeletstats, #47440 k8sobjects, #48525 resourcedetection, #47930 fluentforward, #47369 tcplog, #47370 udplog, #47515 sshcheck, #47932 cloudfoundry, #47505 httpcheck, #47929 flinkmetrics) while keeping the original names accepted, but the operator only recognized one spelling per component, so configs using the other spelling got no RBAC/ports or the wrong service port name. This extends the k8s_attributes fix (#4983) to the remaining renamed components, and makes NewScraperParser accept aliases so future renames of this kind are a one-line fix.

  • target allocator: Fix collector mtls with a TargetAllocator CR (#4297) This only affected collectors associated with a TargetAllocator CR whose name differs from the collector's, e.g. via the opentelemetry.io/target-allocator label, causing them to address the wrong hostname (and TLS certificate) once mTLS was enabled.

  • target allocator: Refresh stale Prometheus meta labels (e.g. __meta_kubernetes_pod_name) on rediscovered targets whose address is unchanged (#4839) Target identity is deliberately hashed without meta labels, since Prometheus discards them after relabeling. But because the allocator's target map is keyed by that same hash, a rediscovered target whose address is unchanged (e.g. a hostNetwork DaemonSet pod after a restart) was never recognized as changed, so its stale meta labels persisted until target-allocator itself restarted.

  • collector: Fix operator crash on startup when Gateway API CRDs are not installed by moving gatewayv1 scheme registration to be gated on autodetect result. (#5357)

  • auto-instrumentation: Apply security context to Java extension init containers (#5335) Extension init containers injected alongside the Java agent were not receiving a security context. This affected both the explicit spec.initContainerSecurityContext field on the Instrumentation CR and the fallback behaviour that inherits the security context from the instrumented application container. Only the main opentelemetry-auto-instrumentation-java init container was having its security context set; extension containers were always created with a nil security context. This caused admission failures on clusters with policies that require all containers to drop capabilities or disallow privilege escalation (e.g. OPA Gatekeeper). The security context is now applied to all Java-related init containers at construction time.

  • target allocator: Propagate the TargetAllocator CR's metadata annotations to all resources created for it, and restrict podAnnotations to the pod template (#4393) This aligns the TargetAllocator with the OpenTelemetryCollector behavior: CR metadata annotations now land (respecting the annotations filter) on the Deployment, Service, ConfigMap, ServiceAccount, ServiceMonitor, PodDisruptionBudget and NetworkPolicy, while podAnnotations is no longer copied to the NetworkPolicy and PodDisruptionBudget.

Components

…(truncated)

0.156.0

🧰 Bug fixes 🧰

  • collector: Honor spec.observability.metrics.disablePrometheusAnnotations: true on update by removing the operator-stamped prometheus.io annotations from the pod template, not just stopping new ones from being added. (#5043) Previously the pod-template mutate path preserved any annotation that existed on the current resource but was absent from the desired render, so toggling disablePrometheusAnnotations from false to true on an existing OpenTelemetryCollector left the prometheus.io/scrape, port, and path annotations stuck on the rolled pods. The operator now stamps an ownership marker (operator.opentelemetry.io/prometheus-annotations-added) whenever it adds one of the default prometheus.io/ annotations, and the mutate path strips those annotations only when the marker is present on the existing pod template. This preserves prometheus.io/ annotations the user set out of band on the same collector.

Components

0.155.0

🧰 Bug fixes 🧰

  • operator: Fix NetworkPolicy and operand network policy defaulting when webhooks run in a separate deployment. (#5288)
  • collector: Collectors with persistent storage no longer fail with "permission denied" on OpenShift when running under a permissive SCC such as anyuid. (#5224) On OpenShift, the restricted SCC injects fsGroup from the namespace range, but permissive SCCs (e.g. anyuid) do not. The controller now defaults podSecurityContext.fsGroup from the namespace's supplemental-groups or UID range annotation when no explicit fsGroup is configured. An explicitly set fsGroup is never overwritten.

Components

0.154.0

πŸ›‘ Breaking changes πŸ›‘

  • collector: Promote the operator.collector.usedefaulttelemetryshape feature gate to beta. The operator-injected Prometheus telemetry reader now uses collector defaults by default β€” metric names from operator-managed collectors no longer carry type suffixes, units, or scope_info. (#5075) Users wanting the pre-v0.154.0 metric name shape can disable the gate via --feature-gates=-operator.collector.usedefaulttelemetryshape, or pin without_type_suffix/without_units/without_scope_info to false explicitly under spec.config.service.telemetry. The gate will be promoted to stable and removed in a future release.

πŸ’‘ Enhancements πŸ’‘

  • collector: Add status.observedGeneration and status.conditions support for OpenTelemetryCollector resources. (#4312)

  • operator: Add pod-webhook subcommand for running a standalone pod mutation webhook (#5010) The operator binary now supports a pod-webhook subcommand that runs only the pod mutation webhook (auto-instrumentation and sidecar injection) without the controllers. This enables deploying the webhook separately.

  • opampbridge: Add TLS configuration support to the OpAMP Bridge, including options to disable TLS or skip certificate verification. (#4921)

  • opamp: Allow standalone OpAMP bridge agents to configure per-agent non-identifying attributes. (#5245)

  • opamp-bridge: Make standalone OpAMP Bridge manifests and runtime permissions friendlier for OpenShift and namespaced RBAC. (#5277)

  • operator: Add standalone pod webhook deployment for High Availability on OpenShift (#5010) On OpenShift with OLM, the pod mutation webhook (auto-instrumentation and sidecar injection) is now deployed as a standalone Deployment with 2 replicas by default, enabling HA.

    OpenShift with OLM:

    • The standalone webhook deployment is managed by OLM via the CSV
    • Default: 2 replicas for HA
    • Pod anti-affinity spreads replicas across different nodes
    • PodDisruptionBudget with maxUnavailable: 1 ensures availability during node maintenance
    • Only scaling down is supported via OPENSHIFT_WEBHOOK_REPLICAS env var in the Subscription (0 or 1)
    • TLS certificates are automatically provisioned by OLM
    • Automatic cleanup when operator is uninstalled (OLM garbage collection)

    Kubernetes (community bundle):

    • No change - pod webhook continues to run as part of the operator deployment

  • opamp-bridge: OpAMP Bridge standalone mode (#4913) Standalone mode for OpAMP Bridge allows users to manage collector configuration from a remote OpAMP server without the need to deploy full Otel Operator.

  • operator: Move all webhooks to the dedicated webhook deployment. (#5010) This change moves remaining webhooks (defaulting, validating for: Collector, TargetAllocator, Instrumentation, OpAMPBridge) to the dedicated webhook deployment. Previously, only the pod mutation webhook was served by the webhook deployment, while the other webhooks were served by the controller-manager. The dedicated webhook deployment is opt-in and enabled by default only on OpenShift with OLM.

🧰 Bug fixes 🧰

  • target allocator: Fix silent target loss when group labels are present in static_configs by sorting labels globally in processTargetGroups. (#4967) ScratchBuilder.Labels() serializes labels in insertion order. When group labels sort alphabetically after target labels (e.g. vendor > address), Labels.Get() early termination returns empty, causing hash collisions that silently drop targets.

  • auto-instrumentation: Use MergeFrom patch for Instrumentation blocked-versions status to avoid overwriting unrelated status fields. (#5243)

  • target allocator: Accept a prometheus receiver that only declares target_allocator: without a config: block. (#2998) When the prometheus receiver is configured with only a target_allocator: block and no config:, reconciliation previously failed with no prometheusConfig available as part of the configuration. The target allocator supplies scrape configuration externally in this mode (e.g. via discovered PrometheusCR objects), so the operator now skips the scrape_configs cleanup when no config: block is present. The webhook validator likewise permits this shape.

Components

0.153.0

πŸ›‘ Breaking changes πŸ›‘

  • api: Move apis package to a separate sub-module (#4362)

    • Yaml standalone functions in internal/otelconfig is moved to a methods on *Config (package apis/v1beta1)
    • Move CheckTargetAllocatorPrometheusCRPolicyRules from apis/v1beta1/targetallocator_rbac.go to internal/webhook/targetallocator_rbac.go + rename it to checkTargetAllocatorPrometheusCRPolicyRules.
    • OpenTelemetryCollector is not implementing the Convertible interface from sigs.k8s.io/controller-runtime/pkg/conversion, but implements 2 helper function the achieve the same functionality:
      • OtelColConvertTo(otc *OpenTelemetryCollector, dstRaw any) error
      • OtelColConvertFrom(otc *OpenTelemetryCollector, srcRaw any) error
    • Move apis package to a dedicated sub-module.

  • target allocator: The operator.targetallocator.mtls feature gate has been removed. mTLS is now configured per-CR via spec.mtls.enabled on the TargetAllocator or Collector resource. (#5136) Set spec.mtls.useCertManager: false to provide your own TLS secrets instead of having cert-manager provision them.

πŸ’‘ Enhancements πŸ’‘

  • collector: Add optional spec.command to OpenTelemetryCollector to override the collector container entrypoint (#3188) spec.command is a []string matching Pod.spec.containers[].command.

  • target allocator: Add allowInsecureAuthSecrets option to serve auth secret values over plain HTTP without mTLS (#3746) Adds a new allowInsecureAuthSecrets field to both the TargetAllocator CRD and the embedded TargetAllocator in the OpenTelemetryCollector CRD. When enabled, auth secret values (e.g. basicAuth passwords) are served over plain HTTP instead of being masked. This is useful when transport security is handled by a service mesh or equivalent.

🧰 Bug fixes 🧰

  • must-gather: Fix must-gather output to produce omc-compatible directory layout and correct YAML serialization (#4965) Previously collected files used a per-collector directory with kind-prefixed filenames (e.g. namespaces/<ns>/<collector-name>/deployment-<name>.yaml), which omc cannot parse. Output now follows the standard omc layout (namespaces/<ns>/<api-group>/<resource-plural>/<name>.yaml). Also fixes missing apiVersion/kind fields in serialized YAML, incorrect default output directory, and adds collection of CRDs and OpAMPBridge resources.

  • opamp: Skip OpenTelemetryCollector instances with a non-nil DeletionTimestamp when building EffectiveConfig (#5170) ListInstances returns objects with DeletionTimestamp set until finalizers complete. Reporting them as effective races with the bridge's own Delete calls in applyRemoteConfig.

  • collector: Fix Service reconciliation to propagate trafficDistribution, internalTrafficPolicy, ipFamilies, and ipFamilyPolicy changes (#5141)

Components

0.152.0

πŸ›‘ Breaking changes πŸ›‘

  • api: Move config parsing and CRD metrics from apis to internal package (#4362)
    • Methods on *Config (package apis/v1beta1) converted to standalone functions in internal/otelconfig, now taking *v1beta1.Config as the first parameter:
      • GetEnabledComponents, GetReceiverPorts, GetExporterPorts, GetExtensionPorts, GetReceiverAndExporterPorts, GetAllPorts, GetEnvironmentVariables, GetAllRbacRules, ApplyDefaults, GetLivenessProbe, GetReadinessProbe, GetStartupProbe, Yaml, NullObjects
    • Methods on *Service converted to functions in internal/otelconfig:
      • MetricsEndpoint, GetTelemetry
      • ApplyDefaults β†’ renamed to ServiceApplyDefaults
    • Method on *Telemetry converted to function:
      • ToAnyConfig β†’ renamed to TelemetryToAnyConfig
    • Functions moved from apis/v1beta1 to internal/metrics with renames:
      • BootstrapMetrics β†’ Bootstrap
      • NewMetrics(prv, ctx, cl) β†’ New(ctx, prv, cl) (parameter reorder: ctx now first)
    • Types moved out of apis/v1beta1:
      • MetricsConfig, Telemetry β†’ internal/otelconfig
      • Metrics β†’ internal/metrics

πŸ’‘ Enhancements πŸ’‘

  • target allocator: Add support for dropping ServiceMonitor/PodMonitor endpoints that reference arbitrary files (#5104)

  • auto-instrumentation: Allow to run the mutating webhook using static configuration, without the need for CRDs. (#4201)

    With this change, you can deploy the manager as a mutating webhook without setting up a v1alpha1.Instrumentation custom resource or the v1alpha1.Instrumentation CRD.

    Instead, you can now set up instrumentation by configuring the manager via its config file with these settings:

      ignore-missing-collector-crds: true 
  enable-instrumentation-crds: false # Ignore that the CRD is not registered.
  enable-multi-instrumentation: false
  instrumentations: # Static configuration for our instrumentation
    spec:
      exporter:
        endpoint: http://collector.default.svc:4318
      propagators:
        - tracecontext
        - baggage
        - b3
      java:
        image: "java-autoinstrumentation:dev"

  • target allocator: Improve the error message when the target allocator is enabled but the Prometheus receiver is not named exactly "prometheus". (#5017)

    When only named instances such as "prometheus/otelcol" are present, the error now lists them and explains that a receiver named exactly "prometheus" is required.

🧰 Bug fixes 🧰

  • collector: Remove unnecessary RBAC permissions from the events receiver. (#5073)

  • collector: Fix when configuring a gRPC port for the jaeger_query extension, the collector-extension Service only generates an HTTP port and is missing the gRPC port. (#4912)

  • collector: Explicitly set without_type_suffix, without_units, and without_scope_info to false on the operator-injected Prometheus telemetry reader. (#5075)

    Preserves historical metric names. Without this, users upgrading to a collector containing open-telemetry/opentelemetry-collector#15027 would see operator-managed collector metric names silently change shape. Added alpha feature gate operator.collector.usedefaulttelemetryshape (off by default) to opt into collector defaults instead. The gate will be promoted to beta (on by default) in a future release.

  • target allocator: Fix scrapeClass tlsConfig fields being silently dropped in target allocator config. (#5101)

    scrapeClasses with tlsConfig like the following had their TLS fields silently dropped when passed to the target allocator: scrapeClasses:

    • name: tls-config tlsConfig: caFile: /scrapeclass-ca.pem insecureSkipVerify: true

  • collector: Restrict automatic RBAC from users without the necessary permissions (#5105)

    If the operator has permission to create ClusterRoles and ClusterRoleBindings, it sets up RBAC for collectors automatically based on their configuration. If a user tries to create an OpenTelemetryCollector whose permissions would be automatically generated this way, and the user doesn't have the permissions themselves, it will be rejected. If the collector tries to use an existing ServiceAccount, only the permissions missing from that ServiceAccount are checked this way.

  • collector: Skip provisioning Services, Ingress, NetworkPolicy, and HPA for sidecar mode collectors since the operator does not control the Pod lifecycle in that mode. PodMonitors are still provisioned when metrics are enabled. (#4934)

Components

0.151.0

πŸ›‘ Breaking changes πŸ›‘

  • auto-instrumentation: Update default Java auto-instrumentation version from 1.33.6 to 2.27.0 (#4996) This is a breaking change due to HTTP semantic convention changes between versions. Existing Instrumentation CRs using a 1.x.x version will NOT be automatically upgraded. To upgrade, manually update the image in your Instrumentation CR after reviewing the migration guide. See https://github.com/open-telemetry/opentelemetry-operator/issues/2542 for details.

πŸ’‘ Enhancements πŸ’‘

  • target allocator: Add secretNamespaces field to PrometheusCR configuration to make the namespaces watched for secrets configurable instead of hardcoding to the collector namespace. (#4999) Previously, the Target Allocator always watched the collector namespace for secrets used in ServiceMonitor/PodMonitor basicAuth and other secret references. Now, the namespaces to watch for secrets can be explicitly configured via spec.prometheusCR.secretNamespaces. If not configured, no namespaces are watched for secrets.

  • operator: Split kubebuilder RBAC markers and restrict pod permissions to get/list/watch only (#3156) The operator does not create, update, patch, or delete Pod objects directly; pods are managed by Deployment, DaemonSet, and StatefulSet controllers. Also reduced targetallocators/finalizers to only the update verb.

  • target allocator: Introduce kustomizaton manifests for standalone deployment (#4945)

🧰 Bug fixes 🧰

  • auto-instrumentation: Validate spec.apacheHttpd.configPath and spec.nginx.configFile more strictly for Instrumentations (#4925) Values from Instrumentation.spec.apacheHttpd.configPath and Instrumentation.spec.nginx.configFile are now passed to init container scripts as positional arguments instead of being concatenated into the shell command string, so they are no longer parsed by the shell. They're also restricted to usual Unix path characters and limited to 256 characters.

Components

0.150.0

πŸ›‘ Breaking changes πŸ›‘

  • auto-instrumentation: Update default .NET auto-instrumentation version from 1.2.0 to 1.15.0 (#4996) This update addresses security vulnerabilities in versions older than 1.15.0 (CVE-2026-40894, GHSA-g94r-2vxg-569j). This is a breaking change due to HTTP semantic convention changes between versions. Existing Instrumentation CRs using version 1.2.0 will NOT be automatically upgraded. To upgrade, manually update the image in your Instrumentation CR after reviewing the migration guide. See https://github.com/open-telemetry/opentelemetry-operator/issues/2542 for details.

πŸ’‘ Enhancements πŸ’‘

  • operator: Expose watch-namespace scope via the --watch-namespace CLI flag and the watch-namespace config file field. The WATCH_NAMESPACE environment variable continues to work. (#4379)

  • auto-instrumentation: Add spec.initContainerSecurityContext to the Instrumentation CRD so users can explicitly set the security context of the auto-instrumentation init containers (Java, NodeJS, Python, DotNet, Apache HTTPD, Nginx). Add spec.go.securityContext for overriding the Go sidecar's defaults. (#4894) When unset, existing behavior is preserved β€” init containers inherit the security context of the first application container being instrumented, and the Go sidecar keeps the hardcoded defaults required for eBPF (Privileged, RunAsUser: 0). Setting either field explicitly lets restricted PSA environments declare the exact capabilities they want.

  • auto-instrumentation: Allow instrumentation upgrades to be blocked for versions containing major breaking changes. (#4646, #2542) Some instrumentation upgrades involve major breaking changes. The operator can't help with those, but it can alert the user about them. This change makes this possible. It will also allow us to set the latest version for new Instrumentation resources by default. See https://github.com/open-telemetry/opentelemetry-operator/issues/2542 for the primary example.

Components

0.149.0

πŸ’‘ Enhancements πŸ’‘

  • collector: Add support for Gateway API HTTPRoute creation via OpenTelemetryCollector CR (#4361)

  • operator: Added hostAliases support for OpenTelemetryCollector and TargetAllocator pods (#896)

  • collector: Support RBAC generation for k8s_leader_elector extension (#4802) Automatically generates a ClusterRole with permissions to manage leases in the coordination.k8s.io API group for leader election among multiple collector replicas.

  • collector: Add TLS security profile injection for health_check and jaeger_query extensions (#4871) When a TLS profile is configured on the cluster, the operator now injects min_version and cipher_suites into health_check and jaeger_query extension configs

🧰 Bug fixes 🧰

  • auto-instrumentation: Fix instrumentation init container security context (#4848)

  • auto-instrumentation: Fix duplicated container names validation to allow the same container name across different language instrumentations. (#4357)

  • operator: Fix AnyConfig.DeepCopyInto performing shallow copy, causing TargetAllocator Deployment infinite reconciliation loop (#4950) AnyConfig.DeepCopyInto used maps.Copy which only copied top-level map entries, leaving nested maps as shared references. When ApplyDefaults injected TLS profile settings (min_version) into the collector's scrape config, it mutated the informer cache through the shared reference. This caused the TargetAllocator config hash to alternate between two values on every reconciliation, triggering an infinite Deployment update loop. The fix uses JSON round-tripping for a true deep copy.

  • opamp: Fix nil pointer dereference in OpAMP Bridge when validating a remote collector config that omits the processors section (#4970) v1beta1.Config.Processors is an optional *AnyConfig, but validateComponents dereferenced it unconditionally. When a remote config without a processors section is applied through a bridge that had componentsAllowed configured, it panicked and pod restarted. The nil case is now skipped during validation.

  • operator: Add missing RBAC permission for events.k8s.io API group (#4950) The operator uses k8s.io/client-go/tools/events which targets the events.k8s.io API group, but the ClusterRole only granted permission for the core API group. This caused "Server rejected event" errors when recording events on managed resources in other namespaces.

  • collector: Register the k8s_attributes spelling alongside k8sattributes when generating RBAC from a Collector CR so either processor name produces the pods/replicasets/etc. permissions the processor needs. (#4922) The underlying processor was renamed to snake_case in open-telemetry/opentelemetry-collector-contrib#45901 while keeping the original spelling accepted, but the operator only parsed the camel form and emitted no RBAC for configs using the new name.

  • collector: Generate RBAC for the k8s_attributes processor under its snake_case spelling, matching the camelCase k8sattributes it was renamed from. (#4922)

  • collector: Expose prometheus receiver api_server port on collector Service and NetworkPolicy (#4949)

  • auto-instrumentation, opamp, target allocator: Fix Env slice aliasing in Apache HTTPD, Nginx, OpAMP Bridge, and Target Allocator container builders when the spec slice has spare backing-array capacity (#4954)

  • collector: Remove the kubebuilder default from the sts pod management policy field so it can be properly omitempty (#4875) This field should not be set on deployment or daemonset collectors.

Components

0.147.0

πŸ›‘ Breaking changes πŸ›‘

  • apis/v1beta1: Move webhooks from the apis/v1beta1 package to the internal package internal/webhook (#4846)
  • v1alpha1: Move webhooks from the apis/v1alpha1 package to the internal package internal/webhook (#4837)

🧰 Bug fixes 🧰

  • target allocator: Fix Service Monitor/Pod Monitor in TargetAllocator doesnt pick up updates to secrets (#4091) Fixes issue where service/pod Monitors don't pick up updates to secrets.

Components