feat(deps): update dependency otel-operator-source ( v0.132.0 → v0.158.0 ) by chaplain-grimaldus[bot] · Pull Request #1688 · crutonjohn/gitops

chaplain-grimaldus · 2026-02-18T15:17:10Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
otel-operator-source	minor	`v0.132.0` → `v0.158.0`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

open-telemetry/opentelemetry-operator (otel-operator-source)

`v0.158.0`

Compare Source

0.158.0

💡 Enhancements 💡

operator, collector, target allocator: Enable operator, collector, target allocator network policies by default. (#5394)
Feature gate operator.networkpolicy and operand.networkpolicy are promoted to beta, and enabled by default.
These feature gates create network policies for the operator and operand components.
auto-instrumentation: Apache and nginx instrumentations forward Spec env vars to attach init containers so kubelet can expand $(VAR) references in exporter endpoints. (#5333)
collector: promote the operator.collector.usedefaulttelemetryshape feature gate to stable, so the operator-injected Prometheus telemetry reader always uses collector defaults for without_type_suffix, without_units, and without_scope_info (#5075)
The gate is now stable and can no longer be disabled. Users wanting the
pre-v0.154.0 metric name shape should explicitly set
without_type_suffix, without_units, and without_scope_info to false
in their collector configuration. The gate will be removed in a future release.
collector: moves operator.golang.flags to stable setting GOMEMLIMIT and GOMAXPROCS automatically (#5455)

🧰 Bug fixes 🧰

collector: Fix the automatic-upgrade routine binding two Prometheus readers to the same port when a collector already uses service.telemetry.metrics.readers. (#5416)
When an OpenTelemetryCollector already configured service.telemetry.metrics.readers
(added by earlier defaulting), the automatic version-upgrade routine still backfilled the
older, deprecated address field for it. The 0.122.0 upgrade step then migrated address
into a new reader, leaving two readers bound to the same host:port. The collector then
failed to start with "address already in use". The 0.111.0 step now skips backfilling
address when readers is already configured, and the 0.122.0 step now skips adding a
reader for address if an equivalent one already exists.
collector: Add PersistentVolume and PersistentVolumeClaim RBAC rules for k8s_cluster receiver automatic RBAC generation. (#5421)
auto-instrumentation: Default OTEL_METRICS_EXPORTER to otlp for Node.js auto-instrumentation so metrics are exported without extra configuration. (#3768)
The Node.js SDK only initializes its metrics pipeline when a metric reader is configured, and the
webhook was not setting one. As a result, metrics silently stopped being exported for anyone relying
on the previous default behavior. The webhook now sets OTEL_METRICS_EXPORTER=otlp by default,
matching the existing behavior for Python auto-instrumentation, unless the user already set it.

Components

`v0.157.0`

Compare Source

0.157.0

💡 Enhancements 💡

target allocator: Allow enabling mTLS between the target allocator and the collector using user-provided certificate Secrets, without requiring cert-manager. (#3982)
When spec.targetAllocator.mtls.useCertManager is set to false, the new mtls.tls block
references user-provided certificates. The CA certificate may be sourced from either a Secret or a
ConfigMap (certificateAuthorityCertificate.secret / .configMap). The target allocator's server
certificate and the collector's client certificate each reference their certificate and private key
independently, so the certificate and key may live in different Secrets. Data keys default to
tls.crt, tls.key and ca.crt and can be overridden per reference. The CA reference is required
in this mode.
operator: Add support for Kubernetes 1.36 (#5354)

🧰 Bug fixes 🧰

target allocator: Seed Prometheus's scrape labels (job, __scheme__, __metrics_path__, __scrape_interval__, __scrape_timeout__, __param_*) before relabel filtering, so keep/drop rules referencing them make the same decisions as Prometheus instead of silently dropping or over-allocating targets (#5246)
The seeded labels also feed the target identity hash, matching Prometheus's post-relabel label partition more closely. With the relabel-config filter strategy enabled, existing targets are re-allocated once on upgrade because their hashes change. The served (pre-relabel) target labels are unchanged.

Components

0.157.0

💡 Enhancements 💡

auto-instrumentation: The autoinstrumentation-dotnet image now bundles the correct native profiler for the platform it is pulled for, fixing arm64 support (the image was already published for arm64 but always contained amd64 binaries). (#3270)
operator-opamp-bridge: Adds support for the OpAMP capability AcceptsRestartCommand to the operator's OpAMP bridge, allowing the operator to restart the collector when requested by an OpAMP server. (#5306)
operator-opamp-bridge: Add an opentelemetry.io/opamp.bridge.mode non-identifying OpAMP AgentDescription attribute so servers can distinguish operator and standalone bridge clients. (#5423)
operator-opamp-bridge: Report the operator-opamp-bridge's own build version as service.version in its OpAMP AgentDescription, instead of always sending an empty string. (#5360)
collector: Add support for setting sessionAffinity and sessionAffinityConfig on the Services created for the Collector (#4455)
target allocator: Support exporting the TargetAllocator's self-telemetry metrics via OTLP, in addition to the Prometheus /metrics endpoint. (#5047)
Configure it under spec.targetAllocator.telemetry.metrics.otlp (OpenTelemetryCollector CR) or
spec.telemetry.metrics.otlp (TargetAllocator CR), with endpoint, protocol (grpc/http), temporality,
headers, TLS and export interval/timeout. Metrics registered directly on the Prometheus registry
(Prometheus service discovery, Go runtime and process collectors) are bridged into the OTLP export
so the Prometheus endpoint and OTLP expose the same metric set.

🧰 Bug fixes 🧰

cluster-observability: Fix dependencies required by the bundled agent and cluster Collector configurations (#3821, #3818)
Follow-ups to the initial ClusterObservability framework so generated
Collectors start cleanly across supported distributions:
- Use K8s Collector distribution for the agent and cluster Collectors,
  defaulting to the operator's Collector version and supporting the
  --clusterobservability-collector-image override. Apply matching version
  labels and canonical component IDs.
- Inject K8S_NODE_NAME, which the bundled kubelet_stats receiver uses
  for its endpoint.
- Report cluster Collector readiness from its StatefulSet so
  ClusterObservability does not remain Pending after the workload is ready.
- Mount the host root at /hostfs for host_metrics and exclude virtual
  and container-runtime filesystems that cannot be scraped reliably.
- On OpenShift, run the agent under the generated spc_t SCC so file_log
  can read root-owned container logs under /var/log/pods.
- On OpenShift, verify kubelet TLS with the platform serving CA.
- Point generated Instrumentation resources to the agent's OTLP/HTTP port
  because auto-instrumentation SDKs commonly use http/protobuf.
collector: Fix OpenShift collector dashboard (#5342)
The collector v0.155.0 renamed the deprecated otelcol_processor_accepted_*/dropped_*/refused_* metrics
to otelcol_processor_memory_limiter_* (open-telemetry/opentelemetry-collector#11203).
The dashboard queries have been updated to use the new metric names.
collector: Register the snake-case spellings of several renamed receivers (kubelet_stats, k8s_objects, resource_detection, fluent_forward, tcp_log, udp_log, ssh_check, cloud_foundry, http_check, flink_metrics) alongside their original spellings when generating RBAC and service ports from a Collector CR, so either spelling produces the same result. (#5317)
These components were renamed to snake_case in opentelemetry-collector-contrib
(#47957 kubeletstats, #47440 k8sobjects, #48525 resourcedetection, #47930
fluentforward, #47369 tcplog, #47370 udplog, #47515 sshcheck, #47932
cloudfoundry, #47505 httpcheck, #47929 flinkmetrics) while keeping the
original names accepted, but the operator only recognized one spelling per
component, so configs using the other spelling got no RBAC/ports or the
wrong service port name. This extends the k8s_attributes fix (#4983) to
the remaining renamed components, and makes NewScraperParser accept
aliases so future renames of this kind are a one-line fix.
target allocator: Fix collector mtls with a TargetAllocator CR (#4297)
This only affected collectors associated with a TargetAllocator CR whose name differs from the
collector's, e.g. via the opentelemetry.io/target-allocator label, causing them to address the
wrong hostname (and TLS certificate) once mTLS was enabled.
target allocator: Refresh stale Prometheus meta labels (e.g. __meta_kubernetes_pod_name) on rediscovered targets whose address is unchanged (#4839)
Target identity is deliberately hashed without meta labels, since Prometheus discards them after
relabeling. But because the allocator's target map is keyed by that same hash, a rediscovered
target whose address is unchanged (e.g. a hostNetwork DaemonSet pod after a restart) was never
recognized as changed, so its stale meta labels persisted until target-allocator itself restarted.
collector: Fix operator crash on startup when Gateway API CRDs are not installed by moving gatewayv1 scheme registration to be gated on autodetect result. (#5357)
auto-instrumentation: Apply security context to Java extension init containers (#5335)
Extension init containers injected alongside the Java agent were not receiving
a security context. This affected both the explicit spec.initContainerSecurityContext
field on the Instrumentation CR and the fallback behaviour that inherits the
security context from the instrumented application container. Only the main
opentelemetry-auto-instrumentation-java init container was having its security
context set; extension containers were always created with a nil security context.
This caused admission failures on clusters with policies that require all
containers to drop capabilities or disallow privilege escalation (e.g. OPA
Gatekeeper). The security context is now applied to all Java-related init
containers at construction time.
target allocator: Propagate the TargetAllocator CR's metadata annotations to all resources created for it, and restrict podAnnotations to the pod template (#4393)
This aligns the TargetAllocator with the OpenTelemetryCollector behavior: CR metadata annotations now land
(respecting the annotations filter) on the Deployment, Service, ConfigMap, ServiceAccount, ServiceMonitor,
PodDisruptionBudget and NetworkPolicy, while podAnnotations is no longer copied to the NetworkPolicy and
PodDisruptionBudget.

Components

`v0.156.0`

Compare Source

0.156.0

🧰 Bug fixes 🧰

collector: Honor spec.observability.metrics.disablePrometheusAnnotations: true on update by removing the operator-stamped prometheus.io annotations from the pod template, not just stopping new ones from being added. (#5043)
Previously the pod-template mutate path preserved any annotation that
existed on the current resource but was absent from the desired render,
so toggling disablePrometheusAnnotations from false to true on an
existing OpenTelemetryCollector left the prometheus.io/scrape, port,
and path annotations stuck on the rolled pods. The operator now stamps
an ownership marker (operator.opentelemetry.io/prometheus-annotations-added)
whenever it adds one of the default prometheus.io/* annotations, and
the mutate path strips those annotations only when the marker is
present on the existing pod template. This preserves prometheus.io/*
annotations the user set out of band on the same collector.

Components

`v0.155.0`

Compare Source

0.155.0

🧰 Bug fixes 🧰

operator: Fix NetworkPolicy and operand network policy defaulting when webhooks run in a separate deployment. (#5288)
collector: Collectors with persistent storage no longer fail with "permission denied" on OpenShift when running under a permissive SCC such as anyuid. (#5224)
On OpenShift, the restricted SCC injects fsGroup from the namespace range, but
permissive SCCs (e.g. anyuid) do not. The controller now defaults
podSecurityContext.fsGroup from the namespace's supplemental-groups or UID range
annotation when no explicit fsGroup is configured. An explicitly set fsGroup is
never overwritten.

Components

`v0.154.0`

Compare Source

0.154.0

🛑 Breaking changes 🛑

collector: Promote the operator.collector.usedefaulttelemetryshape feature gate to beta. The operator-injected Prometheus telemetry reader now uses collector defaults by default — metric names from operator-managed collectors no longer carry type suffixes, units, or scope_info. (#5075)
Users wanting the pre-v0.154.0 metric name shape can disable the gate via --feature-gates=-operator.collector.usedefaulttelemetryshape, or pin without_type_suffix/without_units/without_scope_info to false explicitly under spec.config.service.telemetry. The gate will be promoted to stable and removed in a future release.

💡 Enhancements 💡

collector: Add status.observedGeneration and status.conditions support for OpenTelemetryCollector resources. (#4312)
operator: Add pod-webhook subcommand for running a standalone pod mutation webhook (#5010)
The operator binary now supports a pod-webhook subcommand that runs only the pod mutation
webhook (auto-instrumentation and sidecar injection) without the controllers. This enables
deploying the webhook separately.
opampbridge: Add TLS configuration support to the OpAMP Bridge, including options to disable TLS or skip certificate verification. (#4921)
opamp: Allow standalone OpAMP bridge agents to configure per-agent non-identifying attributes. (#5245)
opamp-bridge: Make standalone OpAMP Bridge manifests and runtime permissions friendlier for OpenShift and namespaced RBAC. (#5277)
operator: Add standalone pod webhook deployment for High Availability on OpenShift (#5010)
On OpenShift with OLM, the pod mutation webhook (auto-instrumentation and sidecar injection)
is now deployed as a standalone Deployment with 2 replicas by default, enabling HA.

OpenShift with OLM:
- The standalone webhook deployment is managed by OLM via the CSV
- Default: 2 replicas for HA
- Pod anti-affinity spreads replicas across different nodes
- PodDisruptionBudget with maxUnavailable: 1 ensures availability during node maintenance
- Only scaling down is supported via OPENSHIFT_WEBHOOK_REPLICAS env var in the Subscription (0 or 1)
- TLS certificates are automatically provisioned by OLM
- Automatic cleanup when operator is uninstalled (OLM garbage collection)
Kubernetes (community bundle):
- No change - pod webhook continues to run as part of the operator deployment
opamp-bridge: OpAMP Bridge standalone mode (#4913)
Standalone mode for OpAMP Bridge allows users to manage collector configuration from a remote
OpAMP server without the need to deploy full Otel Operator.
operator: Move all webhooks to the dedicated webhook deployment. (#5010)
This change moves remaining webhooks (defaulting, validating for: Collector, TargetAllocator, Instrumentation, OpAMPBridge) to the dedicated webhook deployment.
Previously, only the pod mutation webhook was served by the webhook deployment, while the other webhooks were served by the controller-manager.
The dedicated webhook deployment is opt-in and enabled by default only on OpenShift with OLM.

🧰 Bug fixes 🧰

target allocator: Fix silent target loss when group labels are present in static_configs by sorting labels globally in processTargetGroups. (#4967)
ScratchBuilder.Labels() serializes labels in insertion order. When group labels sort
alphabetically after target labels (e.g. vendor > address), Labels.Get() early
termination returns empty, causing hash collisions that silently drop targets.
auto-instrumentation: Use MergeFrom patch for Instrumentation blocked-versions status to avoid overwriting unrelated status fields. (#5243)
target allocator: Accept a prometheus receiver that only declares target_allocator: without a config: block. (#2998)
When the prometheus receiver is configured with only a target_allocator: block and no config:,
reconciliation previously failed with no prometheusConfig available as part of the configuration.
The target allocator supplies scrape configuration externally in this mode (e.g. via discovered
PrometheusCR objects), so the operator now skips the scrape_configs cleanup when no config:
block is present. The webhook validator likewise permits this shape.

Components

`v0.153.0`

Compare Source

0.153.0

🛑 Breaking changes 🛑

api: Move apis package to a separate sub-module (#4362)
- Yaml standalone functions in internal/otelconfig is moved to a methods on *Config (package apis/v1beta1)
- Move CheckTargetAllocatorPrometheusCRPolicyRules from apis/v1beta1/targetallocator_rbac.go to internal/webhook/targetallocator_rbac.go + rename it to checkTargetAllocatorPrometheusCRPolicyRules.
- OpenTelemetryCollector is not implementing the Convertible interface from sigs.k8s.io/controller-runtime/pkg/conversion, but implements 2 helper function the achieve the same functionality:
  - OtelColConvertTo(otc *OpenTelemetryCollector, dstRaw any) error
  - OtelColConvertFrom(otc *OpenTelemetryCollector, srcRaw any) error
- Move apis package to a dedicated sub-module.
target allocator: The operator.targetallocator.mtls feature gate has been removed. mTLS is now configured per-CR via spec.mtls.enabled on the TargetAllocator or Collector resource. (#5136)
Set spec.mtls.useCertManager: false to provide your own TLS secrets instead of having cert-manager provision them.

💡 Enhancements 💡

collector: Add optional spec.command to OpenTelemetryCollector to override the collector container entrypoint (#3188)
spec.command is a []string matching Pod.spec.containers[].command.
target allocator: Add allowInsecureAuthSecrets option to serve auth secret values over plain HTTP without mTLS (#3746)
Adds a new allowInsecureAuthSecrets field to both the TargetAllocator CRD and the
embedded TargetAllocator in the OpenTelemetryCollector CRD. When enabled, auth secret
values (e.g. basicAuth passwords) are served over plain HTTP instead of being masked.
This is useful when transport security is handled by a service mesh or equivalent.

🧰 Bug fixes 🧰

must-gather: Fix must-gather output to produce omc-compatible directory layout and correct YAML serialization (#4965)
Previously collected files used a per-collector directory with kind-prefixed filenames (e.g. namespaces/<ns>/<collector-name>/deployment-<name>.yaml),
which omc cannot parse. Output now follows the standard omc layout (namespaces/<ns>/<api-group>/<resource-plural>/<name>.yaml).
Also fixes missing apiVersion/kind fields in serialized YAML, incorrect default output directory, and adds collection of CRDs and OpAMPBridge resources.
opamp: Skip OpenTelemetryCollector instances with a non-nil DeletionTimestamp when building EffectiveConfig (#5170)
ListInstances returns objects with DeletionTimestamp set until finalizers complete.
Reporting them as effective races with the bridge's own Delete calls in applyRemoteConfig.
collector: Fix Service reconciliation to propagate trafficDistribution, internalTrafficPolicy, ipFamilies, and ipFamilyPolicy changes (#5141)

Components

`v0.152.0`

Compare Source

0.152.0

🛑 Breaking changes 🛑

api: Move config parsing and CRD metrics from apis to internal package (#4362)
- Methods on *Config (package apis/v1beta1) converted to standalone functions in internal/otelconfig, now taking *v1beta1.Config as the first parameter:
  - GetEnabledComponents, GetReceiverPorts, GetExporterPorts, GetExtensionPorts, GetReceiverAndExporterPorts, GetAllPorts, GetEnvironmentVariables, GetAllRbacRules, ApplyDefaults, GetLivenessProbe, GetReadinessProbe, GetStartupProbe, Yaml, NullObjects
- Methods on *Service converted to functions in internal/otelconfig:
  - MetricsEndpoint, GetTelemetry
  - ApplyDefaults → renamed to ServiceApplyDefaults
- Method on *Telemetry converted to function:
  - ToAnyConfig → renamed to TelemetryToAnyConfig
- Functions moved from apis/v1beta1 to internal/metrics with renames:
  - BootstrapMetrics → Bootstrap
  - NewMetrics(prv, ctx, cl) → New(ctx, prv, cl) (parameter reorder: ctx now first)
- Types moved out of apis/v1beta1:
  - MetricsConfig, Telemetry → internal/otelconfig
  - Metrics → internal/metrics

💡 Enhancements 💡

target allocator: Add support for dropping ServiceMonitor/PodMonitor endpoints that reference arbitrary files (#5104)

auto-instrumentation: Allow to run the mutating webhook using static configuration, without the need for CRDs. (#4201)

With this change, you can deploy the manager as a mutating webhook without setting up a v1alpha1.Instrumentation custom resource
or the v1alpha1.Instrumentation CRD.

Instead, you can now set up instrumentation by configuring the manager via its config file with these settings:

  ignore-missing-collector-crds: true 
  enable-instrumentation-crds: false # Ignore that the CRD is not registered.
  enable-multi-instrumentation: false
  instrumentations: # Static configuration for our instrumentation
    spec:
      exporter:
        endpoint: http://collector.default.svc:4318
      propagators:
        - tracecontext
        - baggage
        - b3
      java:
        image: "java-autoinstrumentation:dev"

target allocator: Improve the error message when the target allocator is enabled but the Prometheus receiver is not named exactly "prometheus". (#5017)

When only named instances such as "prometheus/otelcol" are present, the error now lists them and explains that a receiver named exactly "prometheus" is required.

🧰 Bug fixes 🧰

collector: Remove unnecessary RBAC permissions from the events receiver. (#5073)
collector: Fix when configuring a gRPC port for the jaeger_query extension, the collector-extension Service only generates an HTTP port and is missing the gRPC port. (#4912)
collector: Explicitly set without_type_suffix, without_units, and without_scope_info to false on the operator-injected Prometheus telemetry reader. (#5075)

Preserves historical metric names. Without this, users upgrading to a collector containing open-telemetry/opentelemetry-collector#15027 would see operator-managed collector metric names silently change shape. Added alpha feature gate operator.collector.usedefaulttelemetryshape (off by default) to opt into collector defaults instead. The gate will be promoted to beta (on by default) in a future release.
target allocator: Fix scrapeClass tlsConfig fields being silently dropped in target allocator config. (#5101)

scrapeClasses with tlsConfig like the following had their TLS fields silently dropped
when passed to the target allocator:
scrapeClasses:
- name: tls-config
tlsConfig:
caFile: /scrapeclass-ca.pem
insecureSkipVerify: true
collector: Restrict automatic RBAC from users without the necessary permissions (#5105)

If the operator has permission to create ClusterRoles and ClusterRoleBindings, it sets up RBAC
for collectors automatically based on their configuration.
If a user tries to create an OpenTelemetryCollector whose permissions would be automatically
generated this way, and the user doesn't have the permissions themselves, it will be rejected.
If the collector tries to use an existing ServiceAccount, only the permissions missing from
that ServiceAccount are checked this way.
collector: Skip provisioning Services, Ingress, NetworkPolicy, and HPA for sidecar mode collectors since the operator does not control the Pod lifecycle in that mode. PodMonitors are still provisioned when metrics are enabled. (#4934)

Components

`v0.151.0`

Compare Source

0.151.0

🛑 Breaking changes 🛑

auto-instrumentation: Update default Java auto-instrumentation version from 1.33.6 to 2.27.0 (#4996)
This is a breaking change due to HTTP semantic convention changes between versions.
Existing Instrumentation CRs using a 1.x.x version will NOT be automatically upgraded.
To upgrade, manually update the image in your Instrumentation CR after reviewing the migration guide.
See #2542 for details.

💡 Enhancements 💡

target allocator: Add secretNamespaces field to PrometheusCR configuration to make the namespaces watched for secrets configurable instead of hardcoding to the collector namespace. (#4999)
Previously, the Target Allocator always watched the collector namespace for secrets used in
ServiceMonitor/PodMonitor basicAuth and other secret references. Now, the namespaces to watch
for secrets can be explicitly configured via spec.prometheusCR.secretNamespaces.
If not configured, no namespaces are watched for secrets.
operator: Split kubebuilder RBAC markers and restrict pod permissions to get/list/watch only (#3156)
The operator does not create, update, patch, or delete Pod objects directly;
pods are managed by Deployment, DaemonSet, and StatefulSet controllers.
Also reduced targetallocators/finalizers to only the update verb.
target allocator: Introduce kustomizaton manifests for standalone deployment (#4945)

🧰 Bug fixes 🧰

auto-instrumentation: Validate spec.apacheHttpd.configPath and spec.nginx.configFile more strictly for Instrumentations (#4925)
Values from Instrumentation.spec.apacheHttpd.configPath and Instrumentation.spec.nginx.configFile
are now passed to init container scripts as positional arguments instead of being concatenated into
the shell command string, so they are no longer parsed by the shell. They're also restricted to usual Unix
path characters and limited to 256 characters.

Components

`v0.150.0`

Compare Source

0.150.0

🛑 Breaking changes 🛑

auto-instrumentation: Update default .NET auto-instrumentation version from 1.2.0 to 1.15.0 (#4996)
This update addresses security vulnerabilities in versions older than 1.15.0 (CVE-2026-40894, GHSA-g94r-2vxg-569j).
This is a breaking change due to HTTP semantic convention changes between versions.
Existing Instrumentation CRs using version 1.2.0 will NOT be automatically upgraded.
To upgrade, manually update the image in your Instrumentation CR after reviewing the migration guide.
See #2542 for details.

💡 Enhancements 💡

operator: Expose watch-namespace scope via the --watch-namespace CLI flag and the watch-namespace config file field. The WATCH_NAMESPACE environment variable continues to work. (#4379)
auto-instrumentation: Add spec.initContainerSecurityContext to the Instrumentation CRD so users can explicitly set the security context of the auto-instrumentation init containers (Java, NodeJS, Python, DotNet, Apache HTTPD, Nginx). Add spec.go.securityContext for overriding the Go sidecar's defaults. (#4894)
When unset, existing behavior is preserved — init containers inherit the security context
of the first application container being instrumented, and the Go sidecar keeps the hardcoded
defaults required for eBPF (Privileged, RunAsUser: 0). Setting either field explicitly lets
restricted PSA environments declare the exact capabilities they want.
auto-instrumentation: Allow instrumentation upgrades to be blocked for versions containing major breaking changes. (#4646, #2542)
Some instrumentation upgrades involve major breaking changes. The operator can't help with those, but it can
alert the user about them. This change makes this possible. It will also allow us to set the latest version
for new Instrumentation resources by default.
See #2542 for the primary example.

Components

`v0.149.0`

Compare Source

0.149.0

💡 Enhancements 💡

collector: Add support for Gateway API HTTPRoute creation via OpenTelemetryCollector CR (#4361)
operator: Added hostAliases support for OpenTelemetryCollector and TargetAllocator pods (#896)
collector: Support RBAC generation for k8s_leader_elector extension (#4802)
Automatically generates a ClusterRole with permissions to manage leases in the coordination.k8s.io API group for leader election among multiple collector replicas.
collector: Add TLS security profile injection for health_check and jaeger_query extensions (#4871)
When a TLS profile is configured on the cluster, the operator now injects min_version and cipher_suites
into health_check and jaeger_query extension configs

🧰 Bug fixes 🧰

auto-instrumentation: Fix instrumentation init container security context (#4848)
auto-instrumentation: Fix duplicated container names validation to allow the same container name across different language instrumentations. (#4357)
operator: Fix AnyConfig.DeepCopyInto performing shallow copy, causing TargetAllocator Deployment infinite reconciliation loop (#4950)
AnyConfig.DeepCopyInto used maps.Copy which only copied top-level map entries, leaving nested
maps as shared references. When ApplyDefaults injected TLS profile settings (min_version) into
the collector's scrape config, it mutated the informer cache through the shared reference. This
caused the TargetAllocator config hash to alternate between two values on every reconciliation,
triggering an infinite Deployment update loop. The fix uses JSON round-tripping for a true deep copy.
opamp: Fix nil pointer dereference in OpAMP Bridge when validating a remote collector config that omits the processors section (#4970)
v1beta1.Config.Processors is an optional *AnyConfig, but validateComponents dereferenced it unconditionally.
When a remote config without a processors section is applied through a bridge that had componentsAllowed
configured, it panicked and pod restarted. The nil case is now skipped during validation.
operator: Add missing RBAC permission for events.k8s.io API group (#4950)
The operator uses k8s.io/client-go/tools/events which targets the events.k8s.io API group,
but the ClusterRole only granted permission for the core API group. This caused "Server rejected
event" errors when recording events on managed resources in other namespaces.
collector: Register the k8s_attributes spelling alongside k8sattributes when generating RBAC from a Collector CR so either processor name produces the pods/replicasets/etc. permissions the processor needs. (#4922)
The underlying processor was renamed to snake_case in
open-telemetry/opentelemetry-collector-contrib#45901 while keeping the
original spelling accepted, but the operator only parsed the camel form
and emitted no RBAC for configs using the new name.
collector: Generate RBAC for the k8s_attributes processor under its snake_case spelling, matching the camelCase k8sattributes it was renamed from. (#4922)
collector: Expose prometheus receiver api_server port on collector Service and NetworkPolicy (#4949)
auto-instrumentation, opamp, target allocator: Fix Env slice aliasing in Apache HTTPD, Nginx, OpAMP Bridge, and Target Allocator container builders when the spec slice has spare backing-array capacity (#4954)
collector: Remove the kubebuilder default from the sts pod management policy field so it can be properly omitempty (#4875)
This field should not be set on deployment or daemonset collectors.

Components

`v0.148.0`

Compare Source

0.148.0

💡 Enhancements 💡

collector: make the statefulset PodManagementPolicy configurable (#4875)

Components

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone America/New_York)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

…8.0 )

chaplain-grimaldus Bot added the type/minor label Feb 18, 2026

chaplain-grimaldus Bot force-pushed the renovate/otel-operator-source-0.x branch from 4ec8a38 to ebc8005 Compare February 18, 2026 18:13

chaplain-grimaldus Bot changed the title ~~feat(deps): update dependency otel-operator-source ( v0.132.0 → v0.144.0 )~~ feat(deps): update dependency otel-operator-source ( v0.132.0 → v0.145.0 ) Feb 18, 2026

chaplain-grimaldus Bot force-pushed the renovate/otel-operator-source-0.x branch from ebc8005 to 687882f Compare March 9, 2026 15:19

chaplain-grimaldus Bot changed the title ~~feat(deps): update dependency otel-operator-source ( v0.132.0 → v0.145.0 )~~ feat(deps): update dependency otel-operator-source ( v0.132.0 → v0.146.0 ) Mar 9, 2026

chaplain-grimaldus Bot force-pushed the renovate/otel-operator-source-0.x branch from 687882f to 586cb20 Compare March 18, 2026 12:13

chaplain-grimaldus Bot changed the title ~~feat(deps): update dependency otel-operator-source ( v0.132.0 → v0.146.0 )~~ feat(deps): update dependency otel-operator-source ( v0.132.0 → v0.147.0 ) Mar 18, 2026

chaplain-grimaldus Bot force-pushed the renovate/otel-operator-source-0.x branch from 586cb20 to ef3df96 Compare March 23, 2026 12:12

chaplain-grimaldus Bot changed the title ~~feat(deps): update dependency otel-operator-source ( v0.132.0 → v0.147.0 )~~ feat(deps): update dependency otel-operator-source ( v0.132.0 → v0.148.0 ) Mar 23, 2026

chaplain-grimaldus Bot force-pushed the renovate/otel-operator-source-0.x branch from ef3df96 to 210415d Compare April 23, 2026 14:43

chaplain-grimaldus Bot changed the title ~~feat(deps): update dependency otel-operator-source ( v0.132.0 → v0.148.0 )~~ feat(deps): update dependency otel-operator-source ( v0.132.0 → v0.149.0 ) Apr 23, 2026

chaplain-grimaldus Bot force-pushed the renovate/otel-operator-source-0.x branch from 210415d to f05f955 Compare April 27, 2026 17:31

chaplain-grimaldus Bot changed the title ~~feat(deps): update dependency otel-operator-source ( v0.132.0 → v0.149.0 )~~ feat(deps): update dependency otel-operator-source ( v0.132.0 → v0.150.0 ) Apr 27, 2026

chaplain-grimaldus Bot force-pushed the renovate/otel-operator-source-0.x branch from f05f955 to 0d643a3 Compare May 12, 2026 20:32

chaplain-grimaldus Bot changed the title ~~feat(deps): update dependency otel-operator-source ( v0.132.0 → v0.150.0 )~~ feat(deps): update dependency otel-operator-source ( v0.132.0 → v0.151.0 ) May 12, 2026

chaplain-grimaldus Bot force-pushed the renovate/otel-operator-source-0.x branch from 0d643a3 to e60d29d Compare May 25, 2026 21:25

chaplain-grimaldus Bot changed the title ~~feat(deps): update dependency otel-operator-source ( v0.132.0 → v0.151.0 )~~ feat(deps): update dependency otel-operator-source ( v0.132.0 → v0.152.0 ) May 25, 2026

chaplain-grimaldus Bot changed the title ~~feat(deps): update dependency otel-operator-source ( v0.132.0 → v0.152.0 )~~ feat(deps): update dependency otel-operator-source ( v0.132.0 → v0.152.0 ) - autoclosed Jun 10, 2026

chaplain-grimaldus Bot closed this Jun 10, 2026

chaplain-grimaldus Bot deleted the renovate/otel-operator-source-0.x branch June 10, 2026 16:19

chaplain-grimaldus Bot changed the title ~~feat(deps): update dependency otel-operator-source ( v0.132.0 → v0.152.0 ) - autoclosed~~ feat(deps): update dependency otel-operator-source ( v0.132.0 → v0.153.0 ) Jun 10, 2026

chaplain-grimaldus Bot reopened this Jun 10, 2026

chaplain-grimaldus Bot force-pushed the renovate/otel-operator-source-0.x branch from e60d29d to 9be45ec Compare June 10, 2026 18:04

chaplain-grimaldus Bot force-pushed the renovate/otel-operator-source-0.x branch from 9be45ec to 4cc35f5 Compare July 2, 2026 17:42

chaplain-grimaldus Bot changed the title ~~feat(deps): update dependency otel-operator-source ( v0.132.0 → v0.153.0 )~~ feat(deps): update dependency otel-operator-source ( v0.132.0 → v0.154.0 ) Jul 2, 2026

chaplain-grimaldus Bot force-pushed the renovate/otel-operator-source-0.x branch from 4cc35f5 to 7dad8de Compare July 13, 2026 20:08

chaplain-grimaldus Bot changed the title ~~feat(deps): update dependency otel-operator-source ( v0.132.0 → v0.154.0 )~~ feat(deps): update dependency otel-operator-source ( v0.132.0 → v0.155.0 ) Jul 13, 2026

chaplain-grimaldus Bot force-pushed the renovate/otel-operator-source-0.x branch from 7dad8de to 172ea11 Compare July 14, 2026 17:03

chaplain-grimaldus Bot changed the title ~~feat(deps): update dependency otel-operator-source ( v0.132.0 → v0.155.0 )~~ feat(deps): update dependency otel-operator-source ( v0.132.0 → v0.156.0 ) Jul 14, 2026

chaplain-grimaldus Bot force-pushed the renovate/otel-operator-source-0.x branch from 172ea11 to b5f1b28 Compare August 13, 2026 09:04

chaplain-grimaldus Bot changed the title ~~feat(deps): update dependency otel-operator-source ( v0.132.0 → v0.156.0 )~~ feat(deps): update dependency otel-operator-source ( v0.132.0 → v0.157.0 ) Aug 13, 2026

feat(deps): update dependency otel-operator-source ( v0.132.0 → v0.15…

3a7100a

…8.0 )

chaplain-grimaldus Bot force-pushed the renovate/otel-operator-source-0.x branch from b5f1b28 to 3a7100a Compare August 17, 2026 14:21

chaplain-grimaldus Bot changed the title ~~feat(deps): update dependency otel-operator-source ( v0.132.0 → v0.157.0 )~~ feat(deps): update dependency otel-operator-source ( v0.132.0 → v0.158.0 ) Aug 17, 2026

Navigation Menu

feat(deps): update dependency otel-operator-source ( v0.132.0 → v0.158.0 ) - #1688

feat(deps): update dependency otel-operator-source ( v0.132.0 → v0.158.0 )#1688
chaplain-grimaldus[bot] wants to merge 1 commit into
mainfrom
renovate/otel-operator-source-0.x

chaplain-grimaldus Bot commented Feb 18, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

chaplain-grimaldus Bot commented Feb 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

0.158.0

💡 Enhancements 💡

🧰 Bug fixes 🧰

Components

0.157.0

💡 Enhancements 💡

🧰 Bug fixes 🧰

Components

0.157.0

💡 Enhancements 💡

🧰 Bug fixes 🧰

Components

0.156.0

🧰 Bug fixes 🧰

Components

0.155.0

🧰 Bug fixes 🧰

Components

0.154.0

🛑 Breaking changes 🛑

💡 Enhancements 💡

🧰 Bug fixes 🧰

Components

0.153.0

🛑 Breaking changes 🛑

💡 Enhancements 💡

🧰 Bug fixes 🧰

Components

0.152.0

🛑 Breaking changes 🛑

💡 Enhancements 💡

🧰 Bug fixes 🧰

Components

0.151.0

🛑 Breaking changes 🛑

💡 Enhancements 💡

🧰 Bug fixes 🧰

Components

0.150.0

🛑 Breaking changes 🛑

💡 Enhancements 💡

Components

0.149.0

💡 Enhancements 💡

🧰 Bug fixes 🧰

Components

0.148.0

💡 Enhancements 💡

Components

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

chaplain-grimaldus Bot commented Feb 18, 2026 •

edited

Loading