Releases
avuru obs follows semantic versioning (vX.Y.Z). This page
is the version-level timeline; for granular, dated changes see the
Changelog, and for what's next see the Roadmap.
:::note Pre-1.0 Until v1.0.0, minor bumps may include breaking changes; patch bumps are fixes only. :::
The main trunk. Planned direction (see the Roadmap):
multi-cluster member projects, wider ingest compatibility with dual-write
migration paths, richer auto-tagging, and more clients — a Grafana data source
and a CLI riding the API tokens v0.5 shipped.
Operate it from the UI. Nearly everything an operator changed through
values.yaml now lives in the app: runtime collection control (per-signal
switches the sensor follows in seconds, default-off behind a deliberately
narrow Role), service groups authored in Settings → Groups, an editable
SSO group→role mapping beside the chart's read-only rules, and personal
API tokens — hashed at rest, shown once, resolving to their owner's live
permissions so disabling a user disables every token they hold. The
Dashboard becomes the landing screen — group health, live topology, firing
alerts and Kubernetes capacity in one view — and the service map shows
real status rings from the health rollup, caller-side p50/p95 per edge, hover
focus and shareable filters. Also: sorting and filtering on the Nodes screen,
and a fix for three green endpoints that answered without authentication.
Schema migrations 0016–0018 apply automatically; upgrading is a normal
helm upgrade.
GitHub release
· changelog.
Accounts you can administer. v0.2 created users; v0.4 finishes their
lifecycle. Settings → Users edits a name and role grants, resets passwords
and deletes an account behind a disable-first rule, while a new
Settings → Account tab lets anyone rotate their own password — current
password required, other sessions evicted, yours kept alive. Password
operations are refused for SSO users, whose credential lives at the identity
provider. Reviewing that surface closed three ways into an account: a local
password that could be minted on an SSO-only user, a login lockout that
rotating IP addresses walked straight past, and an SSO login able to take over
a local account's email. Operationally, an install whose schema migration never
ran now repairs itself (hub.autoMigrate) and reports applied-versus-expected
schema in Settings → Status; a non-default ClickHouse database name works;
green survives nodes without RAPL; and login works behind a reverse proxy that
rewrites Host. Upgrading is a normal helm upgrade.
GitHub release
· changelog.
Patch. The chart's image defaults never matched what the release workflow
publishes — wrong repositories and a tag format that was never pushed — so a
helm install with no --set could not resolve the hub, UI, gateway or
TDP-estimator images. Both halves are fixed; the green estimator, which
shipped with no repository at all, now defaults like its siblings. No schema
migration, no API or configuration change.
GitHub release
· changelog.
Tenancy you can trust. v0.2 secured the read side; v0.3 closes the write
side. Projects become something you administer — create, rename and delete
them from the UI, with built-in and config-defined entries kept read-only —
and per-project ingest keys end topology-based trust: keys are validated
in the gateway, and in enforce mode the key's project is the authoritative
tenant, overriding whatever a sender claims (the default log mode changes
nothing about the pipeline, so the drop-in OTLP promise survives the upgrade).
A one-click read-only demo signs a visitor in as a scoped viewer without
the shared password ever reaching the browser. Green now works on the
RAPL-less cloud VMs most fleets run on, with every modeled number labeled
estimated end to end. The runtime collection control plane lands its
groundwork — overlay store, validated API, least-privilege RBAC — and the
deploy layer is renamed avuruops → avuruobs (breaking; see the
upgrade guide).
GitHub release
· changelog.
Depth and control. The five-minute install becomes one a real team can run every day: the hub is secure by default (login, Admin/Editor/Viewer roles granted per project, OIDC SSO with any IdP), signals are modular (one switch per family gates schema, API, pipeline, collection and UI together), and the sensor is provably safe to leave on — CI-enforced. Four new modules build on the data already collected: error tracking (deduplicated, triageable issues plus a browser ingest path), service health groups (criticality tiers with dependency propagation), alerting (SSRF-guarded webhooks on health transitions) and green energy & carbon (per-service Wh/gCO2e, budgets, a CSRD-ready export). Network health lands on the service-map edges. Licensed AGPL-3.0 from this release on. GitHub release · changelog.
The first tagged release: the wedge. A fresh Kubernetes cluster reaches a live service map in under five minutes with zero app changes — enforced as a CI gate. All four v0.1 signal tiers ship — traces (Full), logs (Basic), continuous CPU profiling (Lite, opt-in), infra metrics (Supporting) — plus the OTLP drop-in migration path, a per-project model with collection controls, and a deep trace inspect. GitHub release · changelog.
Once a version is cut, its entry links to the
GitHub release and the
matching changelog items. Releases are cut per the engine repo's
RELEASING.md.