Skip to content

Commit bf8f53d

Browse files
yanhaoluo666yanhaoluo666
authored
Merge branch 'main' into feature/gpu-metrics-high-sampling
2 parents 20d1be5 + 3238922 commit bf8f53d

File tree

20 files changed

+460
-46
lines changed

20 files changed

+460
-46
lines changed

‎.github/workflows/amazon-cloudwatch-observability-integration-test.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,10 @@ jobs:
4848
- appsignals-unsupported
4949
- webhooks-partially-enabled
5050
- webhooks-configured
51+
- deployment-rolling-enabled
52+
- deployment-rolling-disabled
53+
- certificate-recreate-enabled
54+
- certificate-recreate-disabled
5155
steps:
5256
- uses: actions/checkout@v3
5357

‎RELEASE_NOTES‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,25 @@
1+
=======================================================================
2+
amazon-cloudwatch-observability v4.6.0 (2025-10-16)
3+
=======================================================================
4+
Enhancements:
5+
* Upgrade CWAgent Operator to v3.3.0
6+
* Upgrade FluentBit to v3.0.0
7+
* Update FluentBit config to use systemd plugin for retrieving host logs
8+
9+
=======================================================================
10+
amazon-cloudwatch-observability v4.5.0 (2025-09-24)
11+
=======================================================================
12+
Enhancements:
13+
* Support custom configurations for admission webhook with managed resources
14+
* Support ARM GPU instances with DCGM Exporter
15+
* Upgrade CWAgent to v1.300060.0b1248
16+
* Upgrade CWAgent Operator to v3.2.0
17+
* Upgrade Fluent Bit to v2.34.0
18+
* Upgrade Java SDK to v2.11.5
19+
* Upgrade .NET SDK to v1.9.1
20+
* Upgrade DCGM Exporter to 4.4.0-4.5.0-ubuntu22.04
21+
* Upgrade Neuron Monitor to v1.6.0
22+
123
=======================================================================
224
amazon-cloudwatch-observability v4.4.0 (2025-09-04)
325
=======================================================================

‎charts/amazon-cloudwatch-observability/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
apiVersion: v2
22
name: amazon-cloudwatch-observability
3-
version: 4.4.0
3+
version: 4.6.0
44
appVersion: 1.0.0
55
description: A Helm chart for Amazon CloudWatch Observability
66
type: application

‎charts/amazon-cloudwatch-observability/templates/_helpers.tpl‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -427,3 +427,33 @@ Get namespaceSelector value for admission webhooks
427427
{{- end -}}
428428
{{- end -}}
429429
{{- end -}}
430+
431+
{{/*
432+
Returns auto-generated certificate and CA for admission webhooks.
433+
*/}}
434+
{{- define "amazon-cloudwatch-observability.webhookCert" -}}
435+
{{- $tlsCrt := "" }}
436+
{{- $tlsKey := "" }}
437+
{{- $caCrt := "" }}
438+
{{- if .Values.admissionWebhooks.autoGenerateCert.enabled }}
439+
{{- $existingCert := ( lookup "v1" "Secret" .Release.Namespace (include "amazon-cloudwatch-observability.certificateSecretName" .) ) }}
440+
{{- if and (not .Values.admissionWebhooks.autoGenerateCert.recreate) $existingCert }}
441+
{{- $tlsCrt = index $existingCert "data" "tls.crt" }}
442+
{{- $tlsKey = index $existingCert "data" "tls.key" }}
443+
{{- $caCrt = index $existingCert "data" "ca.crt" }}
444+
{{- if not $caCrt }}
445+
{{- $existingWebhook := ( lookup "admissionregistration.k8s.io/v1" "MutatingWebhookConfiguration" "" (printf "%s-mutating-webhook-configuration" (include "amazon-cloudwatch-observability.name" .)) ) }}
446+
{{- $caCrt = (first $existingWebhook.webhooks).clientConfig.caBundle }}
447+
{{- end }}
448+
{{- else }}
449+
{{- $altNames := list ( printf "%s-webhook-service.%s" (include "amazon-cloudwatch-observability.name" .) .Release.Namespace ) ( printf "%s-webhook-service.%s.svc" (include "amazon-cloudwatch-observability.name" .) .Release.Namespace ) ( printf "%s-webhook-service.%s.svc.cluster.local" (include "amazon-cloudwatch-observability.name" .) .Release.Namespace ) -}}
450+
{{- $ca := genCA ( printf "%s-ca" (include "amazon-cloudwatch-observability.name" .) ) ( .Values.admissionWebhooks.autoGenerateCert.expiryDays | int ) -}}
451+
{{- $cert := genSignedCert (include "amazon-cloudwatch-observability.name" .) nil $altNames ( .Values.admissionWebhooks.autoGenerateCert.expiryDays | int ) $ca -}}
452+
{{- $tlsCrt = b64enc $cert.Cert }}
453+
{{- $tlsKey = b64enc $cert.Key }}
454+
{{- $caCrt = b64enc $ca.Cert }}
455+
{{- end }}
456+
{{- $result := dict "Cert" $tlsCrt "Key" $tlsKey "Ca" $caCrt }}
457+
{{- $result | toYaml }}
458+
{{- end }}
459+
{{- end }}

‎charts/amazon-cloudwatch-observability/templates/admission-webhooks/operator-webhook.yaml‎

Lines changed: 12 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,5 @@
11
{{- if and (.Values.admissionWebhooks.autoGenerateCert.enabled) (not .Values.admissionWebhooks.certManager.enabled) (include "amazon-cloudwatch-observability.webhookEnabled" .) }}
2-
{{- $altNames := list ( printf "%s-webhook-service.%s" (include "amazon-cloudwatch-observability.name" .) .Release.Namespace ) ( printf "%s-webhook-service.%s.svc" (include "amazon-cloudwatch-observability.name" .) .Release.Namespace ) ( printf "%s-webhook-service.%s.svc.cluster.local" (include "amazon-cloudwatch-observability.name" .) .Release.Namespace ) -}}
3-
{{- $ca := genCA ( printf "%s-ca" (include "amazon-cloudwatch-observability.name" .) ) ( .Values.admissionWebhooks.autoGenerateCert.expiryDays | int ) -}}
4-
{{- $cert := genSignedCert (include "amazon-cloudwatch-observability.name" .) nil $altNames ( .Values.admissionWebhooks.autoGenerateCert.expiryDays | int ) $ca -}}
2+
{{- $cert := fromYaml (include "amazon-cloudwatch-observability.webhookCert" .) }}
53
apiVersion: v1
64
kind: Secret
75
type: kubernetes.io/tls
@@ -11,8 +9,8 @@ metadata:
119
name: {{ template "amazon-cloudwatch-observability.certificateSecretName" . }}
1210
namespace: {{ .Release.Namespace }}
1311
data:
14-
tls.crt: {{ $cert.Cert | b64enc }}
15-
tls.key: {{ $cert.Key | b64enc }}
12+
tls.crt: {{ $cert.Cert }}
13+
tls.key: {{ $cert.Key }}
1614
---
1715
apiVersion: admissionregistration.k8s.io/v1
1816
kind: MutatingWebhookConfiguration
@@ -29,7 +27,7 @@ webhooks:
2927
name: {{ template "amazon-cloudwatch-observability.webhookServiceName" . }}
3028
namespace: {{ .Release.Namespace }}
3129
path: /mutate-cloudwatch-aws-amazon-com-v1alpha1-instrumentation
32-
caBundle: {{ $ca.Cert | b64enc }}
30+
caBundle: {{ $cert.Ca }}
3331
failurePolicy: {{ .Values.admissionWebhooks.instrumentations.failurePolicy | default .Values.admissionWebhooks.failurePolicy }}
3432
name: minstrumentation.kb.io
3533
namespaceSelector: {{ include "amazon-cloudwatch-observability.namespaceSelector" (list . "instrumentations") }}
@@ -58,7 +56,7 @@ webhooks:
5856
name: {{ template "amazon-cloudwatch-observability.webhookServiceName" . }}
5957
namespace: {{ .Release.Namespace }}
6058
path: /mutate-cloudwatch-aws-amazon-com-v1alpha1-amazoncloudwatchagent
61-
caBundle: {{ $ca.Cert | b64enc }}
59+
caBundle: {{ $cert.Ca }}
6260
failurePolicy: {{ .Values.admissionWebhooks.agents.failurePolicy | default .Values.admissionWebhooks.failurePolicy }}
6361
name: mamazoncloudwatchagent.kb.io
6462
namespaceSelector: {{ include "amazon-cloudwatch-observability.namespaceSelector" (list . "agents") }}
@@ -87,7 +85,7 @@ webhooks:
8785
name: {{ template "amazon-cloudwatch-observability.webhookServiceName" . }}
8886
namespace: {{ .Release.Namespace }}
8987
path: /mutate-v1-pod
90-
caBundle: {{ $ca.Cert | b64enc }}
88+
caBundle: {{ $cert.Ca }}
9189
failurePolicy: {{ .Values.admissionWebhooks.pods.failurePolicy | default .Values.admissionWebhooks.failurePolicy }}
9290
name: mpod.kb.io
9391
namespaceSelector: {{ include "amazon-cloudwatch-observability.namespaceSelector" (list . "pods") }}
@@ -116,7 +114,7 @@ webhooks:
116114
name: {{ template "amazon-cloudwatch-observability.webhookServiceName" . }}
117115
namespace: {{ .Release.Namespace }}
118116
path: /mutate-v1-namespace
119-
caBundle: {{ $ca.Cert | b64enc }}
117+
caBundle: {{ $cert.Ca }}
120118
failurePolicy: {{ .Values.admissionWebhooks.namespaces.failurePolicy | default .Values.admissionWebhooks.pods.failurePolicy | default .Values.admissionWebhooks.failurePolicy }}
121119
name: mnamespace.kb.io
122120
namespaceSelector: {{ include "amazon-cloudwatch-observability.namespaceSelector" (list . "namespaces") }}
@@ -145,7 +143,7 @@ webhooks:
145143
name: {{ template "amazon-cloudwatch-observability.webhookServiceName" . }}
146144
namespace: {{ .Release.Namespace }}
147145
path: /mutate-v1-workload
148-
caBundle: {{ $ca.Cert | b64enc }}
146+
caBundle: {{ $cert.Ca }}
149147
failurePolicy: {{ .Values.admissionWebhooks.workloads.failurePolicy | default .Values.admissionWebhooks.pods.failurePolicy | default .Values.admissionWebhooks.failurePolicy }}
150148
name: mworkload.kb.io
151149
namespaceSelector: {{ include "amazon-cloudwatch-observability.namespaceSelector" (list . "workloads") }}
@@ -184,7 +182,7 @@ webhooks:
184182
name: {{ template "amazon-cloudwatch-observability.webhookServiceName" . }}
185183
namespace: {{ .Release.Namespace }}
186184
path: /validate-cloudwatch-aws-amazon-com-v1alpha1-instrumentation
187-
caBundle: {{ $ca.Cert | b64enc }}
185+
caBundle: {{ $cert.Ca }}
188186
failurePolicy: {{ .Values.admissionWebhooks.instrumentations.failurePolicy | default .Values.admissionWebhooks.failurePolicy }}
189187
name: vinstrumentationcreateupdate.kb.io
190188
namespaceSelector: {{ include "amazon-cloudwatch-observability.namespaceSelector" (list . "instrumentations") }}
@@ -213,7 +211,7 @@ webhooks:
213211
name: {{ template "amazon-cloudwatch-observability.webhookServiceName" . }}
214212
namespace: {{ .Release.Namespace }}
215213
path: /validate-cloudwatch-aws-amazon-com-v1alpha1-instrumentation
216-
caBundle: {{ $ca.Cert | b64enc }}
214+
caBundle: {{ $cert.Ca }}
217215
failurePolicy: Ignore
218216
name: vinstrumentationdelete.kb.io
219217
namespaceSelector: {{ include "amazon-cloudwatch-observability.namespaceSelector" (list . "instrumentations") }}
@@ -241,7 +239,7 @@ webhooks:
241239
name: {{ template "amazon-cloudwatch-observability.webhookServiceName" . }}
242240
namespace: {{ .Release.Namespace }}
243241
path: /validate-cloudwatch-aws-amazon-com-v1alpha1-amazoncloudwatchagent
244-
caBundle: {{ $ca.Cert | b64enc }}
242+
caBundle: {{ $cert.Ca }}
245243
failurePolicy: {{ .Values.admissionWebhooks.agents.failurePolicy | default .Values.admissionWebhooks.failurePolicy }}
246244
name: vamazoncloudwatchagentcreateupdate.kb.io
247245
namespaceSelector: {{ include "amazon-cloudwatch-observability.namespaceSelector" (list . "agents") }}
@@ -270,7 +268,7 @@ webhooks:
270268
name: {{ template "amazon-cloudwatch-observability.webhookServiceName" . }}
271269
namespace: {{ .Release.Namespace }}
272270
path: /validate-cloudwatch-aws-amazon-com-v1alpha1-amazoncloudwatchagent
273-
caBundle: {{ $ca.Cert | b64enc }}
271+
caBundle: {{ $cert.Ca }}
274272
failurePolicy: Ignore
275273
name: vamazoncloudwatchagentdelete.kb.io
276274
namespaceSelector: {{ include "amazon-cloudwatch-observability.namespaceSelector" (list . "agents") }}

‎charts/amazon-cloudwatch-observability/templates/operator-deployment.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,9 @@ spec:
1818
{{- if .Values.manager.podAnnotations }}
1919
{{- include "amazon-cloudwatch-observability.podAnnotations" . | nindent 8 }}
2020
{{- end }}
21+
{{- if .Values.manager.rolling }}
22+
rollme: {{ randAlphaNum 5 | quote }}
23+
{{- end }}
2124
labels:
2225
app.kubernetes.io/name: {{ template "amazon-cloudwatch-observability.name" . }}
2326
control-plane: controller-manager
@@ -42,6 +45,18 @@ spec:
4245
- containerPort: {{ .Values.manager.ports.containerPort }}
4346
name: webhook-server
4447
protocol: TCP
48+
livenessProbe:
49+
httpGet:
50+
path: /healthz
51+
port: 8081
52+
initialDelaySeconds: 15
53+
periodSeconds: 20
54+
readinessProbe:
55+
httpGet:
56+
path: /readyz
57+
port: 8081
58+
initialDelaySeconds: 5
59+
periodSeconds: 10
4560
resources: {{ toYaml .Values.manager.resources | nindent 10 }}
4661
volumeMounts:
4762
- mountPath: /tmp/k8s-webhook-server/serving-certs

‎charts/amazon-cloudwatch-observability/values.yaml‎

Lines changed: 43 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ containerLogs:
1919
fluentBit:
2020
image:
2121
repository: aws-for-fluent-bit
22-
tag: 2.33.2
22+
tag: 3.0.0
2323
tagWindows: 2.31.12-windowsservercore
2424
repositoryDomainMap:
2525
public: public.ecr.aws/aws-observability
@@ -193,43 +193,54 @@ containerLogs:
193193
extra_user_agent container-insights
194194
host-log.conf: |
195195
[INPUT]
196-
Name tail
196+
Name systemd
197197
Tag host.dmesg
198-
Path /var/log/dmesg
199-
Key message
198+
Systemd_Filter _TRANSPORT=kernel
200199
DB /var/fluent-bit/state/flb_dmesg.db
201-
Mem_Buf_Limit 5MB
202-
Skip_Long_Lines On
203-
Refresh_Interval 10
204-
Read_from_Head ${READ_FROM_HEAD}
200+
Path /var/log/journal
201+
Read_From_Tail ${READ_FROM_TAIL}
205202
206203
[INPUT]
207-
Name tail
204+
Name systemd
208205
Tag host.messages
209-
Path /var/log/messages
210-
Parser syslog
206+
Systemd_Filter PRIORITY=0
207+
Systemd_Filter PRIORITY=1
208+
Systemd_Filter PRIORITY=2
209+
Systemd_Filter PRIORITY=3
210+
Systemd_Filter PRIORITY=4
211+
Systemd_Filter PRIORITY=5
212+
Systemd_Filter PRIORITY=6
211213
DB /var/fluent-bit/state/flb_messages.db
212-
Mem_Buf_Limit 5MB
213-
Skip_Long_Lines On
214-
Refresh_Interval 10
215-
Read_from_Head ${READ_FROM_HEAD}
214+
Path /var/log/journal
215+
Read_From_Tail ${READ_FROM_TAIL}
216216
217217
[INPUT]
218-
Name tail
218+
Name systemd
219219
Tag host.secure
220-
Path /var/log/secure
221-
Parser syslog
220+
Systemd_Filter SYSLOG_FACILITY=10
222221
DB /var/fluent-bit/state/flb_secure.db
223-
Mem_Buf_Limit 5MB
224-
Skip_Long_Lines On
225-
Refresh_Interval 10
226-
Read_from_Head ${READ_FROM_HEAD}
222+
Path /var/log/journal
223+
Read_From_Tail ${READ_FROM_TAIL}
227224
228225
[FILTER]
229226
Name aws
230227
Match host.*
231228
imds_version v2
232229
230+
[FILTER]
231+
Name grep
232+
Match host.messages
233+
Exclude SYSLOG_FACILITY /^(2|9|10)$/
234+
235+
[FILTER]
236+
Name modify
237+
Match host.*
238+
Rename _HOSTNAME host
239+
Rename MESSAGE message
240+
Rename SYSLOG_IDENTIFIER ident
241+
Rename SYSLOG_PID pid
242+
Remove_regex [A-Z]
243+
233244
[OUTPUT]
234245
Name cloudwatch_logs
235246
Match host.*
@@ -1037,7 +1048,7 @@ manager:
10371048
name:
10381049
image:
10391050
repository: cloudwatch-agent-operator
1040-
tag: 3.1.1
1051+
tag: 3.3.0
10411052
repositoryDomainMap:
10421053
public: public.ecr.aws/cloudwatch-agent
10431054
cn-north-1: 934860584483.dkr.ecr.cn-north-1.amazonaws.com.cn
@@ -1048,15 +1059,15 @@ manager:
10481059
java:
10491060
repositoryDomain: public.ecr.aws/aws-observability
10501061
repository: adot-autoinstrumentation-java
1051-
tag: v2.11.2
1062+
tag: v2.11.5
10521063
python:
10531064
repositoryDomain: public.ecr.aws/aws-observability
10541065
repository: adot-autoinstrumentation-python
1055-
tag: v0.9.0
1066+
tag: v0.12.1
10561067
dotnet:
10571068
repositoryDomain: public.ecr.aws/aws-observability
10581069
repository: adot-autoinstrumentation-dotnet
1059-
tag: v1.9.0
1070+
tag: v1.9.1
10601071
nodejs:
10611072
repositoryDomain: public.ecr.aws/aws-observability
10621073
repository: adot-autoinstrumentation-node
@@ -1197,6 +1208,8 @@ manager:
11971208
affinity: {}
11981209
nodeSelector:
11991210
kubernetes.io/os: linux
1211+
# Enable automatic rolling by forcing a deployment spec change
1212+
rolling: false
12001213
## Admission webhooks make sure only requests with correctly formatted rules will get into the Operator.
12011214
admissionWebhooks:
12021215
create: true
@@ -1245,6 +1258,7 @@ admissionWebhooks:
12451258
autoGenerateCert:
12461259
enabled: true
12471260
expiryDays: 3650 # 10 years
1261+
recreate: true
12481262
## TLS Certificate Option 2: Use certManager to generate self-signed certificate.
12491263
## certManager must be enabled. If enabled, it takes precedence over option 1.
12501264
certManager:
@@ -1270,7 +1284,7 @@ agent:
12701284
replicas: 1 # The total number non-terminated pods targeted by this AmazonCloudWatchAgent's deployment or statefulSet.
12711285
image:
12721286
repository: cloudwatch-agent
1273-
tag: 1.300059.0b1207
1287+
tag: 1.300060.0b1248
12741288
repositoryDomainMap:
12751289
public: public.ecr.aws/cloudwatch-agent
12761290
cn-north-1: 934860584483.dkr.ecr.cn-north-1.amazonaws.com.cn
@@ -1363,7 +1377,7 @@ dcgmExporter:
13631377
name:
13641378
image:
13651379
repository: dcgm-exporter
1366-
tag: 4.3.1-4.4.0-ubuntu22.04
1380+
tag: 4.4.0-4.5.0-ubuntu22.04
13671381
repositoryDomainMap:
13681382
public: nvcr.io/nvidia/k8s
13691383
cn-north-1: 934860584483.dkr.ecr.cn-north-1.amazonaws.com.cn
@@ -1534,7 +1548,7 @@ neuronMonitor:
15341548
name:
15351549
image:
15361550
repository: neuron-monitor
1537-
tag: 1.5.1
1551+
tag: 1.6.0
15381552
repositoryDomainMap:
15391553
public: public.ecr.aws/neuron
15401554
resources:

‎integration-tests/amazon-cloudwatch-observability/terraform/minikube/scenarios/certificate-recreate-disabled/main.tf‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
2+
// SPDX-License-Identifier: MIT
3+
4+
module "base" {
5+
source = "../.."
6+
helm_dir = var.helm_dir
7+
helm_values_file = "${path.module}/values.yaml"
8+
}
9+
10+
variable "helm_dir" {
11+
type = string
12+
default = "../../../../../../charts/amazon-cloudwatch-observability"
13+
}
14+
15+
resource "null_resource" "validator" {
16+
depends_on = [module.base.helm_release]
17+
18+
provisioner "local-exec" {
19+
command = <<-EOT
20+
go test ${var.test_dir} -v -run=TestCertificateRecreateDisabled_Save
21+
helm upgrade --wait --create-namespace --namespace amazon-cloudwatch amazon-cloudwatch-observability ${var.helm_dir} -f ${path.module}/values.yaml
22+
go test ${var.test_dir} -v -run=TestCertificateRecreateDisabled_Compare
23+
EOT
24+
}
25+
}
26+
27+
variable "test_dir" {
28+
type = string
29+
default = "../../../../validations/minikube/scenarios"
30+
}
31+

0 commit comments

Comments
 (0)