v0.1.0

The first release of kubescrape: Kubernetes container logs and Prometheus metrics, shipped as OTLP with every record already attributed to its pod, workload and namespace. A cluster metadata service watches the API server on behalf of the whole cluster; a per-node agent tails container logs with at-least-once delivery, scrapes Prometheus targets (from annotations, ServiceMonitors and PodMonitors), the kubelet and the systemd journal, and exports OTLP.

What is in this release

• Image ghcr.io/johanlindvall/kubescrape:v0.1.0 (also latest), for linux/amd64 and linux/arm64. One image holds both binaries: the metadata service (/kubescrape, the entrypoint) and the agent (/kubescrape-agent). It is the full build, with the journald, Azure Event Hubs and Kubernetes events pipelines compiled in.
• Helm chart kubescrape-0.1.0.tgz, its default image pinned to v0.1.0.
• Manifests kubernetes.yaml (metadata service), agent.yaml (agent DaemonSet), events.yaml (events/Azure singleton) and servicegraph.yaml (trace tier), the image pinned likewise.
• Static binaries kubescrape_v0.1.0_linux_amd64.tar.gz and kubescrape_v0.1.0_linux_arm64.tar.gz: the cgo-free build without the journald reader, for running the metadata service outside a cluster or checking an agent configuration in CI (kubescrape-agent -check-config, -test-config).
• SHA256SUMS for all of the above.

Install

helm install kubescrape \
  https://github.com/JohanLindvall/kubescrape/releases/download/v0.1.0/kubescrape-0.1.0.tgz \
  --namespace monitoring --create-namespace \
  --set agent.otlp.endpoint=my-collector.observability:4317 \
  --set service.otlp.endpoint=my-collector.observability:4317

Before a first install, read docs/FIRST-RUN.md: the pre-flight checklist, what to watch in the first ten minutes, and which counters are worth an alert. Read the accepted security residuals before exposing the OTLP ingest listeners.

Known issue

govulncheck reports GO-2026-6443 in google.golang.org/grpc v1.84.0: a server panic on a request missing its :authority/Host header. It is reachable only from the gRPC listeners, which are opt-in: the agent's OTLP -ingest receiver (agent.ingest.enabled) and the trace tier (serviceGraph.enabled). No grpc release fixes it yet. Where one of those listeners is enabled, restrict who can reach it: agent.ingest.allowFrom and serviceGraph.ingest.allowFrom render NetworkPolicies for exactly that.