What prometheus-operator/prometheus-operator shipped
Written by FoxPlug from the repository's own releases; not affiliated with Prometheus-operator. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/prometheus-operator/prometheus-operator; Prometheus-operator did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of November 2, 2026
What shipped
- Release 0.95.0 added the alertmanagerConfigFileSystemMode field to the Alertmanager CRD and the extraScrapeMetrics field to the Prometheus and PrometheusAgent CRDs. Release
- The Alertmanager CRD gained a spec.web.corsOrigin field, exposed through the new web.cors.origin flag for Alertmanager v0.34.2 and later. Pull request #8933
- The PrometheusAgent controller now writes and removes Probe status bindings when the StatusForConfigurationResources feature gate is on, including rejected Probes. Pull request #8930
- Release 0.95.1 followed because the CI workflow failed to publish the v0.95.0 container images. Release
- Conflicting namespace flags now log errors instead of passing silently. Pull request #8931
- The bundled Alertmanager version was bumped to v0.34.2. Pull request #8932
- The k8s.io dependencies were bumped to v0.37.2. Pull request #8939
- Controller-tools was bumped to v0.23.0, CRDs were regenerated, and the operator version annotation is now inserted even when the controller-gen version annotation is omitted. Pull request #8946
- The push-docker-image.sh script was fixed. Pull request #8945
- Documentation links to proposals moved into accepted and implemented now point to the right files. Pull request #8925
Why it matters
This week brought a feature release with new CRD fields and a follow-up patch because the container images for the first release failed to publish. Users also get Probe status reconciliation for PrometheusAgent behind the feature gate, CORS origin support for Alertmanager, and a bump to Alertmanager v0.34.2.
Changelog entry
- Add alertmanagerConfigFileSystemMode to the Alertmanager CRD and extraScrapeMetrics to the Prometheus and PrometheusAgent CRDs in 0.95.0. Release
- Release 0.95.1 to publish container images after the 0.95.0 CI publish failure. Release
- Add spec.web.corsOrigin to the Alertmanager CRD for Alertmanager v0.34.2 and later. Pull request #8933
- Bump the Alertmanager version to v0.34.2. Pull request #8932
- Reconcile Probe status bindings for PrometheusAgent when StatusForConfigurationResources is enabled. Pull request #8930
- Log errors for conflicting namespace flags. Pull request #8931
- Bump k8s.io dependencies to v0.37.2. Pull request #8939
- Bump controller-tools to v0.23.0 and regenerate CRDs. Pull request #8946
- Fix the push-docker-image.sh script. Pull request #8945
- Fix documentation links to moved proposals. Pull request #8925
- Add test cases for global Telegram config validation. Pull request #8914
- Bump go.mod files to v0.95.0. Pull request #8944
0.95.0 ships new CRD fields for AlertmanagerConfig file handling and extra scrape metrics; 0.95.1 republishes images after a CI publish failure. Plus CORS origin support for Alertmanager and Probe status reconciliation for PrometheusAgent.
This week the project published 0.95.0, adding the alertmanagerConfigFileSystemMode field to the Alertmanager CRD and extraScrapeMetrics to the Prometheus and PrometheusAgent CRDs. A 0.95.1 patch followed because the CI workflow failed to publish the 0.95.0 container images. Alertmanager users get a spec.web.corsOrigin field backed by the new web.cors.origin flag in Alertmanager v0.34.2, which is now the bundled version. The PrometheusAgent controller reconciles Probe status bindings when the StatusForConfigurationResources feature gate is on, logging errors for conflicting namespace flags was added, and dependency and tooling versions were bumped.
Week of October 26, 2026
What shipped
- AlertmanagerConfig Route now supports an optional labels field that propagates labels to alert routing decisions in both v1alpha1 and v1beta1 CRD versions. Pull request #8761
- PrometheusAgent controller now reconciles ScrapeConfig status by writing bindings for each selected ScrapeConfig and cleaning up stale bindings when configurations change. Pull request #8910
- Alertmanager pods now properly roll out when cluster TLS configuration is updated, with a new test verifying the propagation. Pull request #8840
- Added a new --disable-pprof CLI argument to disable the /debug/pprof endpoints for regulated and secure environments. Pull request #8920
- ThanosRuler imagePullPolicy field is now correctly passed to the config-reloader container. Pull request #8916
- New PrometheusOperatorResourceError alerting rules were added to improve operator observability. Pull request #8909
- Prometheus-config-reloader now outputs consistent log entry format across go-kit and slog with timestamp before log level. Pull request #8913
Why it matters
This week brings improvements to configuration propagation, status tracking, and operational flexibility. The changes enhance how alert routing works, improve observability of the operator itself, and provide better control over security-sensitive endpoints.
Changelog entry
- Add labels field support to AlertmanagerConfig Route in v1alpha1 and v1beta1 Pull request #8761
- PrometheusAgent now reconciles ScrapeConfig status with binding information Pull request #8910
- Fix Alertmanager pod rollout on cluster TLS configuration updates Pull request #8840
- Add --disable-pprof CLI flag to disable debug endpoints Pull request #8920
- Pass imagePullPolicy to ThanosRuler config-reloader container Pull request #8916
- Add PrometheusOperatorResourceError alerting rules Pull request #8909
- Fix prometheus-config-reloader log format to put timestamp before level Pull request #8913
New features in prometheus-operator this week: AlertmanagerConfig Route labels support, PrometheusAgent ScrapeConfig status reconciliation, ThanosRuler imagePullPolicy fixes, and --disable-pprof option for secure environments.
This week's prometheus-operator updates focus on operational improvements and configuration management. AlertmanagerConfig now supports route labels for fine-grained alert routing, PrometheusAgent properly reconciles ScrapeConfig status with binding management, and ThanosRuler correctly applies imagePullPolicy settings. We also added a --disable-pprof option for regulated environments and improved logging consistency across components. These changes enhance both functionality and security for Prometheus deployments.
Week of October 19, 2026
What shipped
- Released 0.94.2, rebuilding the busybox base images to remove the Comodo AAA Services root and emSign ECC Root CA - G3 root CAs and rebuilding with Go 1.27.3 to fix vulnerabilities. Release
- AlertmanagerConfig now rejects MSTeamsV2 receivers without a webhook URL, which previously passed selection and then failed config generation for the whole Alertmanager. Pull request #8908
- A CEL rule on WebexConfig now rejects Webex receivers with neither httpConfig.authorization nor httpConfig.bearerTokenSecret at the API server. Pull request #8906
- Validation now rejects Webex receivers missing httpConfig.authorization for v1alpha1 and v1beta1, since Alertmanager refuses to load them. Pull request #8897
- Validation now rejects duplicate time interval names in AlertmanagerConfig for v1alpha1 and v1beta1, matching the existing duplicate receiver name check. Pull request #8896
- Azure SD scrape config now writes
tls_config,follow_redirectsandenable_http2, and setting environment appends instead of replacing the entry so auth and proxy settings are kept. Pull request #8898 - Pushover CR conversion adds sound conversion, checks device, userKeyFile and tokenFile for versions below 0.26.0, shortens device conversion and removes an html check. Pull request #8893
- Added validation test cases for the Rocketchat receiver in AlertmanagerConfig. Pull request #8856
- Updated golangci-lint from v2.14.0 to v2.15.0. Pull request #8905
- Fixed missing quotes and inconsistencies in Alertmanager config and operator logs. Pull request #8900
Why it matters
This week is mostly about validation and reliability: several receiver configurations that Alertmanager would refuse to load are now rejected earlier, and duplicate time interval names are caught before they break config generation. The 0.94.2 release rebuilds base images and Go binaries to drop specific root CAs and address vulnerabilities, and the Azure SD fix keeps HTTP client settings in generated scrape configs.
Changelog entry
- Release 0.94.2: rebuild busybox base images to remove Comodo AAA Services and emSign ECC Root CA - G3 root CAs, and rebuild with Go 1.27.3 for vulnerability fixes. Release
- Reject MSTeamsV2 receivers without a webhook URL in AlertmanagerConfig validation. Pull request #8908
- Add CEL rule rejecting Webex receivers with neither httpConfig.authorization nor httpConfig.bearerTokenSecret. Pull request #8906
- Require httpConfig.authorization for Webex receivers in v1alpha1 and v1beta1 validation. Pull request #8897
- Reject duplicate time interval names in AlertmanagerConfig for v1alpha1 and v1beta1. Pull request #8896
- Write
tls_config,follow_redirectsandenable_http2in Azure SD scrape config and append environment instead of replacing the entry. Pull request #8898 - Update Pushover CR conversion and checks, including sound conversion and version checks for device, userKeyFile and tokenFile. Pull request #8893
- Add validation test cases for the Rocketchat receiver. Pull request #8856
- Update golangci-lint to v2.15.0. Pull request #8905
- Fix missing quotes and inconsistencies in Alertmanager config and operator logs. Pull request #8900
- Merge release 0.94. Pull request #8911
- Cut v0.94.2 maintenance release. Pull request #8907
Prometheus-operator 0.94.2 is out: rebuilt base images drop the Comodo AAA Services and emSign ECC Root CA - G3 root CAs, and Go 1.27.3 fixes vulnerabilities. We also tightened validation for MSTeamsV2, Webex and duplicate time interval names, and fixed Azure SD scrape config fie
Prometheus-operator 0.94.2 is released. The rebuild removes the Comodo AAA Services root and emSign ECC Root CA - G3 root CAs from the base images and moves to Go 1.27.3 to fix vulnerabilities. Alongside the release, validation got stricter: MSTeamsV2 receivers without a webhook URL, Webex receivers without httpConfig.authorization, and duplicate time interval names in AlertmanagerConfig are now rejected before they can break config generation. The Azure SD scrape config now writes tls_config, follow_redirects and enable_http2, and environment no longer drops auth and proxy settings.
Week of October 12, 2026
What shipped
- Added extraScrapeMetrics to the global Prometheus configuration, so users no longer have to repeat the setting per scrape config. Pull request #8810
- Added extraScrapeMetrics to the ServiceMonitor, PodMonitor, Probe and ScrapeConfig CRDs as a per-scrape setting alongside the global option. Pull request #8892
- The log level can now be configured in the runtime config for Prometheus 3.15.0 and higher instead of the log-level command line flag. Pull request #8881
- Added opt-in distroless runtime image variants for the operator, the Prometheus config reloader and the admission webhook, with the existing BusyBox images remaining the default. Pull request #8815
- Added route labels support to the Alertmanager secret config. Pull request #8865
- Improved PagerDuty validation in the CRD so empty routingKey and serviceKey values are rejected before Alertmanager does. Pull request #8842
- Added validation for the Telegram receiver CR. Pull request #8870
- Documented that ServiceMonitor targets must be backed by Pods, since endpoints without a Pod are silently dropped when targetPort matching is used. Pull request #8878
- Added concrete Kubernetes service discovery examples to the ScrapeConfig guide, including Pods in specific namespaces. Pull request #8882
- Documented volume permissions for persistent storage, covering the case where Prometheus running as a non-root user cannot write to NFS or CephFS volumes owned by root. Pull request #8880
Why it matters
This week adds a global extraScrapeMetrics setting and lets the same option be set per scrape config, which removes repetition for users who want extra scrape metrics. It also extends runtime log level configuration for newer Prometheus versions and adds validation for PagerDuty and Telegram receivers. Documentation changes clarify that ServiceMonitor targets must be backed by Pods and explain volume permissions, which addresses common sources of confusion for people deploying the operator.
Changelog entry
- Add extraScrapeMetrics to the global Prometheus configuration. Pull request #8810
- Add extraScrapeMetrics to the ServiceMonitor, PodMonitor, Probe and ScrapeConfig CRDs. Pull request #8892
- Support log level configuration in the runtime config for Prometheus >= 3.15.0. Pull request #8881
- Add opt-in distroless runtime image variants for the operator, config reloader and admission webhook. Pull request #8815
- Add route labels support to the Alertmanager secret config. Pull request #8865
- Reject empty routingKey and serviceKey values in PagerDuty validation. Pull request #8842
- Add validation for the Telegram receiver. Pull request #8870
- Harden testPromReloadRules. Pull request #8845
- Document that ServiceMonitor targets must be backed by Pods. Pull request #8878
- Add Kubernetes service discovery examples to the ScrapeConfig guide. Pull request #8882
- Document volume permissions for persistent storage. Pull request #8880
This week: extraScrapeMetrics in the global Prometheus config and per-scrape CRDs, runtime log level for Prometheus 3.15.0+, distroless image variants, Alertmanager route labels, and PagerDuty and Telegram validation. Docs: ServiceMonitor targets must be backed by Pods.
This week in prometheus-operator: extraScrapeMetrics can now be set in the global Prometheus configuration and per scrape config through ServiceMonitor, PodMonitor, Probe and ScrapeConfig. The log level can be configured in the runtime config for Prometheus 3.15.0 and higher. Opt-in distroless runtime image variants were added for the operator, config reloader and admission webhook, with BusyBox images staying the default. Alertmanager secret config now supports route labels, and validation was improved for PagerDuty and Telegram receivers. Docs now note that ServiceMonitor targets must be backed by Pods and cover volume permissions for persistent storage.
Week of September 28, 2026
What shipped
- PrometheusAgent now reconciles ServiceMonitor status bindings, handling invalid resources, multiple agents, and cleaning up stale bindings on deselection or agent deletion. Pull request #8860
- PrometheusAgent now reconciles PodMonitor status bindings with support for invalid resources and stale binding cleanup on deselection or agent deletion. Pull request #8859
- AlertmanagerConfig now includes finalizers on Alertmanager resources and performs binding garbage collection when configs are deselected or Alertmanager is deleted. Pull request #8843
- Fixed AlertmanagerConfig conversion webhook that was failing when email receivers did not set optional threading fields. Pull request #8858
- Added botToken support for Telegram in Alertmanager global config custom resources. Pull request #8403
- Updated Kubernetes dependencies to v0.37.1. Pull request #8857
- Enhanced Webhook test cases in Alertmanager config with improved test coverage. Pull request #8769
- Split and expanded email validation test cases for Alertmanager config. Pull request #8837
- Simplified detection logic for the StatusForConfigurationResources feature gate. Pull request #8862
Why it matters
This week brought improvements to status binding reconciliation for PrometheusAgent across ServiceMonitor and PodMonitor resources, bringing feature parity with existing Prometheus reconciliation patterns. AlertmanagerConfig also gained missing lifecycle management features including finalizers and binding cleanup. Several bug fixes and test enhancements ensure better reliability when converting and validating alerting configurations.
Changelog entry
- [FEATURE] PrometheusAgent reconciles ServiceMonitor status bindings including invalid resources and stale binding cleanup Pull request #8860
- [FEATURE] PrometheusAgent reconciles PodMonitor status bindings with stale binding cleanup support Pull request #8859
- [FEATURE] AlertmanagerConfig now includes finalizers and binding garbage collection on deselection and deletion Pull request #8843
- [FIX] AlertmanagerConfig conversion webhook no longer fails on email receivers without optional threading field Pull request #8858
- [FEATURE] Added botToken support for Telegram in Alertmanager global config custom resources Pull request #8403
- [CHORE] Updated Kubernetes dependencies to v0.37.1 Pull request #8857
- [TEST] Enhanced Webhook test cases in Alertmanager config Pull request #8769
- [TEST] Expanded email validation test coverage for Alertmanager config Pull request #8837
- [CHORE] Simplified StatusForConfigurationResources feature gate detection Pull request #8862
This week: PrometheusAgent now reconciles ServiceMonitor and PodMonitor status bindings, AlertmanagerConfig gains finalizers and binding cleanup, and fixes for email receiver conversion. Kubernetes dependencies updated to v0.37.1.
Prometheus-operator this week: PrometheusAgent now fully reconciles ServiceMonitor and PodMonitor status bindings with proper cleanup, AlertmanagerConfig implements the missing finalizer and binding garbage collection pattern, email receiver conversion webhook issues resolved, and Telegram botToken support added to Alertmanager global config. Kubernetes dependencies updated to v0.37.1.
Week of September 21, 2026
What shipped
- Version 0.94.1 released with a bugfix restoring update permission on finalizer subresources in the operator's ClusterRole, required by OwnerReferencesPermissionEnforcement when blockOwnerDeletion is set. Release
- RBAC permissions adjusted to scope down default permissions granted to the Prometheus operator service account, granting write permissions on Pods based on repair policy and read permissions on Nodes only when kubelet controller is enabled. Pull request #8828
- ThanosRuler remote-write version filtering fixed to correctly remove unsupported fields from generated configuration instead of just reporting them as ignored. Pull request #8813
- AlertmanagerConfig status subresource now updated during Alertmanager reconciliations. Pull request #8261
- URL validation added for RocketChat receiver configuration fields loaded from secrets, validating
api_url,title_link, andicon_url. Pull request #8224 - URL validation added for PagerDuty receiver configurations loaded from Alertmanager secrets. Pull request #8221
- Validation added for clientAuthType. Pull request #8823
- MS Teams V2 custom resource test cases for Alertmanager Config split into separate test cases. Pull request #8715
- Prometheus LTS latest version updated to v3.13.3. Pull request #8836
Why it matters
Version 0.94.1 fixes critical RBAC issues that affected finalizer operations and makes permissions more restrictive. Several validation improvements for remote write and receiver configurations enhance reliability and security of alerting configurations.
Changelog entry
- [BUGFIX] Restore update permission on finalizer subresources in the operator's ClusterRole, required by OwnerReferencesPermissionEnforcement when blockOwnerDeletion is set. Release
- [CHANGE] Adjust RBAC permissions to scope down default permissions, grant write on Pods based on repair policy, grant read on Nodes only when kubelet controller is enabled. Pull request #8828
- [BUGFIX] Fix ThanosRuler remote-write version filtering to correctly remove unsupported fields from generated configuration. Pull request #8813
- [FEATURE] Update AlertmanagerConfig status subresource during Alertmanager reconciliations. Pull request #8261
- [FEATURE] Add URL validation for RocketChat receiver configuration fields in secrets. Pull request #8224
- [FEATURE] Add URL validation for PagerDuty receiver configurations in secrets. Pull request #8221
- [FEATURE] Add validation for clientAuthType. Pull request #8823
- [CHANGE] Update Prometheus LTS latest version to v3.13.3. Pull request #8836
Prometheus-operator 0.94.1 is out. This release fixes RBAC permissions for finalizers and continues improving validation for alerting receivers and remote write configurations.
Prometheus-operator 0.94.1 is now available. This release addresses RBAC permission scoping for the operator service account, fixes ThanosRuler remote-write field filtering, and adds URL validation for alerting receivers. Updates include improved status handling for AlertmanagerConfigs and enhanced permission controls based on repair policies.
Week of September 14, 2026
What shipped
- Topology sharding now reports unbalanced configurations in the Reconciled condition when the number of shards is not a multiple of the number of zones. Pull request #8670
- Added govulncheck workflow to detect vulnerabilities in dependencies. Pull request #8824
- Enabled unused and whitespace linters in the golangci-lint configuration. Pull request #8827
- Added test verification for TLS connections to Alertmanager. Pull request #8821
- Fixed grammar in PrometheusRule developer documentation. Pull request #8817
Why it matters
The week focused on improving code quality and testing coverage. Topology sharding now provides better visibility into configuration issues, while new linting checks and vulnerability scanning help catch problems earlier in development.
Changelog entry
- Topology sharding now reports unbalanced configurations in Reconciled condition when shards is not a multiple of zone count Pull request #8670
- Added govulncheck workflow for vulnerability detection Pull request #8824
- Enabled unused and whitespace linters in golangci-lint Pull request #8827
- Added TLS connection verification tests for Alertmanager Pull request #8821
This week: topology sharding reports unbalanced configurations, govulncheck workflow added for vulnerability detection, unused and whitespace linters enabled, TLS connection tests for Alertmanager, and documentation grammar fixes.
This week in prometheus-operator: Topology sharding now reports unbalanced configurations in the Reconciled condition when shard counts don't align with zone counts. We added govulncheck workflow for vulnerability detection and enabled additional linters for code quality. TLS connection verification tests for Alertmanager were introduced, and documentation improvements continue.