Release 4.6.0

.github/workflows/amazon-cloudwatch-observability-integration-test.yaml

@@ -213,4 +213,4 @@ jobs:
           retry_wait_seconds: 5
           command: |
             cd integration-tests/amazon-cloudwatch-observability/terraform/eks/windows
-            terraform destroy --auto-approve
+            terraform destroy --auto-approve

RELEASE_NOTES

@@ -1,3 +1,25 @@
+=======================================================================
+amazon-cloudwatch-observability v4.6.0 (2025-10-16)
+=======================================================================
+Enhancements:
+* Upgrade CWAgent Operator to v3.3.0
+* Upgrade FluentBit to v3.0.0
+* Update FluentBit config to use systemd plugin for retrieving host logs
+
+=======================================================================
+amazon-cloudwatch-observability v4.5.0 (2025-09-24)
+=======================================================================
+Enhancements:
+* Support custom configurations for admission webhook with managed resources
+* Support ARM GPU instances with DCGM Exporter
+* Upgrade CWAgent to v1.300060.0b1248
+* Upgrade CWAgent Operator to v3.2.0
+* Upgrade Fluent Bit to v2.34.0
+* Upgrade Java SDK to v2.11.5
+* Upgrade .NET SDK to v1.9.1
+* Upgrade DCGM Exporter to 4.4.0-4.5.0-ubuntu22.04
+* Upgrade Neuron Monitor to v1.6.0
+
 =======================================================================
 amazon-cloudwatch-observability v4.4.0 (2025-09-04)
 =======================================================================

charts/amazon-cloudwatch-observability/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v2
 name: amazon-cloudwatch-observability
-version: 4.4.0
+version: 4.6.0
 appVersion: 1.0.0
 description: A Helm chart for Amazon CloudWatch Observability
 type: application

charts/amazon-cloudwatch-observability/templates/_helpers.tpl

@@ -320,3 +320,56 @@ Define the default service name
 {{- define "amazon-cloudwatch-observability.webhookServiceName" -}}
 {{- default (printf "%s-webhook-service" (include "amazon-cloudwatch-observability.name" .)) .Values.manager.service.name }}
 {{- end -}}
+
+{{/*
+Check if a specific admission webhook is enabled
+*/}}
+{{- define "amazon-cloudwatch-observability.isWebhookEnabled" -}}
+{{- $ctx := index . 0 -}}
+{{- $webhook := index . 1 -}}
+{{- $webhookConfig := index $ctx.Values.admissionWebhooks $webhook -}}
+{{- if hasKey $webhookConfig "create" -}}
+{{- if $webhookConfig.create }}true{{- end -}}
+{{- else -}}
+{{- if $ctx.Values.admissionWebhooks.create }}true{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Check if any admission webhook is enabled
+*/}}
+{{- define "amazon-cloudwatch-observability.webhookEnabled" -}}
+{{- $webhooks := list "agents" "instrumentations" "pods" "workloads" "namespaces" -}}
+{{- range $webhook := $webhooks -}}
+{{- if include "amazon-cloudwatch-observability.isWebhookEnabled" (list $ $webhook) -}}
+true
+{{- break -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Get namespaceSelector value for admission webhooks
+*/}}
+{{- define "amazon-cloudwatch-observability.namespaceSelector" -}}
+{{- $ctx := index . 0 -}}
+{{- $webhook := index . 1 -}}
+{{- $webhookConfig := index $ctx.Values.admissionWebhooks $webhook -}}
+{{- if and (hasKey $webhookConfig "namespaceSelector") (ne $webhookConfig.namespaceSelector nil) -}}
+{{- $selector := $webhookConfig.namespaceSelector -}}
+{{- if $selector -}}
+{{- toYaml $selector | nindent 4 -}}
+{{- else -}}
+{}
+{{- end -}}
+{{- else -}}
+{{- $selector := $ctx.Values.admissionWebhooks.namespaceSelector -}}
+{{- if $selector -}}
+{{- toYaml $selector | nindent 4 -}}
+{{- else -}}
+{}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+

charts/amazon-cloudwatch-observability/templates/admission-webhooks/operator-webhook-with-cert-manager.yaml

@@ -1,4 +1,4 @@
-{{- if and (.Values.admissionWebhooks.create) (.Values.admissionWebhooks.certManager.enabled) }}
+{{- if and (.Values.admissionWebhooks.certManager.enabled) (include "amazon-cloudwatch-observability.webhookEnabled" .) }}
 apiVersion: admissionregistration.k8s.io/v1
 kind: MutatingWebhookConfiguration
 metadata:
@@ -8,23 +8,21 @@ metadata:
     {{- include "amazon-cloudwatch-observability.labels" . | nindent 4}}
   name: {{ template "amazon-cloudwatch-observability.name" . }}-mutating-webhook-configuration
 webhooks:
+{{- if include "amazon-cloudwatch-observability.isWebhookEnabled" (list . "instrumentations") }}
 - admissionReviewVersions:
   - v1
   clientConfig:
     service:
       name: {{ template "amazon-cloudwatch-observability.webhookServiceName" . }}
       namespace: {{ .Release.Namespace }}
       path: /mutate-cloudwatch-aws-amazon-com-v1alpha1-instrumentation
-  failurePolicy: {{ .Values.admissionWebhooks.failurePolicy }}
+  failurePolicy: {{ .Values.admissionWebhooks.instrumentations.failurePolicy | default .Values.admissionWebhooks.failurePolicy }}
   name: minstrumentation.kb.io
-    {{- if .Values.admissionWebhooks.namespaceSelector }}
-  namespaceSelector:
-    {{- toYaml .Values.admissionWebhooks.namespaceSelector | nindent 6 }}
-    {{- end }}
-    {{- if .Values.admissionWebhooks.objectSelector }}
+  namespaceSelector: {{ include "amazon-cloudwatch-observability.namespaceSelector" (list . "instrumentations") }}
+  {{- if .Values.admissionWebhooks.objectSelector }}
   objectSelector:
-    {{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
-    {{- end }}
+  {{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
+  {{- end }}
   rules:
   - apiGroups:
     - cloudwatch.aws.amazon.com
@@ -37,23 +35,22 @@ webhooks:
     - instrumentations
   sideEffects: None
   timeoutSeconds: {{ .Values.admissionWebhooks.timeoutSeconds }}
+{{- end }}
+{{- if include "amazon-cloudwatch-observability.isWebhookEnabled" (list . "agents") }}
 - admissionReviewVersions:
   - v1
   clientConfig:
     service:
       name: {{ template "amazon-cloudwatch-observability.webhookServiceName" . }}
       namespace: {{ .Release.Namespace }}
       path: /mutate-cloudwatch-aws-amazon-com-v1alpha1-amazoncloudwatchagent
-  failurePolicy: {{ .Values.admissionWebhooks.failurePolicy }}
+  failurePolicy: {{ .Values.admissionWebhooks.agents.failurePolicy | default .Values.admissionWebhooks.failurePolicy }}
   name: mamazoncloudwatchagent.kb.io
-    {{- if .Values.admissionWebhooks.namespaceSelector }}
-  namespaceSelector:
-    {{- toYaml .Values.admissionWebhooks.namespaceSelector | nindent 6 }}
-    {{- end }}
-    {{- if .Values.admissionWebhooks.objectSelector }}
+  namespaceSelector: {{ include "amazon-cloudwatch-observability.namespaceSelector" (list . "agents") }}
+  {{- if .Values.admissionWebhooks.objectSelector }}
   objectSelector:
-    {{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
-    {{- end }}
+  {{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
+  {{- end }}
   rules:
   - apiGroups:
     - cloudwatch.aws.amazon.com
@@ -66,23 +63,22 @@ webhooks:
     - amazoncloudwatchagents
   sideEffects: None
   timeoutSeconds: {{ .Values.admissionWebhooks.timeoutSeconds }}
+{{- end }}
+{{- if include "amazon-cloudwatch-observability.isWebhookEnabled" (list . "pods") }}
 - admissionReviewVersions:
   - v1
   clientConfig:
     service:
       name: {{ template "amazon-cloudwatch-observability.webhookServiceName" . }}
       namespace: {{ .Release.Namespace }}
       path: /mutate-v1-pod
-  failurePolicy: {{ .Values.admissionWebhooks.pods.failurePolicy }}
+  failurePolicy: {{ .Values.admissionWebhooks.pods.failurePolicy | default .Values.admissionWebhooks.failurePolicy }}
   name: mpod.kb.io
-    {{- if .Values.admissionWebhooks.namespaceSelector }}
-  namespaceSelector:
-    {{- toYaml .Values.admissionWebhooks.namespaceSelector | nindent 6 }}
-    {{- end }}
-    {{- if .Values.admissionWebhooks.objectSelector }}
+  namespaceSelector: {{ include "amazon-cloudwatch-observability.namespaceSelector" (list . "pods") }}
+  {{- if .Values.admissionWebhooks.objectSelector }}
   objectSelector:
-    {{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
-    {{- end }}
+  {{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
+  {{- end }}
   rules:
   - apiGroups:
     - ""
@@ -95,23 +91,22 @@ webhooks:
     - pods
   sideEffects: None
   timeoutSeconds: {{ .Values.admissionWebhooks.timeoutSeconds }}
+{{- end }}
+{{- if include "amazon-cloudwatch-observability.isWebhookEnabled" (list . "namespaces") }}
 - admissionReviewVersions:
   - v1
   clientConfig:
     service:
       name: {{ template "amazon-cloudwatch-observability.webhookServiceName" . }}
       namespace: {{ .Release.Namespace }}
       path: /mutate-v1-namespace
-  failurePolicy: {{ .Values.admissionWebhooks.pods.failurePolicy }}
+  failurePolicy: {{ .Values.admissionWebhooks.namespaces.failurePolicy | default .Values.admissionWebhooks.pods.failurePolicy | default .Values.admissionWebhooks.failurePolicy }}
   name: mnamespace.kb.io
-    {{- if .Values.admissionWebhooks.namespaceSelector }}
-  namespaceSelector:
-    {{- toYaml .Values.admissionWebhooks.namespaceSelector | nindent 6 }}
-    {{- end }}
-    {{- if .Values.admissionWebhooks.objectSelector }}
+  namespaceSelector: {{ include "amazon-cloudwatch-observability.namespaceSelector" (list . "namespaces") }}
+  {{- if .Values.admissionWebhooks.objectSelector }}
   objectSelector:
-    {{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
-    {{- end }}
+  {{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
+  {{- end }}
   rules:
   - apiGroups:
     - ""
@@ -124,23 +119,22 @@ webhooks:
     - namespaces
   sideEffects: None
   timeoutSeconds: {{ .Values.admissionWebhooks.timeoutSeconds }}
+{{- end }}
+{{- if include "amazon-cloudwatch-observability.isWebhookEnabled" (list . "workloads") }}
 - admissionReviewVersions:
   - v1
   clientConfig:
     service:
       name: {{ template "amazon-cloudwatch-observability.webhookServiceName" . }}
       namespace: {{ .Release.Namespace }}
       path: /mutate-v1-workload
-  failurePolicy: {{ .Values.admissionWebhooks.pods.failurePolicy }}
+  failurePolicy: {{ .Values.admissionWebhooks.workloads.failurePolicy | default .Values.admissionWebhooks.pods.failurePolicy | default .Values.admissionWebhooks.failurePolicy }}
   name: mworkload.kb.io
-    {{- if .Values.admissionWebhooks.namespaceSelector }}
-  namespaceSelector:
-    {{- toYaml .Values.admissionWebhooks.namespaceSelector | nindent 6 }}
-    {{- end }}
-    {{- if .Values.admissionWebhooks.objectSelector }}
+  namespaceSelector: {{ include "amazon-cloudwatch-observability.namespaceSelector" (list . "workloads") }}
+  {{- if .Values.admissionWebhooks.objectSelector }}
   objectSelector:
-    {{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
-    {{- end }}
+  {{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
+  {{- end }}
   rules:
   - apiGroups:
     - apps
@@ -155,6 +149,7 @@ webhooks:
     - statefulsets
   sideEffects: None
   timeoutSeconds: {{ .Values.admissionWebhooks.timeoutSeconds }}
+{{- end }}
 ---
 apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingWebhookConfiguration
@@ -165,23 +160,21 @@ metadata:
     {{- include "amazon-cloudwatch-observability.labels" . | nindent 4}}
   name: {{ template "amazon-cloudwatch-observability.name" . }}-validating-webhook-configuration
 webhooks:
+{{- if include "amazon-cloudwatch-observability.isWebhookEnabled" (list . "instrumentations") }}
 - admissionReviewVersions:
   - v1
   clientConfig:
     service:
       name: {{ template "amazon-cloudwatch-observability.webhookServiceName" . }}
       namespace: {{ .Release.Namespace }}
       path: /validate-cloudwatch-aws-amazon-com-v1alpha1-instrumentation
-  failurePolicy: {{ .Values.admissionWebhooks.failurePolicy }}
+  failurePolicy: {{ .Values.admissionWebhooks.instrumentations.failurePolicy | default .Values.admissionWebhooks.failurePolicy }}
   name: vinstrumentationcreateupdate.kb.io
-    {{- if .Values.admissionWebhooks.namespaceSelector }}
-  namespaceSelector:
-    {{- toYaml .Values.admissionWebhooks.namespaceSelector | nindent 6 }}
-    {{- end }}
-    {{- if .Values.admissionWebhooks.objectSelector }}
+  namespaceSelector: {{ include "amazon-cloudwatch-observability.namespaceSelector" (list . "instrumentations") }}
+  {{- if .Values.admissionWebhooks.objectSelector }}
   objectSelector:
-    {{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
-    {{- end }}
+  {{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
+  {{- end }}
   rules:
   - apiGroups:
     - cloudwatch.aws.amazon.com
@@ -194,6 +187,8 @@ webhooks:
     - instrumentations
   sideEffects: None
   timeoutSeconds: {{ .Values.admissionWebhooks.timeoutSeconds }}
+{{- end }}
+{{- if include "amazon-cloudwatch-observability.isWebhookEnabled" (list . "instrumentations") }}
 - admissionReviewVersions:
   - v1
   clientConfig:
@@ -203,14 +198,11 @@ webhooks:
       path: /validate-cloudwatch-aws-amazon-com-v1alpha1-instrumentation
   failurePolicy: Ignore
   name: vinstrumentationdelete.kb.io
-    {{- if .Values.admissionWebhooks.namespaceSelector }}
-  namespaceSelector:
-    {{- toYaml .Values.admissionWebhooks.namespaceSelector | nindent 6 }}
-    {{- end }}
-    {{- if .Values.admissionWebhooks.objectSelector }}
+  namespaceSelector: {{ include "amazon-cloudwatch-observability.namespaceSelector" (list . "instrumentations") }}
+  {{- if .Values.admissionWebhooks.objectSelector }}
   objectSelector:
-    {{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
-    {{- end }}
+  {{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
+  {{- end }}
   rules:
   - apiGroups:
     - cloudwatch.aws.amazon.com
@@ -222,23 +214,22 @@ webhooks:
     - instrumentations
   sideEffects: None
   timeoutSeconds: {{ .Values.admissionWebhooks.timeoutSeconds }}
+{{- end }}
+{{- if include "amazon-cloudwatch-observability.isWebhookEnabled" (list . "agents") }}
 - admissionReviewVersions:
   - v1
   clientConfig:
     service:
       name: {{ template "amazon-cloudwatch-observability.webhookServiceName" . }}
       namespace: {{ .Release.Namespace }}
       path: /validate-cloudwatch-aws-amazon-com-v1alpha1-amazoncloudwatchagent
-  failurePolicy: {{ .Values.admissionWebhooks.failurePolicy }}
+  failurePolicy: {{ .Values.admissionWebhooks.agents.failurePolicy | default .Values.admissionWebhooks.failurePolicy }}
   name: vamazoncloudwatchagentcreateupdate.kb.io
-    {{- if .Values.admissionWebhooks.namespaceSelector }}
-  namespaceSelector:
-    {{- toYaml .Values.admissionWebhooks.namespaceSelector | nindent 6 }}
-    {{- end }}
-    {{- if .Values.admissionWebhooks.objectSelector }}
+  namespaceSelector: {{ include "amazon-cloudwatch-observability.namespaceSelector" (list . "agents") }}
+  {{- if .Values.admissionWebhooks.objectSelector }}
   objectSelector:
-    {{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
-    {{- end }}
+  {{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
+  {{- end }}
   rules:
   - apiGroups:
     - cloudwatch.aws.amazon.com
@@ -251,6 +242,8 @@ webhooks:
     - amazoncloudwatchagents
   sideEffects: None
   timeoutSeconds: {{ .Values.admissionWebhooks.timeoutSeconds }}
+{{- end }}
+{{- if include "amazon-cloudwatch-observability.isWebhookEnabled" (list . "agents") }}
 - admissionReviewVersions:
   - v1
   clientConfig:
@@ -260,14 +253,11 @@ webhooks:
       path: /validate-cloudwatch-aws-amazon-com-v1alpha1-amazoncloudwatchagent
   failurePolicy: Ignore
   name: vamazoncloudwatchagentdelete.kb.io
-    {{- if .Values.admissionWebhooks.namespaceSelector }}
-  namespaceSelector:
-    {{- toYaml .Values.admissionWebhooks.namespaceSelector | nindent 6 }}
-    {{- end }}
-    {{- if .Values.admissionWebhooks.objectSelector }}
+  namespaceSelector: {{ include "amazon-cloudwatch-observability.namespaceSelector" (list . "agents") }}
+  {{- if .Values.admissionWebhooks.objectSelector }}
   objectSelector:
-    {{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
-    {{- end }}
+  {{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
+  {{- end }}
   rules:
   - apiGroups:
     - cloudwatch.aws.amazon.com
@@ -280,3 +270,4 @@ webhooks:
   sideEffects: None
   timeoutSeconds: {{ .Values.admissionWebhooks.timeoutSeconds }}
 {{- end }}
+{{- end }}