Contributions

#10226 asked for this in 2022 and was closed: maintainers did not want a cloud SDK baked into the Prometheus binary. #18707 reopened it, because the GCE, Kubernetes, and Azure code had since moved to a pattern that lets the linker drop unused SDK code. I followed that pattern, so the binary carries only the SDK calls Prometheus actually makes.

The proposal came with a promise to maintain it. Since then #19030 added IPv6 and hostname labels so dual-stack instances show up, and #19032 stopped targets from deleted compartments lingering until a restart.

#48137 asked for resources covering the feature that routes CloudWatch Logs into S3 Tables, so you can query them with Athena and skip Firehose or Lambda. The integration is one per account, so the acceptance tests had to run one at a time. Listing sources throws a validation error once the parent is gone, which has to count as not-found rather than a failure. During review the maintainer added Autoflex mapping and a list data source. After the merge someone got stuck on the import format: the id is a per-association UUID from the CLI, not anything in the observabilityadmin API, and PR #48286 writes that down.

cilium#47821: the Helm chart wrote prometheus.io/scrape and prometheus.io/port next to the user's own annotation map, so setting either key produced a duplicate YAML key and render order decided the winner. For the Hubble metrics service and both hubble-relay objects the chart default came last and quietly won, which is why annotation-based scraping could not be turned off. PR #47850 renders both keys through a helper that skips anything the user already set, so each key appears once and the user value wins. No new Helm values, and checked with helm template across the default, override, and ServiceMonitor paths.

hubble#1215: the datapath reports an extra error code on drops, for example which FIB lookup failed. cilium monitor printed it, but Hubble's parser threw it away. PR #46663 adds two Flow fields, one for the raw value and one for the readable text, and the printer now prefers the text. The fields are additive, so older agents and clients look the same as before.

hubble#1283: the server already had a reply filter, there were just no CLI flags for it. Added --reply and --not-reply as mutually exclusive flags.

cilium#26521 asked for the request path on Hubble HTTP metrics and was closed in 2023, because a raw path label means a new time series for every ID. CFP-26521 works around that: the label is the template that matched, not the path, so the set of values is fixed when config loads. With no templates set, the metrics are unchanged.

cilium#46107: OKE with VCN-Native Pod Networking is Oracle's recommended CNI mode, and Cilium's docs did not mention Oracle at all. Chaining already worked, because the pod side is a plain veth pair like the AWS VPC CNI. PR #46116 writes it up, tested on a live cluster, including the uninstall trap: helm uninstall leaves 05-cilium.conflist behind, so new pods hang in ContainerCreating until you remove it on every node.

#414692 was filed in 2023 by a GitLab PM: customers wanted PDF copies of release docs without a CI pipeline. It sat for three years. Review reworked my first approach to match the pattern the wiki editor already used, which made it simpler, and it merged in nine days.

Then #602773 turned up two bugs. The print styles leaned on the server-rendered page, so a soft Vue Router navigation printed a blank page, and the dark-mode stylesheet bled into print as gray text. !240468 hides the page chrome directly and forces light text in print.

#5023 flagged the vendored github.com/cilium/ebpf against CVE-2026-10722, fixed upstream in v0.22.0. It is not a direct import, it comes in through containerd/cgroups/v3/cgroup2, so the change is a go get in /agent then go mod tidy and go mod vendor. The CVE is in the BTF parsing path and the agent never reaches it: cgroups builds its device program in code, and the agent only drives the cpu and memory controllers. That went in the PR body so reviewers would not assume the agent was exploitable.

#2098: the reconciler sent a full update every loop, so it claimed ownership of the whole custom resource. Go's resource.Quantity writes integers as strings, so cpu: 1 is stored as "1" and the next helm upgrade fails with a type conflict. A maintainer opened #2121 to move defaulting into a mutating webhook. We agreed the shape first: failurePolicy: Fail, since the webhook runs in the same pod, and ControlRabbitmqImage stays in the reconciler because it is enforcement, not a default.

That work exposed a flaky test, filed as #2152 and fixed in PR #2217. It reads like a timeout but it is a teardown race: AfterEach deletes the cluster and returns straight away, while the finalizer holds the object for about two seconds, so BeforeEach recreates the same name and the API server rejects it. FlakeAttempts(3) was really one attempt. The fix makes teardown poll until the object is gone, and print the remaining finalizers on timeout so a genuinely stuck delete is readable from CI.

#22860 was a bug I filed about missing Middle East regions, and someone else opened PR #22941 months later to fix it. Reading that, I saw the China regions were already listed but the endpoint builder used amazonaws.com for all of them. Any region starting with cn- now gets the .cn domain. The URL parsing regex was already right, only the builder was wrong.

#14153: if k3s is killed before etcd flushes its bootstrap data, the stale snapshot directory carries into the next start and k3s exits with no bootstrap data found. The startup test already paired every kill with a cleanup call. The kubeflags test was simply missing those two calls.

My first version used TCP socket probes on the webhook port: quick, and compliant. The maintainer pushed back, because a TCP probe only says a port is open, not that the controller is healthy. So I built a health checker that tracks informer cache sync, exposed /healthz/live and /healthz/ready, and gated readiness on that. The controller now takes no traffic until it has finished syncing.

I built this while native OCI discovery was still blocked: prometheus#10226 was closed, and HTTP service discovery was the only route that kept cloud-specific code out of the Prometheus binary. Native discovery has since merged in prometheus#18919, which is the better end state, so the repo is archived and left up for anyone still on an older Prometheus.