Releases
Observability Module for Ignition 8.3
Every published version of the module, with what it has been verified against, plus direct downloads for the .modl asset, the user manual and the Grafana dashboard pack.
v0.7.0
v0.7.0 21 Aug 2026OpenTelemetry and Prometheus observability for Ignition 8.3: curated gateway metrics, logs, traces and opt-in audit export, pushed to any OTLP backend or scraped on :9464.
- Ignition:
- 8.3.0+
- Backend:
- Any OpenTelemetry HTTP/protobuf endpoint, or Prometheus scraping the gateway
- Other:
- Ignition Edge is not supported (the Edge platform licenses only a fixed vendor list)
Changes
- Licensing change: the free Community tier is gone. The module is now one paid product, licensed per Ignition gateway. Everything it does - OTLP push, the Prometheus endpoint, curated metrics, the scripting API, health tags - runs under an activation or a live trial. When no license is in effect the module stays installed and every setting is preserved, but it produces no telemetry at all: :9464/metrics stops listening, the gateway route answers HTTP 503, and curated metrics stop being collected.
- system.observability.* calls become no-ops rather than errors when unlicensed, so timer scripts and tag change scripts that publish custom metrics keep running instead of failing the moment a trial lapses. Two new health tags, License/Valid and License/Mode, make an expired trial something you can alarm on.
- The module now fails closed if the gateway never reports a license state. An unknown state used to be treated as licensed; it now denies and logs a warning.
- The EULA text changed, so the gateway asks you to accept it again on install or upgrade. Acceptance is stored as a checksum of the licence file, so any edit re-prompts once. The Ignition Edge carve-out moved out of the old Community clause and into the licence grant itself.
- Rotating a referenced secret now takes effect when you press Save. Previously the module only re-read a secret provider when the settings record itself changed, so the obvious gesture after rotating a token centrally was a silent no-op and the old token stayed in force until an unrelated setting was edited or the gateway restarted.
- Referenced secrets are now verified end to end against a live secret provider rather than unit-tested plumbing: the Prometheus listener demands exactly the stored token, a referenced OTLP auth header resolves on Test Connection, and an unreadable secret fails closed and then recovers when the reference is fixed.
- The minimum-log-level filter gained the end-to-end test it was missing, asserting that everything below the configured level never leaves the gateway.
- API change: license.enterpriseActive in /status and /health is now license.licensed, and the Settings page License row reads "<mode> - telemetry off".
Known issues
- Direct SaaS push is verified at the wire level, with headers and tokens asserted against capture servers, but not yet against live vendor accounts. The Azure Monitor path is in the same position: the client secret resolves like any other referenced secret, but no live Azure tenant has been exercised.
- Traces are manual-only, through system.observability.span(). Automatic instrumentation of HTTP requests, database queries and script executions is not available: the platform offers no injection points, so this is a platform limitation rather than a pending item.
- The Settings and Export Status pages are built on undocumented gateway web-UI internals, tested against 8.3.6. A future 8.3.x update could break page rendering; telemetry export itself would be unaffected.
- Metric-pack coverage stops short of SQL Bridge, EAM, Sepasoft and further Cirrus Link modules. Those await unmatched-name captures from field gateways.