Releases
Observability Module for Ignition 8.3
Every published version of the module, with what it has been verified against, plus direct downloads for the .modl asset, the user manual and the Grafana dashboard pack.
v0.7.0
v0.7.021 Aug 2026OpenTelemetry and Prometheus observability for Ignition 8.3: curated gateway metrics, logs, traces and opt-in audit export, pushed to any OTLP backend or scraped on :9464.
- Ignition:
- 8.3.0+
- Backend:
- Any OpenTelemetry HTTP/protobuf endpoint, or Prometheus scraping the gateway
- Other:
- Ignition Edge is not supported (the Edge platform licenses only a fixed vendor list)
Changes
- Licensing change: the free Community tier is gone. The module is now one paid product, licensed per Ignition gateway. Everything it does — OTLP push, the Prometheus endpoint, curated metrics, the scripting API, health tags — runs under an activation or a live trial. When no license is in effect the module stays installed and every setting is preserved, but it produces no telemetry at all. What that means in practice, if you were relying on the free tier: :9464/metrics stops listening, the gateway route /data/mustry-observability/metrics answers HTTP 503, and curated metrics stop being collected. system.observability.* calls become no-ops instead of errors, so timer scripts and tag change scripts that publish custom metrics keep running rather than failing at the moment a trial lapses. Health tags keep publishing throughout, with two new tags — License/Valid and License/Mode — so you can alarm on an expired trial. The gateway log gets one WARN line naming the state.
- The module now fails closed if the gateway never reports a license state. Previously an unknown state was treated as licensed. On 8.3.6 the platform resolves a module's license before starting it and faults the module rather than passing nothing, so this branch should be unreachable; it now denies and logs a warning instead of silently unlocking the module.
- API change: the license.enterpriseActive field in /status and /health is now license.licensed. The Settings page License row reads "<mode> — telemetry off" instead of "<mode> — OTLP export paused".
- The EULA text changed, so the gateway will ask you to accept it again when you install or upgrade the module. Acceptance is stored as a checksum of the licence file and matched on install, so any edit to the text re-prompts once. (Containers that set ACCEPT_MODULE_LICENSES are unaffected — that env var short-circuits the check.) The grant is now a single per-gateway license covering the whole module, and the Ignition Edge carve-out has moved out of the old Community clause into the grant itself: the Edge platform licenses only a fixed list of vendors' modules, so this module is faulted before it starts and nothing runs there. We have raised that with Inductive Automation; see docs/EDGE.md.
- Rotating a referenced secret now takes effect when you press Save. Previously the module only re-read a Secret Provider when the settings record itself changed, so the obvious gesture after rotating a token centrally — open Settings, Save — was a silent no-op and the old token stayed in force until an unrelated setting was edited or the gateway restarted. Save (and the settings API) now re-resolve referenced secrets and rebuild the pipeline when the material actually changed; unchanged secrets still skip the rebuild, so scans and startup are unaffected. A rotation is only picked up by that Save or a restart, never mid-flight, so a running scrape is never broken by a rotation happening elsewhere. The same guard silently broke the documented recovery from a fail-closed secret — the manual's "fix the secret, then save the Settings page" left the Prometheus endpoint down, because the settings had not changed. Measured on the pre-fix module (endpoint still refusing connections after fix-and-Save) and on this one (endpoint back). Both recovery paths are now covered by ops/secrets-e2e.sh.
- Referenced secrets are now verified end-to-end against a live secret provider, not just unit-tested plumbing. A new ops/secrets-e2e.sh provisions a real provider (the platform's built-in file type) on the dev gateway and asserts the whole path: the Prometheus listener demands exactly the token stored in the provider (401 without or with a wrong one, 200 with it), a referenced OTLP auth header resolves on Test Connection, and an unreadable secret fails closed — listener off, /data/.../metrics 503, "FAILING CLOSED" in the log — then recovers when the reference is fixed.
- The minimum-log-level filter now has the automated end-to-end test it was missing: settings → resolved config → the gateway's own appender wiring → a real logback dispatch → exported records, asserting that everything below the configured level never leaves the gateway.
- Build: the module EULA is now packaged by the Gradle plugin's own license property instead of a hand-rolled copy plus a string-replace on the generated module.xml. <license> is emitted in its schema position, and a new verifyModuleLicensePackaging check fails the build if a .modl is ever produced without the EULA embedded and declared. license.html is unchanged, so already-accepted gateways are not re-prompted.
Known issues
- Direct SaaS push is verified at the wire level (headers/tokens asserted against capture servers) but not yet against live vendor accounts. This also covers the Azure Monitor path: the client secret resolves like any other referenced secret, but no live Azure tenant has been exercised.
- The Settings and Export Status pages are built on undocumented gateway web-UI internals (tested against 8.3.6). A future 8.3.x update could break page rendering; telemetry export itself would be unaffected.
- Traces are beta and manual-only: system.observability.span() (verified end-to-end). Automatic instrumentation of HTTP requests, database queries, and script executions is not available — the platform offers no injection points. This is a platform limitation, not a pending item: the module probes for them at startup and logs the verdict.
- Remaining metric-pack gaps (SQL Bridge, EAM, Sepasoft, further Cirrus modules) await unmatched-name captures from field gateways via the DEBUG logger.