Feature status
A snapshot of what's live today versus what's coming. avuru obs v0.5.0 is released and the trunk moves fast — for the plan see the Roadmap, and for shipped changes the Changelog.
Available now
| Capability | Status | Since |
|---|---|---|
| Service map — call edges derived from traces, health-status rings from the service-health rollup, per-edge caller-side p50/p95 latency, hover-to-focus, and shareable search/status/group filters | Shipped | M1 |
| Traces — search, filters (tags, order, duration, status), latency heatmap, per-operation RED overview | Shipped | M1 |
| Trace viewer — timeline, spans table, flamegraph, statistics, trace graph, JSON | Shipped | M4 |
| Trace comparison — structural diff of two traces | Shipped | M4 |
Logs — full-text search, severity/service filters, trace_id correlation | Shipped | M1 |
| System Status — component health, storage, retention, disk | Shipped | M1 |
| Sensor DaemonSet — zero-code eBPF traces + RED (OBI), zero-config log collection | Shipped | M2 |
| Service inventory — sortable RED table, drill-down to traces | Shipped | M2 |
| RED metrics dashboard — rate/errors/duration charts per service | Shipped | M3 |
| Node / pod health — CPU, memory, network per node & pod (kubeletstats), sortable on every column and filterable by name, namespace or workload | Shipped | M3 |
| Continuous profiling — CPU flame graphs per service (experimental, opt-in) | Shipped | M4 |
Projects — per-environment scoping, sidebar switcher, shareable ?project= links | Shipped | v0.1 |
Project management — create, rename and delete projects from the UI; default and config-defined projects stay read-only | Shipped | v0.3 |
| Read-only demo — one-click "Try the demo" viewer backed by live data (OpenTelemetry Astronomy Shop); opt-in, server-side sign-in | Shipped | v0.3 |
| Collection controls — per signal/namespace/pod/node, with a per-node agent inventory | Shipped | v0.1 |
Runtime collection control — switch each signal on or off from Settings → Collection and the sensor follows in seconds, no helm upgrade; shows the effective config and resets to chart defaults. Opt-in, behind a namespace-scoped Role over the hub's own sensor resources | Shipped | v0.5 |
| Error tracking — deduplicated issues from spans/logs, triage lifecycle, Sentry-protocol ingest | Shipped | v0.2 |
| Service health — group health with criticality tiers and critical-dependency propagation, derived from RED | Shipped | v0.2 |
Service groups from the UI — create, edit and delete health groups in Settings → Groups; applies to the next health read, no helm upgrade. Chart-declared groups stay read-only and win a name collision; auto-grouping by namespace is unchanged | Shipped | v0.5 |
| Alerting — webhook notifications when a service/group crosses into a bad state | Shipped | v0.2 |
| Network health on the service map — per-edge RTT + failed/reset connections (OBI TCP stats) | Shipped | v0.2 |
| Green — per-service energy (Wh) & carbon (gCO2e) via CNCF Kepler, carbon budgets, CSRD-ready export (off by default; measured on RAPL hardware) | Shipped | v0.2 |
Sensor safety — CI-proven "do no harm" gate (probe-sensitive canary) + opt-in instrumentation mode (discovery.mode) | Shipped | v0.2 |
| Authentication — secure by default: local users, fixed roles (admin/editor/viewer) with per-project grants, server-side sessions, Settings → Users, opt-in anonymous viewer | Shipped | v0.2 |
SSO — OpenID Connect (discovery, PKCE) with any IdP, group→role/project mapping (hot-reloaded), forceSSO | Shipped | v0.2 |
Modules — one switch per signal family (modules.<name>.enabled) gates schema, API, pipeline, collection and UI together; capabilities-driven sidebar | Shipped | v0.2 |
Ingest API keys — per-project keys validated in the gateway; enforce makes the key's project the authoritative tenant; safe off/log/enforce rollout | Shipped | v0.3 |
Green on RAPL-less nodes — opt-in TDP power estimation for cloud VMs, labeled estimated end to end and never blended with measured energy; /green coverage panel. The measured source can be dropped entirely (sensor.green.kepler.enabled=false) so a RAPL-less fleet keeps its other signals | Shipped | v0.3 |
| User management — edit a user's name and role grants, reset passwords, and delete users behind a disable-first rule; password operations refused for SSO accounts | Shipped | v0.4 |
| Self-service password change — Settings → Account, current password required, other sessions evicted while yours stays live | Shipped | v0.4 |
Schema self-healing — the hub applies missing migrations on connect (hub.autoMigrate) and reports applied vs. expected as a Schema component in Settings → Status | Shipped | v0.4 |
Reverse-proxy support for login — auth.trustedOrigins plus an enforce/log/off origin check for proxies that rewrite Host | Shipped | v0.4 |
| Storage view — ClickHouse connection (read-only), per-signal size, compression and age, and configured retention shown against the TTL the tables actually enforce | Shipped | v0.5 |
| Access view — which role may read and which may change each area, derived by the hub from the guards its routes registered with, so it cannot drift from what is enforced | Shipped | v0.5 |
| Dashboard — the landing screen: service-group health, compact topology, firing alerts and Kubernetes capacity in one view. Each band follows its module, and falls back to the busiest services rather than disappearing when service health is off | Shipped | v0.5 |
| SSO group mapping from the UI — Settings → Access shows the chart-declared OIDC group→role rules and lets an admin author, edit and delete rules beside them; the chart wins a name collision and an overridden rule says why. A change applies on the group's next sign-in or token refresh, cluster-wide within ~15 s | Shipped | v0.5 |
| Personal API tokens — mint, list and revoke bearer tokens in Settings → Access; only the SHA-256 is stored and the raw value is shown once. A token resolves to its owner's live grants, so disabling a user disables every token they hold; a bad token is a clean 401, never an anonymous downgrade | Shipped | v0.5 |
Coming
| Capability | Status | Target |
|---|---|---|
| Multi-cluster projects — member projects aggregating several clusters, per-project retention and status | Planned | v0.6 |
| Wider ingest compatibility — push receivers for the common tracing/metrics/logging wire protocols alongside OTLP, plus forwarding exporters for dual-write migrations | Planned | v0.6 |
Inter-zone traffic accounting (OBI network_inter_zone) | Planned | v0.6 |
:::info Service map today
Topology edges are derived from trace spans (cross-service Client/Server
pairs) — and with the sensor DaemonSet, every HTTP/gRPC service is traced
zero-code, so uninstrumented apps appear too. OBI's built-in network
feature further enriches the map with un-instrumented edges and per-edge
network health when enabled. A node's ring is read from the
service-health rollup, not re-derived on the
map — a service outside that rollup's coverage reads unknown, never healthy.
:::