Issues

• spike: Which cert-manager version do mctl clusters run, and can they be upgraded to v1.20.5 to drop trust in the compromised eMudhra CA?

  spike:scout
  mctlhq/mctl-gitops#2246 · Filter by author mctl-agents opened on Oct 29, 2026
  2

• spike: Would VictoriaLogs beat the current log backend on ingestion cost and resource use for multi-tenant structured logs on mctl clusters?

  spike:scout
  mctlhq/mctl-gitops#2245 · Filter by author mctl-agents opened on Oct 29, 2026
  1

• feat(observability): DNS visibility for agent pods (830 F6)

  mctlhq/mctl-gitops#2236 · Filter by author mashkovd opened on Oct 28, 2026

• feat(agents): egress detector canary (830 F5)

  mctlhq/mctl-gitops#2235 · Filter by author mashkovd opened on Oct 28, 2026

• feat(observability): denied agent egress counter and alert (830 F4)

  mctlhq/mctl-gitops#2234 · Filter by author mashkovd opened on Oct 28, 2026

• feat(agents): attribute proxied egress to the agent run (830 F2)

  mctlhq/mctl-gitops#2233 · Filter by author mashkovd opened on Oct 28, 2026

• feat(observability): Squid egress log counters and silence alerts (830 F1)

  mctlhq/mctl-gitops#2232 · Filter by author mashkovd opened on Oct 28, 2026

• feat(observability): apiserver and CP component health signals

  mctlhq/mctl-gitops#2225 · Filter by author mashkovd opened on Oct 28, 2026

• chore(runbooks): etcd restore drill and restore.md cadence drift

  mctlhq/mctl-gitops#2224 · Filter by author mashkovd opened on Oct 28, 2026

• feat(observability): admission webhook and VAP health alerts

  mctlhq/mctl-gitops#2223 · Filter by author mashkovd opened on Oct 28, 2026

• feat(observability): etcd snapshot freshness alert

  mctlhq/mctl-gitops#2222 · Filter by author mashkovd opened on Oct 28, 2026

• feat(observability): etcd metrics and etcd alert rules

  mctlhq/mctl-gitops#2221 · Filter by author mashkovd opened on Oct 28, 2026

• fix(observability): off-cluster dead-man's switch fed by Watchdog

  mctlhq/mctl-gitops#2220 · Filter by author mashkovd opened on Oct 28, 2026

• spike: Can stable OTTL in the OpenTelemetry Collector be used to filter, redact and cut telemetry cost in the multi-tenant observability pipeline?

  spike:scout
  mctlhq/mctl-gitops#2211 · Filter by author mashkovd opened on Oct 28, 2026
  3

• fix(deploy-intent): flag function calls inside if-conditions in the chart-key guard

  mctlhq/mctl-gitops#2189 · Filter by author mashkovd opened on Oct 27, 2026

• hardening: enforce approved-providers-only egress for mctl-agents pods

  security
  mctlhq/mctl-gitops#2159 · Filter by author mashkovd opened on Oct 26, 2026
  2

• rollout(governance): enable strict registered-policy enforcement after #721

  mctlhq/mctl-gitops#2141 · Filter by author mashkovd opened on Oct 25, 2026
  1

• feat(hetzner): hard-block legacy-priced cloud server rescale/replacement without explicit repricing approval

  mctlhq/mctl-gitops#2121 · Filter by author mashkovd opened on Oct 24, 2026
  2

• Logging: replace Promtail with Alloy and move Loki 2.9 to 3.x

  mctlhq/mctl-gitops#2093 · Filter by author mashkovd opened on Oct 23, 2026

• Vault: upgrade to a supported release line

  mctlhq/mctl-gitops#2092 · Filter by author mashkovd opened on Oct 23, 2026

• shared-pg: move the image off Debian bullseye (EOL)

  mctlhq/mctl-gitops#2091 · Filter by author mashkovd opened on Oct 23, 2026

• Delete leftover preview release preview-mctl-web-l6grwd in admins-preview (and live-check #2020)

  mctlhq/mctl-gitops#2045 · Filter by author mashkovd opened on Oct 20, 2026

• PreviewReaperNotTriggered fires forever after a CronWorkflow is deliberately removed

  mctlhq/mctl-gitops#2044 · Filter by author mashkovd opened on Oct 20, 2026

• Global workflow exit hook has no resources: workflows hang in small-quota tenants

  mctlhq/mctl-gitops#2043 · Filter by author mashkovd opened on Oct 20, 2026

• Scope workflow log archive credentials per tenant

  mctlhq/mctl-gitops#1999 · Filter by author mashkovd opened on Oct 19, 2026