Grafana GCX (CLI)

Breaking changes

• Credential storage now fails closed when the OS keychain is unavailable, instead of writing to the config file in plaintext with a warning. You will now see a Keychain unavailable error in this scenario. A locked, as opposed to absent, keychain already failed closed and is unchanged. Set GCX_KEYCHAIN=off to opt in to a plaintext write. (#1271)
• Fleet Management permissions have changed: A grafana.com Cloud Access Policy token is no longer needed for interacting with gcx fleet. gcx will need write permissions when using the OAuth flow for all gcx fleet commands. Users will need grafana-collector-app:read for named routes, and wildcard routes need the Admin role or grafana-collector-app:admin, including some read-only commands such as tenant get-limits. (#1261)
• gcx synthetic-monitoring probes deploy emits different manifests, and the probe token is now provided through a Kubernetes Secret, defined by the SM_AGENT_API_TOKEN environment variable. To use this, regenerate the manifests and update anything that read the token out of the Deployment arguments before applying. Using --token still works but it is deprecated and hidden from help (#1262)
• gcx synthetic-monitoring probes reset-token now returns the new token value instead of just confirming the reset. The value is in gcx.synth.probe_token_reset. Anything parsing the previous result shape needs updating (#1262)
• gcx irm oncall schedules list-final-shifts takes a --timezone flag and sends the timezone of the schedule, rather than the host. Without the --timezone flag it now uses the schedule's timezone, falling back to UTC with a warning if the schedule does not have a timezone set. (#1187)

Datasources and queries

• Add BigQuery, MSSQL, and OpenSearch datasource support (#1106, #1059, #1252)
• Add gcx profiles series for series discovery (#1086)
• Add -o dot call-graph output to gcx profiles query (#1122)
• Add the experimental gcx traces baseline command (#1168)
• Require an Explore link on every query command (#1134)

Alerting and IRM

• Add gcx alert state-history and notification history (#1296, #1258)
• Add gcx irm incidents update, and honour incident severity (#1191)
• Let a discovery command list its own catalog (#1193)
• alert-groups list --limit 0 now returns every alert group (#1213)

Configuration and credentials

• Add the trusted credentials.keychain policy (#1266)
• Add GCX_KEYCHAIN to disable the OS credential store (#1242)
• Make configuration load and write parameters explicit (#1272)

Agent Observability and Instrumentation

• Add gcx agento11y experiments pull for experiment bundles (#1267)
• Add gcx agento11y rules list-scores for online scores (#1226)
• Add --fix-plan to gcx instrumentation check (#1115)

Telemetry

• Break down api command usage by route, method, and type (#1094)
• Report HTTP status, Kubernetes reason, and authentication method (#1118)
• Report a canceled invocation with the outcome canceled (#1109)

Fixes

• create -f and update -f accept the K8s envelope that gcx itself prints, instead of discarding every field of the file (#1187)
• --jq now works together with -o agents (#1287)
• Normalize unstructured jq numbers (#1235)
• Faro sends extraLogLabels under the label field (#1238)
• Browser checks keep their notification channels (#1299)

Other

• Render provider tables with one generic codec (#1274, #1285, #1286, #1289)
• Add declarative provider registration machinery (#931)
• Set the manager identity from the gcx version (#1166)
• Enforce the command naming conventions in CI (#1243)
• Upgrade the Bubble Tea stack to v2 (#1253)
• Refine the Grafana investigation skill (#1279, #1292)
• Define how to mark an experimental command (#1220)
• Update CONTRIBUTING, and add skill references (#1304, #1280)