Merge branch 'master' into Enable-HATracker-memberlist

Signed-off-by: Friedrich Gonzalez <1517449+friedrichg@users.noreply.github.com>

Author: friedrichg

CHANGELOG.md

@@ -1,6 +1,12 @@
 # Changelog
 
 ## master / unreleased
+* [CHANGE] Ruler: Graduate Ruler API from experimental. #7312
+  * Flag: Renamed `-experimental.ruler.enable-api` to `-ruler.enable-api`. The old flag is kept as deprecated.
+  * Ruler API is no longer marked as experimental.
+* [CHANGE] Alertmanager: Graduate Alertmanager API and sharding from experimental. #7315
+  * Flag: Renamed `-experimental.alertmanager.enable-api` to `-alertmanager.enable-api`. The old flag is kept as deprecated.
+  * Alertmanager sharding is no longer marked as experimental.
 * [CHANGE] Blocks storage: Bucket index is now enabled by default. Disabling the bucket index (`-blocks-storage.bucket-store.bucket-index.enabled=false`) is not recommended for production. #7259
 * [CHANGE] Users Scanner: Rename user index update configuration. #7180
   * Flag: Renamed `-*.users-scanner.user-index.cleanup-interval` to `-*.users-scanner.user-index.update-interval`.
@@ -10,6 +16,7 @@
   * Flags: Renamed `-querier.parquet-queryable-shard-cache-size` to `-querier.parquet-shard-cache-size` and `-querier.parquet-queryable-shard-cache-ttl` to `-querier.parquet-shard-cache-ttl`.
   * Config: Renamed `parquet_queryable_shard_cache_size` to `parquet_shard_cache_size` and `parquet_queryable_shard_cache_ttl` to `parquet_shard_cache_ttl`.
 * [FEATURE] HATracker: Add experimental support for `memberlist` and `multi` as a KV store backend. #7284
+* [FEATURE] Distributor: Add `-distributor.otlp.add-metric-suffixes` flag. If true, suffixes will be added to the metrics for name normalization. #7286
 * [FEATURE] StoreGateway: Introduces a new parquet mode. #7046
 * [FEATURE] StoreGateway: Add a parquet shard cache to parquet mode. #7166
 * [FEATURE] Distributor: Add a per-tenant flag `-distributor.enable-type-and-unit-labels` that enables adding `__unit__` and `__type__` labels for remote write v2 and OTLP requests. This is a breaking change; the `-distributor.otlp.enable-type-and-unit-labels` flag is now deprecated, operates as a no-op, and has been consolidated into this new flag. #7077
@@ -45,6 +52,7 @@
 * [ENHANCEMENT] Compactor: Add partition group creation time to visit marker. #7217
 * [ENHANCEMENT] Compactor: Add concurrency for partition cleanup and mark block for deletion #7246
 * [ENHANCEMENT] Distributor: Validate metric name before removing empty labels. #7253
+* [ENHANCEMENT] Ruler/Ingester: Propagate append hints to discard out of order samples on Ingester #7226
 * [ENHANCEMENT] Make cortex_ingester_tsdb_sample_ooo_delta metric per-tenant #7278
 * [ENHANCEMENT] Distributor: Add dimension `nhcb` to keep track of nhcb samples in `cortex_distributor_received_samples_total` and `cortex_distributor_samples_in_total` metrics.
 * [ENHANCEMENT] Distributor: Add `-distributor.accept-unknown-remote-write-content-type` flag. When enabled, requests with unknown or invalid Content-Type header are treated as remote write v1 instead of returning 415 Unsupported Media Type. Default is false. #7293
@@ -62,6 +70,7 @@
 * [BUGFIX] Distributor: Return remote write V2 stats headers properly when the request is HA deduplicated. #7240
 * [BUGFIX] Cache: Fix Redis Cluster EXECABORT error in MSet by using individual SET commands instead of transactions for cluster mode. #7262
 * [BUGFIX] Distributor: Fix an `index out of range` panic in PRW2.0 handler caused by dirty metadata when reusing requests from `sync.Pool`. #7299
+* [BUGFIX] Distributor: Fix data corruption in the push handler caused by shallow copying `Samples` and `Histograms` when converting Remote Write V2 requests to V1. #7337
 
 
 ## 1.20.1 2025-12-03

RELEASE.md

@@ -36,6 +36,7 @@ Our goal is to provide a new minor release every 6 weeks. This is a new process
 | v1.18.0        | 2024-08-16                                 | Daniel Blando (@danielblando)               |
 | v1.19.0        | 2025-01-22                                 | Charlie Le (@charlietle)                    |
 | v1.20.0        | 2025-10-31                                 | Ben Ye (@yeya24)                            |
+| v1.21.0        | 2026-03-09                                 | Friedrich Gonzalez (@friedrichg)            |
 
 ## Release shepherd responsibilities
 

build-image/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.25.5-trixie
+FROM golang:1.25.8-trixie
 ARG goproxyValue
 ENV GOPROXY=${goproxyValue}
 RUN apt-get update && apt-get install -y curl file gettext jq unzip protobuf-compiler libprotobuf-dev && \

docs/api/_index.md

@@ -541,7 +541,7 @@ Prometheus-compatible rules endpoint to list alerting and recording rules that a
 
 _For more information, please check out the Prometheus [rules](https://prometheus.io/docs/prometheus/latest/querying/api/#rules) documentation._
 
-_This experimental endpoint is disabled by default and can be enabled via the `-experimental.ruler.enable-api` CLI flag (or its respective YAML config option)._
+_This endpoint is disabled by default and can be enabled via the `-ruler.enable-api` CLI flag (or its respective YAML config option)._
 
 _Requires [authentication](#authentication)._
 
@@ -558,7 +558,7 @@ Prometheus-compatible rules endpoint to list of all active alerts.
 
 _For more information, please check out the Prometheus [alerts](https://prometheus.io/docs/prometheus/latest/querying/api/#alerts) documentation._
 
-_This experimental endpoint is disabled by default and can be enabled via the `-experimental.ruler.enable-api` CLI flag (or its respective YAML config option)._
+_This endpoint is disabled by default and can be enabled via the `-ruler.enable-api` CLI flag (or its respective YAML config option)._
 
 _Requires [authentication](#authentication)._
 
@@ -573,7 +573,7 @@ GET <legacy-http-prefix>/rules
 
 List all rules configured for the authenticated tenant. This endpoint returns a YAML dictionary with all the rule groups for each namespace and `200` status code on success.
 
-_This experimental endpoint is disabled by default and can be enabled via the `-experimental.ruler.enable-api` CLI flag (or its respective YAML config option)._
+_This endpoint is disabled by default and can be enabled via the `-ruler.enable-api` CLI flag (or its respective YAML config option)._
 
 _Requires [authentication](#authentication)._
 
@@ -632,7 +632,7 @@ GET <legacy-http-prefix>/rules/{namespace}
 
 Returns the rule groups defined for a given namespace.
 
-_This experimental endpoint is disabled by default and can be enabled via the `-experimental.ruler.enable-api` CLI flag (or its respective YAML config option)._
+_This endpoint is disabled by default and can be enabled via the `-ruler.enable-api` CLI flag (or its respective YAML config option)._
 
 _Requires [authentication](#authentication)._
 
@@ -664,7 +664,7 @@ GET <legacy-http-prefix>/rules/{namespace}/{groupName}
 
 Returns the rule group matching the request namespace and group name.
 
-_This experimental endpoint is disabled by default and can be enabled via the `-experimental.ruler.enable-api` CLI flag (or its respective YAML config option)._
+_This endpoint is disabled by default and can be enabled via the `-ruler.enable-api` CLI flag (or its respective YAML config option)._
 
 _Requires [authentication](#authentication)._
 
@@ -679,7 +679,7 @@ POST <legacy-http-prefix>/rules/{namespace}
 
 Creates or updates a rule group. This endpoint expects a request with `Content-Type: application/yaml` header and the rules **YAML** definition in the request body, and returns `202` on success.
 
-_This experimental endpoint is disabled by default and can be enabled via the `-experimental.ruler.enable-api` CLI flag (or its respective YAML config option)._
+_This endpoint is disabled by default and can be enabled via the `-ruler.enable-api` CLI flag (or its respective YAML config option)._
 
 _Requires [authentication](#authentication)._
 
@@ -716,7 +716,7 @@ DELETE <legacy-http-prefix>/rules/{namespace}/{groupName}
 
 Deletes a rule group by namespace and group name. This endpoints returns `202` on success.
 
-_This experimental endpoint is disabled by default and can be enabled via the `-experimental.ruler.enable-api` CLI flag (or its respective YAML config option)._
+_This endpoint is disabled by default and can be enabled via the `-ruler.enable-api` CLI flag (or its respective YAML config option)._
 
 _Requires [authentication](#authentication)._
 
@@ -731,7 +731,7 @@ DELETE <legacy-http-prefix>/rules/{namespace}
 
 Deletes all the rule groups in a namespace (including the namespace itself). This endpoint returns `202` on success.
 
-_This experimental endpoint is disabled by default and can be enabled via the `-experimental.ruler.enable-api` CLI flag (or its respective YAML config option)._
+_This endpoint is disabled by default and can be enabled via the `-ruler.enable-api` CLI flag (or its respective YAML config option)._
 
 _Requires [authentication](#authentication)._
 
@@ -743,7 +743,7 @@ POST /ruler/delete_tenant_config
 
 This deletes all rule groups for tenant, and returns `200` on success. Calling endpoint when no rule groups exist for user returns `200`. Authentication is only to identify the tenant.
 
-This is intended as internal API, and not to be exposed to users. This endpoint is enabled regardless of whether `-experimental.ruler.enable-api` is enabled or not.
+This is intended as internal API, and not to be exposed to users. This endpoint is enabled regardless of whether `-ruler.enable-api` is enabled or not.
 
 _Requires [authentication](#authentication)._
 
@@ -796,7 +796,7 @@ POST /multitenant_alertmanager/delete_tenant_config
 ```
 
 This endpoint deletes configuration for a tenant identified by `X-Scope-OrgID` header.
-It is internal, available even if Alertmanager API is not enabled by using `-experimental.alertmanager.enable-api`.
+It is internal, available even if Alertmanager API is not enabled by using `-alertmanager.enable-api`.
 The endpoint returns a status code of `200` if the user's configuration has been deleted, or it didn't exist in the first place.
 
 _Requires [authentication](#authentication)._
@@ -811,7 +811,7 @@ Get the current Alertmanager configuration for the authenticated tenant, reading
 
 This endpoint doesn't accept any URL query parameter and returns `200` on success.
 
-_This experimental endpoint is disabled by default and can be enabled via the `-experimental.alertmanager.enable-api` CLI flag (or its respective YAML config option)._
+_This endpoint is disabled by default and can be enabled via the `-alertmanager.enable-api` CLI flag (or its respective YAML config option)._
 
 _Requires [authentication](#authentication)._
 
@@ -825,7 +825,7 @@ Stores or updates the Alertmanager configuration for the authenticated tenant. T
 
 This endpoint expects the Alertmanager **YAML** configuration in the request body and returns `201` on success.
 
-_This experimental endpoint is disabled by default and can be enabled via the `-experimental.alertmanager.enable-api` CLI flag (or its respective YAML config option)._
+_This endpoint is disabled by default and can be enabled via the `-alertmanager.enable-api` CLI flag (or its respective YAML config option)._
 
 _Requires [authentication](#authentication)._
 
@@ -863,7 +863,7 @@ Deletes the Alertmanager configuration for the authenticated tenant.
 
 This endpoint doesn't accept any URL query parameter and returns `200` on success.
 
-_This experimental endpoint is disabled by default and can be enabled via the `-experimental.alertmanager.enable-api` CLI flag (or its respective YAML config option)._
+_This endpoint is disabled by default and can be enabled via the `-alertmanager.enable-api` CLI flag (or its respective YAML config option)._
 
 _Requires [authentication](#authentication)._
 

docs/configuration/config-file-reference.md

@@ -610,7 +610,7 @@ cluster:
   # CLI flag: -alertmanager.cluster.push-pull-interval
   [push_pull_interval: <duration> | default = 1m]
 
-# Enable the experimental alertmanager config api.
+# Deprecated: Use -alertmanager.enable-api instead.
 # CLI flag: -experimental.alertmanager.enable-api
 [enable_api: <boolean> | default = false]
 
@@ -3342,6 +3342,10 @@ otlp:
   # Deprecated: Use `-distributor.enable-type-and-unit-labels` flag instead.
   # CLI flag: -distributor.otlp.enable-type-and-unit-labels
   [enable_type_and_unit_labels: <boolean> | default = false]
+
+  # If true, suffixes will be added to the metrics for name normalization.
+  # CLI flag: -distributor.otlp.add-metric-suffixes
+  [add_metric_suffixes: <boolean> | default = true]
 ```
 
 ### `etcd_config`
@@ -5604,7 +5608,7 @@ ring:
 [flush_period: <duration> | default = 1m]
 
 # Enable the ruler api
-# CLI flag: -experimental.ruler.enable-api
+# CLI flag: -ruler.enable-api
 [enable_api: <boolean> | default = false]
 
 # EXPERIMENTAL: Remove duplicate rules in the prometheus rules and alerts API

docs/configuration/v1-guarantees.md

@@ -39,10 +39,7 @@ Currently experimental features are:
   - Evaluate rules to query frontend instead of ingesters (enabled via `-ruler.frontend-address`).
   - When `-ruler.frontend-address` is specified, the response format can be specified (via `-ruler.query-response-format`).
 - S3 Server Side Encryption (SSE) using KMS (including per-tenant KMS config overrides).
-- Ruler API (to PUT rules).
 - Alertmanager:
-  - API (enabled via `-experimental.alertmanager.enable-api`)
-  - Sharding of tenants across multiple instances (enabled via `-alertmanager.sharding-enabled`)
   - Receiver integrations firewall (configured via `-alertmanager.receivers-firewall.*`)
 - gRPC Store.
 - TLS configuration in gRPC and HTTP clients.

docs/getting-started/cortex-values.yaml

@@ -147,7 +147,7 @@ config:
     # -- Disable alertmanager gossip cluster by setting empty listen_address to empty string
     cluster:
       listen_address: '0.0.0.0:9094'
-    # -- Enable the experimental alertmanager config api.
+    # -- Enable the alertmanager config api.
     enable_api: true
     external_url: '/api/prom/alertmanager'
   frontend:

docs/guides/open-telemetry-collector.md

@@ -77,6 +77,7 @@ distributor:
     disable_target_info: <boolean>
     allow_delta_temporality: <boolean>
     enable_type_and_unit_labels: <boolean>
+    add_metric_suffixes: <boolean>
 ```
 
 ### Ingest `target_info` metric
@@ -156,3 +157,8 @@ overrides:
     promote_resource_attributes: ["attr1", "attr2"]
 `
 ```
+
+### Configure adding suffixes to metrics
+
+The flag `add_metric_suffixes` allows control to add suffixes to the metrics for name normalization.
+This flag is enabled by default.

integration/configs.go

@@ -119,7 +119,7 @@ var (
 			"-api.response-compression-enabled":   "true",
 			"-ruler.enable-sharding":              "false",
 			"-ruler.poll-interval":                "2s",
-			"-experimental.ruler.enable-api":      "true",
+			"-ruler.enable-api":                   "true",
 			"-ruler-storage.backend":              "s3",
 			"-ruler-storage.s3.access-key-id":     e2edb.MinioAccessKey,
 			"-ruler-storage.s3.secret-access-key": e2edb.MinioSecretKey,

integration/e2e/service.go

@@ -162,6 +162,12 @@ func (s *ConcreteService) Stop() error {
 
 	s.Wait()
 
+	// Ensure the container is fully removed before returning. Even though
+	// containers are started with --rm, Docker removes them asynchronously
+	// after the process exits. Without this explicit removal, restarting a
+	// container with the same name can fail with "name already in use".
+	_, _ = RunCommandAndGetOutput("docker", "rm", "--force", s.containerName())
+
 	s.usedNetworkName = ""
 
 	return nil
@@ -181,6 +187,12 @@ func (s *ConcreteService) Kill() error {
 
 	s.Wait()
 
+	// Ensure the container is fully removed before returning. Even though
+	// containers are started with --rm, Docker removes them asynchronously
+	// after the process exits. Without this explicit removal, restarting a
+	// container with the same name can fail with "name already in use".
+	_, _ = RunCommandAndGetOutput("docker", "rm", "--force", s.containerName())
+
 	s.usedNetworkName = ""
 
 	return nil