LoginSign Up
← Back to all sparks
C

Cortex

ANALYTICS
Velocity0.0

Horizontally scalable, multi-tenant Prometheus metrics store

cortexmetrics.io ↗

Cortex is betting on Parquet block storage and graduating years of experimental features.

metricsprometheusparquetmulti-tenancystoragehardening
◆Current state
Cortex publishes its release notes as release candidates, and the two majors visible here tell a consistent story. 1.20 introduced Parquet-based block storage, Prometheus Remote Write 2.0, a resource-based limiter for ingesters and store-gateways, and regex tenant resolution, all experimental. 1.21 then made Parquet a Store Gateway query mode, graduated the Ruler API, Alertmanager API and sharding, tenant federation, FIFO/Redis cache and memcached service discovery out of experimental, and enabled the bucket index by default. The 1.21.1 candidate is almost entirely security hardening.
◆Where it's heading
Two arcs run in parallel. The storage arc is moving Cortex off pure TSDB blocks toward Parquet, first as a converter and format, then as a queryable Store Gateway mode — the same columnar direction the rest of the observability market has taken for long-retention data. The maturity arc is a deliberate clearing of the experimental backlog, with six subsystems graduating in one release and their flags renamed to drop the experimental prefix. Layered on both is a distinct hardening push: the latest candidate bounds gossip connections, caps decompressed request bodies, adds HMAC stream authentication and validates tenant IDs against the authenticated caller.
◆Prediction
Expect Parquet to keep progressing from experimental toward default, following the path the bucket index just completed. The security work in 1.21.1 reads like a systematic pass over untrusted input paths rather than a response to a single report, so more of the same in the ingestion and gossip layers is likely.

◆Recent moves

  1. 2mo ago

    1.21.1 candidate hardens gossip, ingestion and status pages

    A candidate made almost entirely of security fixes: stored XSS in Alertmanager and Store Gateway status pages, decompressed gzip output capped on the OTLP path, native histogram size limits against memory amplification, credentials masked on /config, and new flags bounding inbound gossip connections. Also adds HMAC-SHA256 stream authentication and rejects PushStream requests whose tenant ID does not match the caller.

    View source ↗
  2. 3mo ago

    1.21.0-rc.1 fixes memberlist, tenant federation and a memory leak

    A cleanup candidate: a HA tracker panic on deleted memberlist keys, a tenant federation regex failure when matching zero or one tenant, and a memory leak in ReuseWriteRequestV2 from unreleased symbol pointers. Most of these land on the features 1.21.0 was in the process of graduating.

    View source ↗
  3. 4mo ago

    Parquet becomes a Store Gateway mode as six features graduate

    ⚡ SPARK

    The release where 1.20's experiments become supported product: Parquet moves from a format and converter to a Store Gateway query mode, and six subsystems shed their experimental flags at once. Together with the bucket index becoming default, this is Cortex declaring a large part of its recent surface production-ready.

    View source ↗
  4. 9mo ago

    1.20.0-rc.1 fixes metric name validation and a compactor race

    Two bug fixes ahead of the 1.20 release: wrong validation logic being applied to metric names, and a compactor race that could leave partitions uncompacted. A short stabilisation candidate rather than new content.

    View source ↗
  5. 9mo ago

    Cortex 1.20 introduces Parquet storage and Remote Write 2.0

    ⚡ SPARK

    The release that opens the current arc: experimental Parquet block storage with a converter service and querier support, Prometheus Remote Write 2.0, gRPC stream push between distributor and ingester, and a resource-based limiter. Everything 1.21 graduates or promotes traces back to this batch.

    View source ↗