Problem
The first question in many incidents is "what changed?" — yet change data often lives outside the observability tools engineers use during investigation.
Current Practice
Deployment history sits in CI/CD systems, chat announcements, or ticketing tools — disconnected from metrics, logs, and traces on the investigation timeline.
Why It Breaks Down
Engineers lose minutes reconstructing change timelines. Automated correlation cannot link symptoms to causes when changes are invisible to the evidence model.
Architecture
Ingest deployment, rollout, and configuration change events as evidence alongside telemetry — aligned on service identity and timestamps.
01
Deploy
Rollout + config event
02
Identity
service.name alignment
03
Timeline
Shared timestamps
04
Evidence
Change + signal
05
Investigate
What changed?
Tradeoffs
Change ingestion adds integration work and noise if every minor config flip is treated as high-signal. Filter and classify changes by blast radius and production relevance.
Implementation
Connect Kubernetes deployment events, Helm releases, and feature-flag changes to the same resource identity used by OpenTelemetry signals.
Further Reading
- Kubernetes deployment controller events
- OpenTelemetry trace context propagation
- CHANGELOG and release engineering practices