April 2026 Summaries

Groundcover's development of Agent Mode marks a significant shift in observability, transitioning from traditional dashboards to an agent-first model that operates the platform from within rather than serving as an external assistant. This approach enables a more integrated and efficient system, as the agent uses the native query language gcQL to directly interact with the platform, allowing for precise execution and reliable investigations. By embedding the agent into the product, groundcover ensures that observability tasks are handled with context and intelligence, moving beyond merely fetching and summarizing data to making informed operational decisions. This architectural decision emphasizes the agent's role in orchestrating investigations and actions, with the backend executing the analytical work, thereby enhancing the system's flexibility and reducing reliance on external APIs. The result is a more dynamic and responsive observability platform where traditional artifacts like dashboards and monitors become outputs of investigations rather than starting points, offering a more nuanced and action-oriented user experience.

The text delves into the complexities and challenges involved in creating a normalizer for OpenTelemetry (OTel) in the context of Generative AI (GenAI). It highlights the discrepancies across different SDKs, frameworks, and providers, emphasizing that "we support OpenTelemetry" varies widely in implementation. The discussion includes examples of radically different data structures from three SDKs for the same conversation, the impact of orchestration frameworks on telemetry data shape, and the evolution through three eras of OTel GenAI semantic conventions. Challenges such as provider-specific semantics, the need for simultaneous support of multiple eras, and the use of eBPF for capturing API calls without SDKs are explored. The text argues for the necessity of a normalization layer to produce a consistent output from diverse data sources, underscoring the ongoing effort to handle provider quirks and ensure compatibility between SDK and eBPF paths, while anticipating eventual convergence in the OTel GenAI ecosystem.

In the blog post, Anais Dotis from groundcover discusses the challenges and insights gained from developing a GenAI SDK, framework, and provider-agnostic AI observability solution using OpenTelemetry (OTel). The goal was to simplify AI observability akin to existing methods for infrastructure, APM, and RUM data collection through their eBPF sensor. However, the team encountered significant complexities due to inconsistent telemetry attributes across various SDKs, frameworks, and LLM providers, highlighting the disparity between the idealized narrative of a unified OTel standard and the real-world variations and quirks. Groundcover’s solution involves normalizing GenAI spans from multiple sources into a single canonical view to manage differences in model naming, token semantics, cost calculations, and provider names. The post emphasizes the importance of bridging these gaps to facilitate reliable AI observability and promises to delve deeper into specific technical aspects in the subsequent part of the series.

Groundcover is set to debut its innovative Agent Mode at Google Cloud Next 2026, offering a bring-your-own-cloud (BYOC) observability platform that enhances AI observability and agentic workloads without exporting sensitive telemetry data. This approach minimizes security and compliance concerns while providing cost-effective solutions by charging customers based on node usage instead of data volume, allowing for comprehensive data observation without sampling. At the core of Agent Mode is the groundcover Query Language (gcQL), which facilitates precise queries across logs, traces, metrics, and events to improve AI-driven investigations. The platform supports integration with major cloud services and introduces new features such as intelligent prompt recommendations, trigger-based background workflows, and AI-assisted code remediation, enhancing productivity and efficiency for engineering teams. Groundcover's participation in Google Cloud Next aims to showcase these advancements, inviting attendees to explore the platform's capabilities firsthand.

Groundcover has introduced AI Observability, utilizing the Berkeley Packet Filter-powered sensor in a bring-your-own-cloud (BYOC) model, to address the limitations of traditional observability systems for agentic applications, which often lead to privacy and economic issues. This platform allows users to have comprehensive visibility into their large language models (LLM) and agentic workloads without extra costs, providing insights into prompts, responses, tokens, and latency, and unifying LLM usage costs. The integration of Agent Mode enables development and SRE teams to enhance remediation efforts and streamline investigations through intelligent prompts and automated workflows, ensuring full context is available without the need for data sampling. Groundcover's approach permits data retention directly within the customer's cloud, eliminating the privacy concerns and unexpected costs associated with traditional SaaS observability solutions, and allowing organizations to deploy agentic applications confidently in production environments.

Kubernetes has deprecated the Pod Security Policy (PSP) as of version 1.21, fully removing it in version 1.25 due to its complexity and inconsistency, prompting organizations to adopt new security measures. The PSP was replaced by Pod Security Admission and Pod Security Standards, which enforce namespace-level security profiles and offer more straightforward, scalable security solutions. To transition smoothly, organizations must audit existing PSP rules, map them to the new standards, and gradually enforce them using audit and warn modes to avoid disruption. Despite this shift, admission policies alone are insufficient, necessitating runtime visibility to detect potential security breaches such as privilege escalations and misconfigurations. Tools like OPA Gatekeeper and Kyverno provide more advanced policy enforcement options, while solutions like groundcover enhance real-time observability by monitoring runtime behavior, thus closing the gap between admission controls and actual workload activities. As Kubernetes continues to be widely adopted, maintaining robust, layered security practices that combine admission controls with runtime detection is crucial for safeguarding clusters.

Groundcover's innovative BYOC (Bring Your Own Cloud) architecture leverages eBPF technology to provide a seamless, zero-code observability experience by keeping all telemetry data within the user's cloud environment, thereby enhancing data security and sovereignty. Unlike traditional SaaS observability solutions, which often lead to fragmented data management and increased costs due to their reliance on external cloud services, groundcover's approach allows for full-stack visibility, including logs, traces, and metrics, without the need for code modifications. This architecture ensures that data is captured at the kernel level, offering a comprehensive and trustworthy view of system operations, which is crucial for effective root cause analysis and reliable agentic workflows. The platform's design emphasizes data completeness and privacy, allowing users to maintain control over their data while benefiting from the fully managed SaaS experience that groundcover provides.