eblume/blumeops
1
1
Fork 0
Code Issues Pull requests Projects Releases 83 Packages Wiki Activity Actions
blumeops/argocd/manifests
History
Erich Blume b1e2811077
All checks were successful
Build Container / detect (push) Successful in 2s
Details
Build Container / build-dockerfile (grafana) (push) Successful in 7s
Details
Upgrade Grafana 12.3.3 → 12.4.2 (#322) 
## Summary

- Bumps Grafana from 12.3.3 to 12.4.2
- Patches 7 CVEs, notably CVE-2026-27880 (unauthenticated OOM DoS, CVSS 7.5) and CVE-2026-27879 (authenticated OOM via resample queries)
- No config changes required — reviewed alerting, datasources, OIDC, and feature toggles against 12.4.x breaking changes

## Breaking changes reviewed

| Change | Impact |
|--------|--------|
| Alerting: pending period applies to NoData/Error | Net positive — reduces noise from transient blips |
| Default notification uses empty receiver | No impact — we explicitly set `ntfy-infra` |
| Removed feature toggles (4) | No impact — none configured |
| OAuth ID token signature validation | Low risk — verify OIDC login post-deploy |
| OpsGenie deprecated | No impact — using webhook |

## Test plan

- [ ] Container build completes at forge
- [ ] Update kustomization.yaml with new image tag
- [ ] `argocd app set grafana --revision upgrade/grafana-12.4.2 && argocd app sync grafana`
- [ ] Verify Grafana UI loads at grafana.ops.eblu.me
- [ ] Verify OIDC login via Authentik
- [ ] Verify dashboards and datasources load
- [ ] Check alerting rules are intact

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Reviewed-on: #322
2026-04-02 11:33:19 -07:00
..
1password-connect Fix 1Password Connect credentials for chart 2.3.0 2026-02-13 17:30:45 -08:00
alloy-k8s Update container tags to fd0bebb (post-merge rebuild) 2026-03-24 13:39:26 -07:00
alloy-ringtail Deploy Tor Snowflake proxy on ringtail (#311) 2026-03-24 20:51:40 -07:00
alloy-tracing-ringtail Update container tags to fd0bebb (post-merge rebuild) 2026-03-24 13:39:26 -07:00
argocd Add ExternalSecret default fields to prevent ArgoCD drift 2026-03-05 09:11:23 -08:00
authentik Update container tags to fd0bebb (post-merge rebuild) 2026-03-24 13:39:26 -07:00
cloudnative-pg Port CloudNative-PG off Helm to direct release manifest (#268) 2026-02-25 17:37:53 -08:00
cv Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00
databases Add borgmatic backups for authentik and immich databases (#314) 2026-03-27 16:59:58 -07:00
devpi Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00
docs Update docs release to v1.15.2 2026-03-30 17:48:40 -07:00
external-secrets Upgrade External Secrets Operator v2.2.0 + migrate Helm to kustomize (#312) 2026-03-25 15:56:41 -07:00
forgejo-runner Upgrade forgejo-runner 12.7.0 → 12.7.3, add service card 2026-03-30 16:31:06 -07:00
frigate Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00
grafana Upgrade Grafana 12.3.3 → 12.4.2 (#322) 2026-04-02 11:33:19 -07:00
grafana-config Add offsite backup for immich photo library to BorgBase (#315) 2026-03-27 19:43:05 -07:00
homepage Deploy Homepage v1.11.0-e375859 2026-03-26 10:25:07 -07:00
immich Fix Immich resource limits and probe timeouts 2026-03-27 22:36:32 -07:00
kingfisher Add compensating controls framework and date-based report dirs (#320) 2026-03-30 17:44:11 -07:00
kiwix Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00
kube-state-metrics Add Prowler mutelist and fix kube-state-metrics seccomp (#319) 2026-03-30 17:22:31 -07:00
kube-state-metrics-ringtail Add :kustomized sentinel tag to manifest images, review devpi 2026-03-06 08:15:06 -08:00
loki Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00
mealie Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00
miniflux Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00
navidrome Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00
ntfy Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00
nvidia-device-plugin Upgrade nvidia-device-plugin v0.18.2 → v0.19.0 and add reference card 2026-03-27 07:19:24 -07:00
ollama Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00
prometheus Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00
prowler Add compensating controls framework and date-based report dirs (#320) 2026-03-30 17:44:11 -07:00
tailscale-operator Expose Forgejo publicly at forge.eblu.me (#278) 2026-03-03 08:40:41 -08:00
tailscale-operator-base Revert Tailscale operator to v1.94.2 — images not yet published 2026-03-22 19:41:40 -07:00
tailscale-operator-ringtail Deploy Tailscale operator on ringtail k3s cluster (#215) 2026-02-19 09:33:05 -08:00
tempo Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00
teslamate Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00
torrent Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00
unpoller Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00