Erich Blume
b1e2811077
## Summary - Bumps Grafana from 12.3.3 to 12.4.2 - Patches 7 CVEs, notably CVE-2026-27880 (unauthenticated OOM DoS, CVSS 7.5) and CVE-2026-27879 (authenticated OOM via resample queries) - No config changes required — reviewed alerting, datasources, OIDC, and feature toggles against 12.4.x breaking changes ## Breaking changes reviewed | Change | Impact | |--------|--------| | Alerting: pending period applies to NoData/Error | Net positive — reduces noise from transient blips | | Default notification uses empty receiver | No impact — we explicitly set `ntfy-infra` | | Removed feature toggles (4) | No impact — none configured | | OAuth ID token signature validation | Low risk — verify OIDC login post-deploy | | OpsGenie deprecated | No impact — using webhook | ## Test plan - [ ] Container build completes at forge - [ ] Update kustomization.yaml with new image tag - [ ] `argocd app set grafana --revision upgrade/grafana-12.4.2 && argocd app sync grafana` - [ ] Verify Grafana UI loads at grafana.ops.eblu.me - [ ] Verify OIDC login via Authentik - [ ] Verify dashboards and datasources load - [ ] Check alerting rules are intact 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: #322
39 lines
873 B
YAML
39 lines
873 B
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
namespace: monitoring
|
|
|
|
resources:
|
|
- serviceaccount.yaml
|
|
- pvc.yaml
|
|
- deployment.yaml
|
|
- service.yaml
|
|
- rbac.yaml
|
|
|
|
images:
|
|
- name: docker.io/library/alpine
|
|
newTag: "3.21"
|
|
- name: docker.io/library/busybox
|
|
newTag: 1.31.1
|
|
- name: registry.ops.eblu.me/blumeops/grafana-sidecar
|
|
newTag: v1.28.0-613f05d
|
|
- name: registry.ops.eblu.me/blumeops/grafana
|
|
newTag: v12.4.2-4c54774
|
|
|
|
configMapGenerator:
|
|
- name: grafana
|
|
files:
|
|
- grafana.ini
|
|
- datasources.yaml
|
|
- alerting.yaml
|
|
options:
|
|
labels:
|
|
app.kubernetes.io/name: grafana
|
|
app.kubernetes.io/instance: grafana
|
|
- name: grafana-config-dashboards
|
|
files:
|
|
- provider.yaml
|
|
options:
|
|
labels:
|
|
app.kubernetes.io/name: grafana
|
|
app.kubernetes.io/instance: grafana
|