From 5cbf526faf102f7ca91529dd3225792fa8b55c87 Mon Sep 17 00:00:00 2001 From: Robert Fratto Date: Wed, 8 Dec 2021 08:37:34 -0500 Subject: [PATCH] announce patch releases for cve-2021-41090 --- CHANGELOG.md | 22 +++++++++++++++++++ .../integrations/node-exporter-config.md | 4 ++-- .../integrations/process-exporter-config.md | 4 ++-- docs/getting-started/_index.md | 2 +- docs/operator/custom-resource-quickstart.md | 2 +- docs/operator/getting-started.md | 2 +- docs/upgrade-guide/_index.md | 10 +++++++++ pkg/operator/defaults.go | 2 ++ production/README.md | 2 +- production/grafanacloud-install.sh | 2 +- production/kubernetes/agent-bare.yaml | 2 +- production/kubernetes/agent-loki.yaml | 2 +- production/kubernetes/agent-traces.yaml | 2 +- .../kubernetes/build/lib/version.libsonnet | 2 +- production/kubernetes/install-bare.sh | 2 +- .../tanka/grafana-agent/v1/main.libsonnet | 4 ++-- .../grafana-agent/v2/internal/base.libsonnet | 4 ++-- .../v2/internal/syncer.libsonnet | 2 +- 18 files changed, 53 insertions(+), 19 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c30203472ac6..820d0dc85d18 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,16 @@ - [ENHANCEMENT] Traces: Improved pod association in PromSD processor (@mapno) +# v0.21.2 (2021-12-08) + +- [SECURITY] This release contains a fix for + [CVE-2021-41090](https://github.com/grafana/agent/security/advisories/GHSA-9c4x-5hgq-q3wh). + +- [CHANGE] This release disables the existing `/-/config` and + `/agent/api/v1/configs/{name}` endpoitns by default. Pass the + `--config.enable-read-api` flag at the command line to opt in to these + endpoints. + # v0.21.1 (2021-11-18) - [BUGFIX] Fix panic when using postgres_exporter integration (@saputradharma) @@ -47,6 +57,18 @@ - [CHANGE] Traces: Changed service graphs store implementation to improve CPU performance (@mapno) +# v0.20.1 (2021-12-08) + +*NOTE*: The fixes in this patch are only present in v0.20.1 and >=v0.21.2. + +- [SECURITY] This release contains a fix for + [CVE-2021-41090](https://github.com/grafana/agent/security/advisories/GHSA-9c4x-5hgq-q3wh). + +- [CHANGE] This release disables the existing `/-/config` and + `/agent/api/v1/configs/{name}` endpoitns by default. Pass the + `--config.enable-read-api` flag at the command line to opt in to these + endpoints. + # v0.20.0 (2021-10-28) - [FEATURE] Operator: The Grafana Agent Operator can now generate a Kubelet diff --git a/docs/configuration/integrations/node-exporter-config.md b/docs/configuration/integrations/node-exporter-config.md index 42d6c4875006..d44d675a6a39 100644 --- a/docs/configuration/integrations/node-exporter-config.md +++ b/docs/configuration/integrations/node-exporter-config.md @@ -26,7 +26,7 @@ docker run \ -v "/proc:/host/proc:ro,rslave" \ -v /tmp/agent:/etc/agent \ -v /path/to/config.yaml:/etc/agent-config/agent.yaml \ - grafana/agent:v0.21.1 \ + grafana/agent:v0.21.2 \ --config.file=/etc/agent-config/agent.yaml ``` @@ -66,7 +66,7 @@ metadata: name: agent spec: containers: - - image: grafana/agent:v0.21.1 + - image: grafana/agent:v0.21.2 name: agent args: - --config.file=/etc/agent-config/agent.yaml diff --git a/docs/configuration/integrations/process-exporter-config.md b/docs/configuration/integrations/process-exporter-config.md index 3e0ccb7dc921..d5e428841a54 100644 --- a/docs/configuration/integrations/process-exporter-config.md +++ b/docs/configuration/integrations/process-exporter-config.md @@ -18,7 +18,7 @@ docker run \ -v "/proc:/proc:ro" \ -v /tmp/agent:/etc/agent \ -v /path/to/config.yaml:/etc/agent-config/agent.yaml \ - grafana/agent:v0.21.1 \ + grafana/agent:v0.21.2 \ --config.file=/etc/agent-config/agent.yaml ``` @@ -35,7 +35,7 @@ metadata: name: agent spec: containers: - - image: grafana/agent:v0.21.1 + - image: grafana/agent:v0.21.2 name: agent args: - --config.file=/etc/agent-config/agent.yaml diff --git a/docs/getting-started/_index.md b/docs/getting-started/_index.md index 8e16295475cf..bf477d9448a2 100644 --- a/docs/getting-started/_index.md +++ b/docs/getting-started/_index.md @@ -26,7 +26,7 @@ See the list of [Community Projects](#community-projects) for the community-driv docker run \ -v /tmp/agent:/etc/agent/data \ -v /path/to/config.yaml:/etc/agent/agent.yaml \ - grafana/agent:v0.21.1 + grafana/agent:v0.21.2 ``` Replace `/tmp/agent` with the folder you wish to store WAL data in. WAL data is diff --git a/docs/operator/custom-resource-quickstart.md b/docs/operator/custom-resource-quickstart.md index 57160a08d638..bfef07d9cb47 100644 --- a/docs/operator/custom-resource-quickstart.md +++ b/docs/operator/custom-resource-quickstart.md @@ -43,7 +43,7 @@ metadata: labels: app: grafana-agent spec: - image: grafana/agent:v0.21.1 + image: grafana/agent:v0.21.2 logLevel: info serviceAccountName: grafana-agent metrics: diff --git a/docs/operator/getting-started.md b/docs/operator/getting-started.md index 662fccbd945e..fe11b9543a92 100644 --- a/docs/operator/getting-started.md +++ b/docs/operator/getting-started.md @@ -72,7 +72,7 @@ spec: serviceAccountName: grafana-agent-operator containers: - name: operator - image: grafana/agent-operator:v0.21.1 + image: grafana/agent-operator:v0.21.2 args: - --kubelet-service=default/kubelet --- diff --git a/docs/upgrade-guide/_index.md b/docs/upgrade-guide/_index.md index 299c6be7238c..bff63e6ae01a 100644 --- a/docs/upgrade-guide/_index.md +++ b/docs/upgrade-guide/_index.md @@ -12,6 +12,16 @@ releases and how to migrate to newer versions. These changes will come in a future version. +## v0.21.2, v0.20.1 + +### Disabling of config retrieval enpoints + +These two patch releases, as part of a fix for +[CVE-2021-41090](https://github.com/grafana/agent/security/advisories/GHSA-9c4x-5hgq-q3wh), +disable the `/-/config` and `/agent/api/v1/configs/{name}` endpoints by +default. Pass the `--config.enable-read-api` flag at the command line to +re-enable them. + ## v0.21.0 ### Integrations: Change in how instance labels are handled (Breaking change) diff --git a/pkg/operator/defaults.go b/pkg/operator/defaults.go index efc54e6f7062..e0189dc0f942 100644 --- a/pkg/operator/defaults.go +++ b/pkg/operator/defaults.go @@ -15,8 +15,10 @@ var ( "v0.18.4", "v0.19.0", "v0.20.0", + "v0.20.1", "v0.21.0", "v0.21.1", + "v0.21.2", // NOTE(rfratto): when performing an upgrade, add the newest version above instead of changing the existing reference. } diff --git a/production/README.md b/production/README.md index 020deb53a7fc..2fe509253e6e 100644 --- a/production/README.md +++ b/production/README.md @@ -27,7 +27,7 @@ directory on your host that you want the agent to store its WAL. docker run \ -v /tmp/agent:/etc/agent/data \ -v /path/to/config.yaml:/etc/agent/agent.yaml \ - grafana/agent:v0.21.1 + grafana/agent:v0.21.2 ``` ## Running the Agent locally diff --git a/production/grafanacloud-install.sh b/production/grafanacloud-install.sh index 701dfddb1a0d..b7acda2ba2c5 100755 --- a/production/grafanacloud-install.sh +++ b/production/grafanacloud-install.sh @@ -50,7 +50,7 @@ PACKAGE_SYSTEM=${PACKAGE_SYSTEM:=} # # Global constants. # -RELEASE_VERSION="0.21.1" +RELEASE_VERSION="0.21.2" RELEASE_URL="https://github.com/grafana/agent/releases/download/v${RELEASE_VERSION}" DEB_URL="${RELEASE_URL}/grafana-agent-${RELEASE_VERSION}-1.${ARCH}.deb" diff --git a/production/kubernetes/agent-bare.yaml b/production/kubernetes/agent-bare.yaml index ccc52c952bb8..cea60c76ba81 100644 --- a/production/kubernetes/agent-bare.yaml +++ b/production/kubernetes/agent-bare.yaml @@ -66,7 +66,7 @@ spec: valueFrom: fieldRef: fieldPath: spec.nodeName - image: grafana/agent:v0.21.1 + image: grafana/agent:v0.21.2 imagePullPolicy: IfNotPresent name: agent ports: diff --git a/production/kubernetes/agent-loki.yaml b/production/kubernetes/agent-loki.yaml index 2f361e72f888..bd746b2b7b98 100644 --- a/production/kubernetes/agent-loki.yaml +++ b/production/kubernetes/agent-loki.yaml @@ -64,7 +64,7 @@ spec: valueFrom: fieldRef: fieldPath: spec.nodeName - image: grafana/agent:v0.21.1 + image: grafana/agent:v0.21.2 imagePullPolicy: IfNotPresent name: agent ports: diff --git a/production/kubernetes/agent-traces.yaml b/production/kubernetes/agent-traces.yaml index b24195c78871..51b82f7e5151 100644 --- a/production/kubernetes/agent-traces.yaml +++ b/production/kubernetes/agent-traces.yaml @@ -109,7 +109,7 @@ spec: valueFrom: fieldRef: fieldPath: spec.nodeName - image: grafana/agent:v0.21.1 + image: grafana/agent:v0.21.2 imagePullPolicy: IfNotPresent name: agent ports: diff --git a/production/kubernetes/build/lib/version.libsonnet b/production/kubernetes/build/lib/version.libsonnet index 1f68d087721c..47c428aa1220 100644 --- a/production/kubernetes/build/lib/version.libsonnet +++ b/production/kubernetes/build/lib/version.libsonnet @@ -1 +1 @@ -'grafana/agent:v0.21.1' +'grafana/agent:v0.21.2' diff --git a/production/kubernetes/install-bare.sh b/production/kubernetes/install-bare.sh index 80c0e52f9a63..cfcef950a1ce 100644 --- a/production/kubernetes/install-bare.sh +++ b/production/kubernetes/install-bare.sh @@ -25,7 +25,7 @@ check_installed() { check_installed curl check_installed envsubst -MANIFEST_BRANCH=v0.21.1 +MANIFEST_BRANCH=v0.21.2 MANIFEST_URL=${MANIFEST_URL:-https://raw.githubusercontent.com/grafana/agent/${MANIFEST_BRANCH}/production/kubernetes/agent-bare.yaml} NAMESPACE=${NAMESPACE:-default} diff --git a/production/tanka/grafana-agent/v1/main.libsonnet b/production/tanka/grafana-agent/v1/main.libsonnet index fe8af7c363d4..cda3bffd1942 100644 --- a/production/tanka/grafana-agent/v1/main.libsonnet +++ b/production/tanka/grafana-agent/v1/main.libsonnet @@ -15,8 +15,8 @@ local service = k.core.v1.service; (import './lib/traces.libsonnet') + { _images:: { - agent: 'grafana/agent:v0.21.1', - agentctl: 'grafana/agentctl:v0.21.1', + agent: 'grafana/agent:v0.21.2', + agentctl: 'grafana/agentctl:v0.21.2', }, // new creates a new DaemonSet deployment of the grafana-agent. By default, diff --git a/production/tanka/grafana-agent/v2/internal/base.libsonnet b/production/tanka/grafana-agent/v2/internal/base.libsonnet index 15b769b1ef19..c07b012d978d 100644 --- a/production/tanka/grafana-agent/v2/internal/base.libsonnet +++ b/production/tanka/grafana-agent/v2/internal/base.libsonnet @@ -10,8 +10,8 @@ function(name='grafana-agent', namespace='') { local this = self, _images:: { - agent: 'grafana/agent:v0.21.1', - agentctl: 'grafana/agentctl:v0.21.1', + agent: 'grafana/agent:v0.21.2', + agentctl: 'grafana/agentctl:v0.21.2', }, _config:: { name: name, diff --git a/production/tanka/grafana-agent/v2/internal/syncer.libsonnet b/production/tanka/grafana-agent/v2/internal/syncer.libsonnet index 2f0050d85113..a90672591d68 100644 --- a/production/tanka/grafana-agent/v2/internal/syncer.libsonnet +++ b/production/tanka/grafana-agent/v2/internal/syncer.libsonnet @@ -14,7 +14,7 @@ function( ) { local _config = { api: error 'api must be set', - image: 'grafana/agentctl:v0.21.1', + image: 'grafana/agentctl:v0.21.2', schedule: '*/5 * * * *', configs: [], } + config,