grafana-cold-storage · rfratto · Dec 8, 2021 · Dec 8, 2021
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -5,6 +5,16 @@
 
 - [ENHANCEMENT] Traces: Improved pod association in PromSD processor (@mapno)
 
+# v0.21.2 (2021-12-08)
+
+- [SECURITY] This release contains a fix for
+  [CVE-2021-41090](https://github.com/grafana/agent/security/advisories/GHSA-9c4x-5hgq-q3wh).
+
+- [CHANGE] This release disables the existing `/-/config` and
+  `/agent/api/v1/configs/{name}` endpoitns by default. Pass the
+  `--config.enable-read-api` flag at the command line to opt in to these
+  endpoints.
+
 # v0.21.1 (2021-11-18)
 
 - [BUGFIX] Fix panic when using postgres_exporter integration (@saputradharma)
@@ -47,6 +57,18 @@
 
 - [CHANGE] Traces: Changed service graphs store implementation to improve CPU performance (@mapno)
 
+# v0.20.1 (2021-12-08)
+
+*NOTE*: The fixes in this patch are only present in v0.20.1 and >=v0.21.2.
+
+- [SECURITY] This release contains a fix for
+  [CVE-2021-41090](https://github.com/grafana/agent/security/advisories/GHSA-9c4x-5hgq-q3wh).
+
+- [CHANGE] This release disables the existing `/-/config` and
+  `/agent/api/v1/configs/{name}` endpoitns by default. Pass the
+  `--config.enable-read-api` flag at the command line to opt in to these
+  endpoints.
+
 # v0.20.0 (2021-10-28)
 
 - [FEATURE] Operator: The Grafana Agent Operator can now generate a Kubelet

diff --git a/docs/configuration/integrations/node-exporter-config.md b/docs/configuration/integrations/node-exporter-config.md
@@ -26,7 +26,7 @@ docker run \
   -v "/proc:/host/proc:ro,rslave" \
   -v /tmp/agent:/etc/agent \
   -v /path/to/config.yaml:/etc/agent-config/agent.yaml \
-  grafana/agent:v0.21.1 \
+  grafana/agent:v0.21.2 \
   --config.file=/etc/agent-config/agent.yaml
 ```
 
@@ -66,7 +66,7 @@ metadata:
   name: agent
 spec:
   containers:
-  - image: grafana/agent:v0.21.1
+  - image: grafana/agent:v0.21.2
     name: agent
     args:
     - --config.file=/etc/agent-config/agent.yaml

diff --git a/docs/configuration/integrations/process-exporter-config.md b/docs/configuration/integrations/process-exporter-config.md
@@ -18,7 +18,7 @@ docker run \
   -v "/proc:/proc:ro" \
   -v /tmp/agent:/etc/agent \
   -v /path/to/config.yaml:/etc/agent-config/agent.yaml \
-  grafana/agent:v0.21.1 \
+  grafana/agent:v0.21.2 \
   --config.file=/etc/agent-config/agent.yaml
 ```
 
@@ -35,7 +35,7 @@ metadata:
   name: agent
 spec:
   containers:
-  - image: grafana/agent:v0.21.1
+  - image: grafana/agent:v0.21.2
     name: agent
     args:
     - --config.file=/etc/agent-config/agent.yaml

diff --git a/docs/getting-started/_index.md b/docs/getting-started/_index.md
@@ -26,7 +26,7 @@ See the list of [Community Projects](#community-projects) for the community-driv
 docker run \
   -v /tmp/agent:/etc/agent/data \
   -v /path/to/config.yaml:/etc/agent/agent.yaml \
-  grafana/agent:v0.21.1
+  grafana/agent:v0.21.2
 ```
 
 Replace `/tmp/agent` with the folder you wish to store WAL data in. WAL data is

diff --git a/docs/operator/custom-resource-quickstart.md b/docs/operator/custom-resource-quickstart.md
@@ -43,7 +43,7 @@ metadata:
   labels:
     app: grafana-agent
 spec:
-  image: grafana/agent:v0.21.1
+  image: grafana/agent:v0.21.2
   logLevel: info
   serviceAccountName: grafana-agent
   metrics:

diff --git a/docs/operator/getting-started.md b/docs/operator/getting-started.md
@@ -72,7 +72,7 @@ spec:
       serviceAccountName: grafana-agent-operator
       containers:
       - name: operator
-        image: grafana/agent-operator:v0.21.1
+        image: grafana/agent-operator:v0.21.2
         args:
         - --kubelet-service=default/kubelet
 ---

diff --git a/docs/upgrade-guide/_index.md b/docs/upgrade-guide/_index.md
@@ -12,6 +12,16 @@ releases and how to migrate to newer versions.
 
 These changes will come in a future version.
 
+## v0.21.2, v0.20.1
+
+### Disabling of config retrieval enpoints
+
+These two patch releases, as part of a fix for
+[CVE-2021-41090](https://github.com/grafana/agent/security/advisories/GHSA-9c4x-5hgq-q3wh),
+disable the `/-/config` and `/agent/api/v1/configs/{name}` endpoints by
+default. Pass the `--config.enable-read-api` flag at the command line to
+re-enable them.
+
 ## v0.21.0
 
 ### Integrations: Change in how instance labels are handled (Breaking change)

diff --git a/pkg/operator/defaults.go b/pkg/operator/defaults.go
@@ -15,8 +15,10 @@ var (
 		"v0.18.4",
 		"v0.19.0",
 		"v0.20.0",
+		"v0.20.1",
 		"v0.21.0",
 		"v0.21.1",
+		"v0.21.2",
 
 		// NOTE(rfratto): when performing an upgrade, add the newest version above instead of changing the existing reference.
 	}

diff --git a/production/README.md b/production/README.md
@@ -27,7 +27,7 @@ directory on your host that you want the agent to store its WAL.
 docker run \
   -v /tmp/agent:/etc/agent/data \
   -v /path/to/config.yaml:/etc/agent/agent.yaml \
-  grafana/agent:v0.21.1
+  grafana/agent:v0.21.2
 ```
 
 ## Running the Agent locally

diff --git a/production/grafanacloud-install.sh b/production/grafanacloud-install.sh
@@ -50,7 +50,7 @@ PACKAGE_SYSTEM=${PACKAGE_SYSTEM:=}
 #
 # Global constants.
 #
-RELEASE_VERSION="0.21.1"
+RELEASE_VERSION="0.21.2"
 
 RELEASE_URL="https://github.com/grafana/agent/releases/download/v${RELEASE_VERSION}"
 DEB_URL="${RELEASE_URL}/grafana-agent-${RELEASE_VERSION}-1.${ARCH}.deb"

diff --git a/production/kubernetes/agent-bare.yaml b/production/kubernetes/agent-bare.yaml
@@ -66,7 +66,7 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
-        image: grafana/agent:v0.21.1
+        image: grafana/agent:v0.21.2
         imagePullPolicy: IfNotPresent
         name: agent
         ports:

diff --git a/production/kubernetes/agent-loki.yaml b/production/kubernetes/agent-loki.yaml
@@ -64,7 +64,7 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
-        image: grafana/agent:v0.21.1
+        image: grafana/agent:v0.21.2
         imagePullPolicy: IfNotPresent
         name: agent
         ports:

diff --git a/production/kubernetes/agent-traces.yaml b/production/kubernetes/agent-traces.yaml
@@ -109,7 +109,7 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
-        image: grafana/agent:v0.21.1
+        image: grafana/agent:v0.21.2
         imagePullPolicy: IfNotPresent
         name: agent
         ports:

diff --git a/production/kubernetes/build/lib/version.libsonnet b/production/kubernetes/build/lib/version.libsonnet
@@ -1 +1 @@
-'grafana/agent:v0.21.1'
+'grafana/agent:v0.21.2'
diff --git a/production/kubernetes/install-bare.sh b/production/kubernetes/install-bare.sh
@@ -25,7 +25,7 @@ check_installed() {
 check_installed curl
 check_installed envsubst
 
-MANIFEST_BRANCH=v0.21.1
+MANIFEST_BRANCH=v0.21.2
 MANIFEST_URL=${MANIFEST_URL:-https://raw.githubusercontent.com/grafana/agent/${MANIFEST_BRANCH}/production/kubernetes/agent-bare.yaml}
 NAMESPACE=${NAMESPACE:-default}
 

diff --git a/production/tanka/grafana-agent/v1/main.libsonnet b/production/tanka/grafana-agent/v1/main.libsonnet
@@ -15,8 +15,8 @@ local service = k.core.v1.service;
 (import './lib/traces.libsonnet') +
 {
   _images:: {
-    agent: 'grafana/agent:v0.21.1',
-    agentctl: 'grafana/agentctl:v0.21.1',
+    agent: 'grafana/agent:v0.21.2',
+    agentctl: 'grafana/agentctl:v0.21.2',
   },
 
   // new creates a new DaemonSet deployment of the grafana-agent. By default,

diff --git a/production/tanka/grafana-agent/v2/internal/base.libsonnet b/production/tanka/grafana-agent/v2/internal/base.libsonnet
@@ -10,8 +10,8 @@ function(name='grafana-agent', namespace='') {
   local this = self,
 
   _images:: {
-    agent: 'grafana/agent:v0.21.1',
-    agentctl: 'grafana/agentctl:v0.21.1',
+    agent: 'grafana/agent:v0.21.2',
+    agentctl: 'grafana/agentctl:v0.21.2',
   },
   _config:: {
     name: name,

diff --git a/production/tanka/grafana-agent/v2/internal/syncer.libsonnet b/production/tanka/grafana-agent/v2/internal/syncer.libsonnet
@@ -14,7 +14,7 @@ function(
 ) {
   local _config = {
     api: error 'api must be set',
-    image: 'grafana/agentctl:v0.21.1',
+    image: 'grafana/agentctl:v0.21.2',
     schedule: '*/5 * * * *',
     configs: [],
   } + config,