Repository navigation
Conversation
The stack pins grafana/grafana:9.3.0 (December 2022). That release has been end-of-life for years: every CVE fixed since - including the auth-bypass and XSS fixes in 9.5/10.x - is missing from the monitoring stack every node operator runs. Bump the default to 12.4.14 (the current 12.x line, still receiving patches; 13.2.5 is available if you would rather jump to the newest major). Compatibility was checked against the shipped dashboard before bumping: - schemaVersion 37 is auto-migrated by Grafana on load - panel types are gauge/row/stat/timeseries - all core panels, no removed 'graph' panel - the dashboard's datasource uid 6R74VAnVz matches the provisioned datasource uid - provisioning apiVersion 1, GF_SECURITY_ADMIN_PASSWORD and the file-based dashboard provider are unchanged in 12.x While in there, fix the provisioning schema: both files use org_id, which modern Grafana ignores (it expects orgId), so the datasource and dashboard provider silently fall back to org 1. Use the documented key. Also drop the two InfluxDB entries from deleteDatasources - InfluxDB left the stack in inkonchain#97, so they can never match anything.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
docker-compose.yml:grafana/grafana:${IMAGE_TAG__GRAFANA:-9.3.0}→12.4.14docker/grafana/provisioning/datasources/all.yml:org_id: 1→orgId: 1, and drop the twoInfluxDBentries fromdeleteDatasourcesdocker/grafana/provisioning/dashboards/all.yml:org_id: 1→orgId: 1Why
The version. 9.3.0 is from December 2022 and has been end-of-life for years — every Grafana CVE fixed since (including the auth-bypass and XSS fixes shipped in 9.5 and 10.x) is missing from the monitoring stack every node operator runs. 12.4.14 is the current 12.x line and still receives patches (13.2.5 is available if you would rather jump to the newest major).
Compatibility, checked against the shipped dashboard before bumping:
schemaVersion: 37gauge,row,stat,timeseries— all core panels; no removedgraphpanel6R74VAnVz, which matches the provisioned datasourceapiVersion: 1, file-based dashboard provider,GF_SECURITY_ADMIN_PASSWORD— all unchanged in 12.xThe keys. Both provisioning files use
org_id; modern Grafana expectsorgIdand silently ignores the unknown field, so the datasource and dashboard provider fall back to org 1 (which happens to be the only org). Use the documented key so the intent is explicit and survives stricter parsing.The InfluxDB entries. InfluxDB left the stack in #97, so
deleteDatasourcescan never match them — dead config.Verification
IMAGE_TAG__GRAFANAis documented in.env.example, so anyone pinned to an older tag is unaffectedNot verified: a live Grafana start (no Docker here) — the compatibility table above is from reading the shipped dashboard against Grafana's documented provisioning and migration behaviour.