355 Commits (a8aa3f68cb46289baf912b22e427b1a18a520bcc)

Author	SHA1	Message	Date
Robert Jacob	aeaefe6aab	feat(operator): Extend Azure secret validation (#12007) ... Co-authored-by: Periklis Tsirakidis <periklis@redhat.com>	2 years ago
Robert Jacob	1f3e64bbe1	fix(operator): Support using multiple buckets with AWS STS (#12008) ... Co-authored-by: Periklis Tsirakidis <periklis@redhat.com>	2 years ago
Robert Jacob	4e1b210017	operator: Provide Azure region for managed credentials using environment variable (#11964)	2 years ago
Paul Rogers	472496feb7	Parse JSON String arrays properly so string elements can be retrieved (#11921) ... **What this PR does / why we need it**: This PR imports the newly forked grafana/jsonparser over the buger/jsonparser module. The latter has seemingly been abandoned. PR 10690 introduces a fix to the jsonparser module, which has been incorporated into the grafana fork of the module. The PR is designed to fix accessing string array elements from within a JSON structure. For example, with the following JSON: `{"log":{"message":{"content":{"misses":["a","b","c","d"]}}}}` The Loki code, before this PR, when searching for `json misses = "log.message.content.misses[0]" ` will result in an "Unknown value type error". After this PR is merged, the result will assign `a` to the `misses` variable. **Which issue(s) this PR fixes**: Fixes #[9179](https://github.com/grafana/loki/issues/9179) https://github.com/grafana/loki/pull/10690 **Special notes for your reviewer**: **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [ ] Documentation added - [x] Tests updated - [x] `CHANGELOG.md` updated - [x] If the change is worth mentioning in the release notes, add `add-to-release-notes` label - [ ] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [ ] For Helm chart changes bump the Helm chart version in `production/helm/loki/Chart.yaml` and update `production/helm/loki/CHANGELOG.md` and `production/helm/loki/README.md`. [Example PR](d10549e3ec) - [ ] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](0d4416a4b0)	2 years ago
Robert Jacob	6c5c347270	operator: Refactor handling of credentials in managed-auth mode (#11920)	2 years ago
Periklis Tsirakidis	5914df77b9	operator: Add support for running with Google Workload Identity (#11869) ... Co-authored-by: Robert Jacob <rojacob@redhat.com>	2 years ago
Robert Jacob	6b46e373fb	operator: Integrate support for OpenShift-managed credentials in Azure (#11868)	2 years ago
Periklis Tsirakidis	24c760a75e	operator: Allow custom audience for managed-auth on STS (#11854)	2 years ago
Robert Jacob	009c53a75e	operator: Add support for running with Azure Workload Identity (#11802)	2 years ago
Robert Jacob	38d205b967	operator: Improve messages for errors in storage secret (#11824)	2 years ago
Joao Marcal	fe4ba0c3ba	operator: Add OpenShift CloudCredentials support for AWS STS (#11524) ... Co-authored-by: Periklis Tsirakidis <periklis@redhat.com>	2 years ago
Periklis Tsirakidis	88df82295d	operator: Update Loki operand to v2.9.4 (#11778) ... **What this PR does / why we need it**: Update Loki operand to v2.9.4 **Which issue(s) this PR fixes**: Fixes #<issue number> **Special notes for your reviewer**: **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [x] Documentation added - [ ] Tests updated - [x] `CHANGELOG.md` updated - [ ] If the change is worth mentioning in the release notes, add `add-to-release-notes` label - [ ] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [ ] For Helm chart changes bump the Helm chart version in `production/helm/loki/Chart.yaml` and update `production/helm/loki/CHANGELOG.md` and `production/helm/loki/README.md`. [Example PR](d10549e3ec) - [ ] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](0d4416a4b0)	2 years ago
Bayan Taani	837cfc010c	operator: Add a custom metric that collects Lokistacks requiring a schema upgrade (#11513) ... Co-authored-by: Robert Jacob <rojacob@redhat.com> Co-authored-by: Periklis Tsirakidis <periklis@redhat.com>	2 years ago
Periklis Tsirakidis	71d3ab8c54	operator: Upgrade k8s.io, sigs.k8s.io and openshift deps (#11718)	2 years ago
Periklis Tsirakidis	28a413539e	operator: Replace deprecated ctrl-runtime cfg with custom package (#11678) ... Co-authored-by: Robert Jacob <rojacob@redhat.com> Co-authored-by: Robert Jacob <xperimental@solidproject.de>	2 years ago
Periklis Tsirakidis	0065fd6e95	operator: Refactor CreateOrUpdateLokiStack handler (#11592) ... Co-authored-by: Robert Jacob <xperimental@solidproject.de>	2 years ago
Joao Marcal	c7ad168a33	operator: updates mixins to fix structured metadata dashboards (#11671)	2 years ago
Robert Jacob	e7b9455327	operator: React to changes in ConfigMap used for storage CA (#11624)	2 years ago
Joao Marcal	5559b26856	operator: Fixes Ruler RBAC to allow it to send alerts to UWM AM (#11620) ... Updated RBAC now match the new updated requirements by UWM Alertmanager introduced on: https://github.com/openshift/cluster-monitoring-operator/pull/2099	2 years ago
Trevor Whitney	8b48a18d77	Bump build image (#11608) ... **What this PR does / why we need it**: Bumps alpine in the loki build image and ass the build image to the `scan-vulnerabilities` target to make it easier to scan in the future --------- Co-authored-by: Danny Kopping <danny.kopping@grafana.com>	2 years ago
Joao Marcal	4421efe32e	operator: adds AWS sts support (#11481) ... Adds support for users to configure the S3 object storage with AWS STS. Co-authored-by: Periklis Tsirakidis <periklis@nefeli.eu> Co-authored-by: Periklis Tsirakidis <periklis@redhat.com>	2 years ago
Joao Marcal	26432c0bf8	operator: Add serviceaccount per lokistack resource (#11533)	2 years ago
Joao Marcal	003a51b860	operator: Refactor ensureObjectStoreCredentials in manifests/storage package (#11531) ... Co-authored-by: Periklis Tsirakidis <periklis@redhat.com>	2 years ago
dependabot[bot]	9e7c256d26	Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /operator (#11519) ... Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.14.0 to 0.17.0. <details> <summary>Commits</summary> <ul> <li><a href="9d2ee975ef"><code>9d2ee97</code></a> ssh: implement strict KEX protocol changes</li> <li><a href="4e5a26183e"><code>4e5a261</code></a> ssh: close net.Conn on all NewServerConn errors</li> <li><a href="152cdb1503"><code>152cdb1</code></a> x509roots/fallback: update bundle</li> <li><a href="fdfe1f8531"><code>fdfe1f8</code></a> ssh: defer channel window adjustment</li> <li><a href="b8ffc16e10"><code>b8ffc16</code></a> blake2b: drop Go 1.6, Go 1.8 compatibility</li> <li><a href="7e6fbd82c8"><code>7e6fbd8</code></a> ssh: wrap errors from client handshake</li> <li><a href="bda2f3f5cf"><code>bda2f3f</code></a> argon2: avoid clobbering BP</li> <li><a href="325b735346"><code>325b735</code></a> ssh/test: skip TestSSHCLIAuth on Windows</li> <li><a href="1eadac50a5"><code>1eadac5</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="b2d7c26edb"><code>b2d7c26</code></a> ssh: add (*Client).DialContext method</li> <li>Additional commits viewable in <a href="https://github.com/golang/crypto/compare/v0.14.0...v0.17.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/grafana/loki/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Periklis Tsirakidis <periklis@redhat.com>	2 years ago
Periklis Tsirakidis	4c506532f2	operator: Apply linter on all test files (#11501)	2 years ago
Bayan Taani	8931f4a978	operator: Add warning for old schema configuration (#11158) ... Co-authored-by: Robert Jacob <rojacob@redhat.com> Co-authored-by: Periklis Tsirakidis <periklis@nefeli.eu>	2 years ago
Joao Marcal	9a3bcba174	operator: Adds structured metadata dashboards (#11473)	2 years ago
Periklis Tsirakidis	bfc2312427	operator: Update Loki operand to v2.9.3 (#11448)	2 years ago
Periklis Tsirakidis	c573defcbb	operator: Fix storing authentication credentials in the Loki ConfigMap (#11357) ... Co-authored-by: Robert Jacob <xperimental@solidproject.de> Co-authored-by: Robert Jacob <rojacob@redhat.com>	2 years ago
Periklis Tsirakidis	e590963471	operator: Add infra annotations for OpenShift based deployments (#11393)	2 years ago
Periklis Tsirakidis	d683aedb1b	operator: Add tools to test on Azure (#11340) ... )	2 years ago
Robert Jacob	cd3a04d6d7	operator: Run unit tests of API module as well (#11328)	2 years ago
Periklis Tsirakidis	21a7f96b63	operator: Add support for blocking queries per tenant (#11094) ... Co-authored-by: Robert Jacob <xperimental@solidproject.de>	2 years ago
Joao Marcal	b29b4565a5	operator: Add tools to test on GCP (#11303) ... Co-authored-by: Periklis Tsirakidis <periklis@redhat.com>	2 years ago
Periklis Tsirakidis	6b944f7c79	operator: Fix custom CA for object-store in ruler component (#11288) ... Co-authored-by: Robert Jacob <xperimental@solidproject.de>	2 years ago
Periklis Tsirakidis	21a07773ba	operator: Add automatic stream sharding support (#11091) ... Co-authored-by: Robert Jacob <xperimental@solidproject.de>	2 years ago
Joao Marcal	5535267f2c	operator: Remove outdated BoltDB dashboards (#11022) ... Co-authored-by: Periklis Tsirakidis <periklis@redhat.com>	2 years ago
Joao Marcal	0c10f28a46	operator: Adds new value v13 to schema (#10932) ... Co-authored-by: Periklis Tsirakidis <periklis@redhat.com>	2 years ago
Periklis Tsirakidis	8d0fc171cc	operator: Update dependencies and dev tools (#11232)	2 years ago
Periklis Tsirakidis	fecdd85210	operator: Update deps to secure webhooks for CVE-2023-44487 (#11129)	2 years ago
Robert Jacob	cea2e0ed58	operator: Update skipRange for next OpenShift release (#11106)	2 years ago
Periklis Tsirakidis	5def37d63d	operator: Prepare community release v0.5.0 (#10996)	2 years ago
renovate[bot]	ab94c70c4c	chore(deps): update module golang.org/x/net to v0.17.0 [security] (main) (#10831) ... [](https://renovatebot.com) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | golang.org/x/net | indirect | minor | `v0.7.0` -> `v0.17.0` | | golang.org/x/net | indirect | minor | `v0.8.0` -> `v0.17.0` | ### GitHub Vulnerability Alerts #### [CVE-2023-3978](https://nvd.nist.gov/vuln/detail/CVE-2023-3978) Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack. #### [CVE-2023-39325](https://togithub.com/golang/go/issues/63417) A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function. #### [CVE-2023-44487](https://togithub.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3) swift-nio-http2 is vulnerable to a denial-of-service vulnerability in which a malicious client can create and then reset a large number of HTTP/2 streams in a short period of time. This causes swift-nio-http2 to commit to a large amount of expensive work which it then throws away, including creating entirely new `Channel`s to serve the traffic. This can easily overwhelm an `EventLoop` and prevent it from making forward progress. swift-nio-http2 1.28 contains a remediation for this issue that applies reset counter using a sliding window. This constrains the number of stream resets that may occur in a given window of time. Clients violating this limit will have their connections torn down. This allows clients to continue to cancel streams for legitimate reasons, while constraining malicious actors. --- ### Configuration 📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/grafana/loki). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy44LjEiLCJ1cGRhdGVkSW5WZXIiOiIzNy4xOS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiJ9--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2 years ago
Periklis Tsirakidis	a1387c78c7	operator: Update Loki operand to v2.9.2 (#10924)	2 years ago
Periklis Tsirakidis	6b16d547ac	operator: Bump deps to address CVE-2023-39325 and CVE-2023-44487 (#10874)	2 years ago
Periklis Tsirakidis	48087e0e1a	operator: Add missing marker/sweeper panels in retention dashboard (#10854) ... Co-authored-by: Joao Marcal <joao.marcal12@gmail.com>	2 years ago
Robert Jacob	e2ed1c01d4	operator: Update tools and dependencies (#10795)	2 years ago
dependabot[bot]	5f55dbd249	operator: Bump github.com/prometheus/client_golang from 1.16.0 to 1.17.0 in /operator (#10734)	2 years ago
Periklis Tsirakidis	50f838df90	operator: Allow SSE settings in S3 object storage secret (#10717) ... Co-authored-by: Robert Jacob <xperimental@solidproject.de>	2 years ago
Periklis Tsirakidis	8d6bcd4083	operator: Allow endpoint_suffix in azure object storage secret (#10715) ... Co-authored-by: Robert Jacob <xperimental@solidproject.de>	2 years ago