Update Prometheus chart from v25 to v29 by antgamdia · Pull Request #204 · trento-project/helm-charts

antgamdia · 2026-06-08T19:23:10Z

This PR updates the Prometheus Helm chart we use, from v25 to v26 The major version changes affecting the Helm chart should not be a big deal. However, in v26, they switched to Prometheus v3 instead of v2, which seems reasonable, as v2 is EOLed.

As of today, this change reduces the CVEs from 534 to 59.

We could possibly keep chart v29 but override Prometheus to v2. Since I haven't played around with this subchart that much, I'd like to sync with @balanza and decide what to do.

Related TRNT-4394

PS:

Example upgrade plan (AI-generated)

# Prometheus Helm Chart Upgrade: v25 → v29 Migration Checklist

**Target**: Upgrade from Prometheus Helm Chart v25.x to v29.10.0  
**Date**: 2026-06-08  
**Current Config**: Custom configmap with Prometheus v2.53.1

---

## Pre-Migration Status Assessment

### ✅ **Not Affected By:**

- [x] **v29.0 kubernetes_sd_configs migration** - We use `http_sd_configs`, not `kubernetes_sd_configs`
- [x] **v28.0 scrapeConfigs restructuring** - We use custom configmap override (`configMapOverrideName`)
- [x] **v27.0 certificate verification** - No custom cert skip configs
- [x] **Custom relabeling rules** - None that would conflict with endpoint→endpointslice migration

### ⚠️ **Requires Action:**

- [ ] **Prometheus 2.x → 3.x upgrade** - Currently pinned to v2.53.1
- [ ] **Chart configuration updates** - Add `scrapeConfigs: null` (DONE ✅)

---

## Migration Steps

### Phase 1: Chart v25 → v29 Upgrade (No Prometheus version change)

#### Step 1.1: Update Configuration ✅ COMPLETED

```yaml
prometheus:
  enabled: true
  scrapeConfigs: null  # Added to disable v28+ scrape config structure
  server:
    image:
      tag: v2.53.1  # Keep current version for now

Step 1.2: Update Chart Dependency

# In charts/trento-server/Chart.yaml
dependencies:
  - name: prometheus
    version: ~29.10.0  # Already updated

Step 1.3: Test in Dev Environment

Run helm dependency update charts/trento-server
Deploy to dev/test environment
Verify Prometheus starts successfully
Verify custom scrape config still works (http_sd_hosts job)
Check targets are discovered: http://<prometheus>/prometheus/targets
Verify metrics collection from Trento components

Phase 2: Prometheus 2.x → 3.x Upgrade (Optional but Recommended)

⚠️ Important: This is a separate decision with significant breaking changes. Can be done later.

Step 2.1: Pre-Upgrade Preparation

Review Your Current Setup:

Check if you have any PromQL queries in alerts/dashboards
Check if you have any recording rules
Verify your scrape targets return proper Content-Type headers
Review any remote_write/remote_read configurations

Key Decisions:

Decide on Prometheus 3.x version (recommend: v3.1.0 or latest stable)
Plan downtime window (if needed)
Ensure backup/snapshot capability

Step 2.2: Breaking Changes Impact Assessment

HIGH IMPACT (Likely affects your setup)

Content-Type Header Validation ⚠️ CRITICAL

Issue: Prometheus 3 strictly validates scrape target Content-Type headers
Your Risk: Medium - depends on /api/prometheus/targets endpoint implementation

Action Required:

# Test your http_sd endpoint response
curl -v http://<trento-web>:4000/api/prometheus/targets
# Check for proper Content-Type header in response

Mitigation: If targets lack headers, add to scrape config:

scrape_configs:
  - job_name: "http_sd_hosts"
    fallback_scrape_protocol: "PrometheusText0.0.4"  # Add if needed

HTTP/2 Remote Write Default Change
- Issue: http_config.enable_http2 in remote_write now defaults to false (was true)
- Your Risk: Low - you use --web.enable-remote-write-receiver flag but likely local
- Action: No change needed unless using remote_write to external systems

MEDIUM IMPACT (May affect queries/dashboards)

Label Value Normalization
- Issue: Histogram le labels change from "1" to "1.0"
- Your Risk: Medium - if you have dashboards querying histograms
- Action Required:
  - Audit Grafana dashboards for histogram queries with le="<integer>"
  - Update to use float format: le="1.0" instead of le="1"
  - Test all dashboards before production upgrade
PromQL Regular Expression Changes
- Issue: . now matches newlines
- Your Risk: Low - only affects complex regex in label matchers
- Action: Review any queries with =~ regex operators
Range Selector Boundary Changes
- Issue: Range selectors now left-open, right-closed
- Your Risk: Low-Medium - affects subqueries and edge cases
- Action: Test critical rate/increase queries

LOW IMPACT (Unlikely to affect you)

Feature Flags Removed
- ✅ --web.enable-remote-write-receiver - Already using this, will continue to work
- ✅ --web.enable-lifecycle - Already using this, will continue to work
Function Renaming
- holt_winters → double_exponential_smoothing
- Action: Check if used in queries (unlikely)
TSDB Format
- New format only downgradeable to v2.55+
- Action: Note for rollback planning

Step 2.3: Upgrade Execution Plan

Option A: Conservative (Recommended)

Stay on Prometheus v2.53.1 with Helm chart v29
Validate chart upgrade works correctly
Plan Prometheus 3.x upgrade separately after thorough testing

Option B: Full Upgrade

Complete all Phase 2.2 assessments

Update configuration:

prometheus:
  server:
    image:
      tag: v3.1.0  # or latest stable 3.x

Test thoroughly in dev environment
Validate:
- All scrape targets discovered
- All metrics flowing
- All dashboards rendering correctly
- All alerts firing correctly
- No error logs in Prometheus container

Step 2.4: Rollback Plan

If issues occur:

# Rollback chart version
helm rollback <release-name> <revision>

# If TSDB incompatible (unlikely), restore from backup
# Note: Can only rollback to Prometheus v2.55+ after v3.x upgrade

Testing Checklist

Chart Upgrade Tests (Phase 1)

helm dependency update succeeds
helm template renders correctly
Deployment succeeds without errors
Prometheus pod starts and becomes ready
Custom configmap is loaded correctly
Service discovery finds targets
Metrics are being scraped
Ingress/auth-proxy works correctly
Data persists across pod restarts

Prometheus 3.x Upgrade Tests (Phase 2 - if proceeding)

Content-Type headers validated on scrape targets
Existing metrics continue to be collected
Historical data accessible
PromQL queries return expected results
Grafana dashboards render correctly
Alert rules evaluate correctly
Remote write (if used) continues to work
No error/warning logs in Prometheus
Performance acceptable (scrape latency, query speed)

Risk Assessment

Component	Risk Level	Mitigation
Chart v25→v29 upgrade	LOW	Using custom configmap, minimal chart changes affect us
Prometheus 2→3 upgrade	MEDIUM	Content-Type validation and label normalization may require changes
Downtime	LOW	Can be done with rolling update
Data loss	VERY LOW	TSDB format compatible, persistence enabled

Recommended Approach

Immediate (Low Risk)

✅ Add scrapeConfigs: null to values.yaml (DONE)
Update helm dependencies: helm dependency update charts/trento-server
Deploy to dev/test with Prometheus v2.53.1 (no version change)
Validate for 24-48 hours

Near Term (Plan & Test)

Test Content-Type headers from Trento web /api/prometheus/targets endpoint
Audit Grafana dashboards for histogram queries
Set up test environment with Prometheus v3.x
Run query compatibility tests

Later (When Ready)

Upgrade Prometheus to v3.x in production after successful testing
Monitor closely for 24 hours
Validate all dashboards and alerts

Commands Reference

# Update dependencies
cd charts/trento-server
helm dependency update

# Test template rendering
helm template trento . -f values.yaml

# Upgrade (dry-run)
helm upgrade --dry-run --debug trento . -f values.yaml

# Actual upgrade
helm upgrade trento . -f values.yaml

# Check Prometheus version
kubectl exec -it <prometheus-pod> -- prometheus --version

# Check targets
curl http://<prometheus-service>:8081/prometheus/targets

# View Prometheus logs
kubectl logs -f <prometheus-pod> -c prometheus-server

# Check loaded configuration
curl http://<prometheus-service>:8081/prometheus/api/v1/status/config

Sign-off

Chart upgrade tested in dev
Prometheus 3.x impact assessed
Grafana dashboards reviewed
Rollback procedure documented
Team notified of upgrade plan
Production upgrade scheduled

</details>

Signed-off-by: Antonio Gamez Diaz <antonio.gamez@suse.com>

Copilot

Pull request overview

This PR upgrades the trento-server Helm chart’s Prometheus subchart dependency to a newer major release and updates the pinned Prometheus server image tag accordingly, along with updating the Helm CLI version used in CI/release workflows.

Changes:

Bump prometheus-community/prometheus dependency from the v25.x series to 29.10.1 and update the chart version.
Update Prometheus server image tag to v3.12.0 and add scrapeConfigs: null in values.
Update GitHub Actions workflows to install a newer Helm CLI version.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
charts/trento-server/values.yaml	Updates Prometheus server image tag and sets `scrapeConfigs: null` for newer chart behavior.
charts/trento-server/Chart.yaml	Bumps chart version and upgrades Prometheus dependency to `29.10.1`.
charts/trento-server/Chart.lock	Updates the locked Prometheus dependency version/digest/timestamp.
.github/workflows/publish-oci.yaml	Updates Helm CLI version used for packaging/publishing.
.github/workflows/ci.yaml	Updates Helm CLI version used for linting/testing charts.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

    version: ">0.0.0"
    condition: postgresql.enabled
  - name: prometheus
-    version: ~25.21.0
+    version: 29.10.1
    repository: https://prometheus-community.github.io/helm-charts/


nelsonkopliku

This needs to be double checked/aligned with

local development
with what is actually available out there (which versions do we have/support on a systemd installation on sles 15.x for instance?)

Referring to this specific change https://github.com/trento-project/helm-charts/pull/204/changes#diff-4dfbe3cdee8f1e71117c7cdd1e4e9077f05039d508f22affb38ca0c6656ee1d0R105 related to the actual version of prometheus.

Signed-off-by: Antonio Gamez Diaz <antonio.gamez@suse.com>

github-actions · 2026-06-24T10:06:15Z

Summary

⚠️ Total: 200 CVEs detected

CVE Scan Results

🆕 NEW: `quay.io/prometheus-operator/prometheus-config-reloader:v0.91.0`

Found 30 CVEs

HIGH (23)

CVE ID	Package	Installed	Fixed
CVE-2026-46597	golang.org/x/crypto	v0.50.0	0.52.0
CVE-2026-46595	golang.org/x/crypto	v0.50.0	0.52.0
CVE-2026-42508	golang.org/x/crypto	v0.50.0	0.52.0
CVE-2026-42506	golang.org/x/net	v0.53.0	0.55.0
CVE-2026-42504	stdlib	v1.25.9	1.25.11, 1.26.4
CVE-2026-42502	golang.org/x/net	v0.53.0	0.55.0
CVE-2026-42499	stdlib	v1.25.9	1.25.10, 1.26.3
CVE-2026-39836	stdlib	v1.25.9	1.25.10, 1.26.3
CVE-2026-39835	golang.org/x/crypto	v0.50.0	0.52.0
CVE-2026-39830	golang.org/x/crypto	v0.50.0	0.52.0
CVE-2026-39829	golang.org/x/crypto	v0.50.0	0.52.0
CVE-2026-39828	golang.org/x/crypto	v0.50.0	0.52.0
CVE-2026-39827	golang.org/x/crypto	v0.50.0	0.52.0
CVE-2026-39825	stdlib	v1.25.9	1.25.10, 1.26.3
CVE-2026-39823	stdlib	v1.25.9	1.25.10, 1.26.3
CVE-2026-39821	golang.org/x/net	v0.53.0	0.55.0
CVE-2026-39820	stdlib	v1.25.9	1.25.10, 1.26.3
CVE-2026-33814	stdlib	v1.25.9	1.25.10, 1.26.3
CVE-2026-33811	stdlib	v1.25.9	1.25.10, 1.26.3
CVE-2026-27145	stdlib	v1.25.9	1.25.11, 1.26.4
CVE-2026-27136	golang.org/x/net	v0.53.0	0.55.0
CVE-2026-25681	golang.org/x/net	v0.53.0	0.55.0
CVE-2026-25680	golang.org/x/net	v0.53.0	0.55.0

MEDIUM (7)

CVE ID	Package	Installed	Fixed
CVE-2026-46598	golang.org/x/crypto	v0.50.0	0.52.0
CVE-2026-42507	stdlib	v1.25.9	1.25.11, 1.26.4
CVE-2026-39834	golang.org/x/crypto	v0.50.0	0.52.0
CVE-2026-39833	golang.org/x/crypto	v0.50.0	0.52.0
CVE-2026-39832	golang.org/x/crypto	v0.50.0	0.52.0
CVE-2026-39831	golang.org/x/crypto	v0.50.0	0.52.0
CVE-2026-39826	stdlib	v1.25.9	1.25.10, 1.26.3

🆕 NEW: `quay.io/prometheus/alertmanager:v0.32.1`

Found 66 CVEs

HIGH (50)

CVE ID	Package	Installed	Fixed
CVE-2026-46597	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-46597	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-46595	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-46595	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-42508	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-42508	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-42506	golang.org/x/net	v0.52.0	0.55.0
CVE-2026-42506	golang.org/x/net	v0.52.0	0.55.0
CVE-2026-42504	stdlib	v1.26.2	1.25.11, 1.26.4
CVE-2026-42504	stdlib	v1.26.2	1.25.11, 1.26.4
CVE-2026-42502	golang.org/x/net	v0.52.0	0.55.0
CVE-2026-42502	golang.org/x/net	v0.52.0	0.55.0
CVE-2026-42499	stdlib	v1.26.2	1.25.10, 1.26.3
CVE-2026-42499	stdlib	v1.26.2	1.25.10, 1.26.3
CVE-2026-39883	go.opentelemetry.io/otel/sdk	v1.41.0	1.43.0
CVE-2026-39883	go.opentelemetry.io/otel/sdk	v1.41.0	1.43.0
CVE-2026-39836	stdlib	v1.26.2	1.25.10, 1.26.3
CVE-2026-39836	stdlib	v1.26.2	1.25.10, 1.26.3
CVE-2026-39835	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-39835	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-39830	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-39830	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-39829	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-39829	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-39828	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-39828	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-39827	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-39827	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-39825	stdlib	v1.26.2	1.25.10, 1.26.3
CVE-2026-39825	stdlib	v1.26.2	1.25.10, 1.26.3
CVE-2026-39823	stdlib	v1.26.2	1.25.10, 1.26.3
CVE-2026-39823	stdlib	v1.26.2	1.25.10, 1.26.3
CVE-2026-39821	golang.org/x/net	v0.52.0	0.55.0
CVE-2026-39821	golang.org/x/net	v0.52.0	0.55.0
CVE-2026-39820	stdlib	v1.26.2	1.25.10, 1.26.3
CVE-2026-39820	stdlib	v1.26.2	1.25.10, 1.26.3
CVE-2026-33814	stdlib	v1.26.2	1.25.10, 1.26.3
CVE-2026-33814	stdlib	v1.26.2	1.25.10, 1.26.3
CVE-2026-33814	golang.org/x/net	v0.52.0	0.53.0
CVE-2026-33814	golang.org/x/net	v0.52.0	0.53.0
CVE-2026-33811	stdlib	v1.26.2	1.25.10, 1.26.3
CVE-2026-33811	stdlib	v1.26.2	1.25.10, 1.26.3
CVE-2026-27145	stdlib	v1.26.2	1.25.11, 1.26.4
CVE-2026-27145	stdlib	v1.26.2	1.25.11, 1.26.4
CVE-2026-27136	golang.org/x/net	v0.52.0	0.55.0
CVE-2026-27136	golang.org/x/net	v0.52.0	0.55.0
CVE-2026-25681	golang.org/x/net	v0.52.0	0.55.0
CVE-2026-25681	golang.org/x/net	v0.52.0	0.55.0
CVE-2026-25680	golang.org/x/net	v0.52.0	0.55.0
CVE-2026-25680	golang.org/x/net	v0.52.0	0.55.0

MEDIUM (16)

CVE ID	Package	Installed	Fixed
CVE-2026-46598	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-46598	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-42507	stdlib	v1.26.2	1.25.11, 1.26.4
CVE-2026-42507	stdlib	v1.26.2	1.25.11, 1.26.4
CVE-2026-39882	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp	v1.41.0	1.43.0
CVE-2026-39882	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp	v1.41.0	1.43.0
CVE-2026-39834	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-39834	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-39833	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-39833	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-39832	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-39832	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-39831	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-39831	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-39826	stdlib	v1.26.2	1.25.10, 1.26.3
CVE-2026-39826	stdlib	v1.26.2	1.25.10, 1.26.3

🆕 NEW: `quay.io/prometheus/node-exporter:v1.11.1`

Found 38 CVEs

HIGH (28)

CVE ID	Package	Installed	Fixed
CVE-2026-46597	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-46595	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-42508	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-42506	golang.org/x/net	v0.52.0	0.55.0
CVE-2026-42504	stdlib	v1.26.1	1.25.11, 1.26.4
CVE-2026-42502	golang.org/x/net	v0.52.0	0.55.0
CVE-2026-42499	stdlib	v1.26.1	1.25.10, 1.26.3
CVE-2026-39836	stdlib	v1.26.1	1.25.10, 1.26.3
CVE-2026-39835	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-39830	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-39829	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-39828	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-39827	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-39825	stdlib	v1.26.1	1.25.10, 1.26.3
CVE-2026-39823	stdlib	v1.26.1	1.25.10, 1.26.3
CVE-2026-39821	golang.org/x/net	v0.52.0	0.55.0
CVE-2026-39820	stdlib	v1.26.1	1.25.10, 1.26.3
CVE-2026-33814	stdlib	v1.26.1	1.25.10, 1.26.3
CVE-2026-33814	golang.org/x/net	v0.52.0	0.53.0
CVE-2026-33811	stdlib	v1.26.1	1.25.10, 1.26.3
CVE-2026-33810	stdlib	v1.26.1	1.26.2
CVE-2026-32283	stdlib	v1.26.1	1.25.9, 1.26.2
CVE-2026-32281	stdlib	v1.26.1	1.25.9, 1.26.2
CVE-2026-32280	stdlib	v1.26.1	1.25.9, 1.26.2
CVE-2026-27145	stdlib	v1.26.1	1.25.11, 1.26.4
CVE-2026-27136	golang.org/x/net	v0.52.0	0.55.0
CVE-2026-25681	golang.org/x/net	v0.52.0	0.55.0
CVE-2026-25680	golang.org/x/net	v0.52.0	0.55.0

MEDIUM (10)

CVE ID	Package	Installed	Fixed
CVE-2026-46598	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-42507	stdlib	v1.26.1	1.25.11, 1.26.4
CVE-2026-39834	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-39833	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-39832	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-39831	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-39826	stdlib	v1.26.1	1.25.10, 1.26.3
CVE-2026-32289	stdlib	v1.26.1	1.25.9, 1.26.2
CVE-2026-32288	stdlib	v1.26.1	1.25.9, 1.26.2
CVE-2026-32282	stdlib	v1.26.1	1.25.9, 1.26.2

🆕 NEW: `quay.io/prometheus/prometheus:v3.12.0`

Found 32 CVEs

HIGH (20)

CVE ID	Package	Installed	Fixed
CVE-2026-46597	golang.org/x/crypto	v0.51.0	0.52.0
CVE-2026-46597	golang.org/x/crypto	v0.51.0	0.52.0
CVE-2026-46595	golang.org/x/crypto	v0.51.0	0.52.0
CVE-2026-46595	golang.org/x/crypto	v0.51.0	0.52.0
CVE-2026-42508	golang.org/x/crypto	v0.51.0	0.52.0
CVE-2026-42508	golang.org/x/crypto	v0.51.0	0.52.0
CVE-2026-42504	stdlib	v1.26.3	1.25.11, 1.26.4
CVE-2026-42504	stdlib	v1.26.3	1.25.11, 1.26.4
CVE-2026-39835	golang.org/x/crypto	v0.51.0	0.52.0
CVE-2026-39835	golang.org/x/crypto	v0.51.0	0.52.0
CVE-2026-39830	golang.org/x/crypto	v0.51.0	0.52.0
CVE-2026-39830	golang.org/x/crypto	v0.51.0	0.52.0
CVE-2026-39829	golang.org/x/crypto	v0.51.0	0.52.0
CVE-2026-39829	golang.org/x/crypto	v0.51.0	0.52.0
CVE-2026-39828	golang.org/x/crypto	v0.51.0	0.52.0
CVE-2026-39828	golang.org/x/crypto	v0.51.0	0.52.0
CVE-2026-39827	golang.org/x/crypto	v0.51.0	0.52.0
CVE-2026-39827	golang.org/x/crypto	v0.51.0	0.52.0
CVE-2026-27145	stdlib	v1.26.3	1.25.11, 1.26.4
CVE-2026-27145	stdlib	v1.26.3	1.25.11, 1.26.4

MEDIUM (12)

CVE ID	Package	Installed	Fixed
CVE-2026-46598	golang.org/x/crypto	v0.51.0	0.52.0
CVE-2026-46598	golang.org/x/crypto	v0.51.0	0.52.0
CVE-2026-42507	stdlib	v1.26.3	1.25.11, 1.26.4
CVE-2026-42507	stdlib	v1.26.3	1.25.11, 1.26.4
CVE-2026-39834	golang.org/x/crypto	v0.51.0	0.52.0
CVE-2026-39834	golang.org/x/crypto	v0.51.0	0.52.0
CVE-2026-39833	golang.org/x/crypto	v0.51.0	0.52.0
CVE-2026-39833	golang.org/x/crypto	v0.51.0	0.52.0
CVE-2026-39832	golang.org/x/crypto	v0.51.0	0.52.0
CVE-2026-39832	golang.org/x/crypto	v0.51.0	0.52.0
CVE-2026-39831	golang.org/x/crypto	v0.51.0	0.52.0
CVE-2026-39831	golang.org/x/crypto	v0.51.0	0.52.0

🆕 NEW: `quay.io/prometheus/pushgateway:v1.11.3`

Found 3 CVEs

HIGH (2)

CVE ID	Package	Installed	Fixed
CVE-2026-42504	stdlib	v1.26.3	1.25.11, 1.26.4
CVE-2026-27145	stdlib	v1.26.3	1.25.11, 1.26.4

MEDIUM (1)

CVE ID	Package	Installed	Fixed
CVE-2026-42507	stdlib	v1.26.3	1.25.11, 1.26.4

🆕 NEW: `registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.0`

Found 31 CVEs

HIGH (24)

CVE ID	Package	Installed	Fixed
CVE-2026-46597	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-46595	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-42508	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-42506	golang.org/x/net	v0.51.0	0.55.0
CVE-2026-42504	stdlib	v1.26.2	1.25.11, 1.26.4
CVE-2026-42502	golang.org/x/net	v0.51.0	0.55.0
CVE-2026-42499	stdlib	v1.26.2	1.25.10, 1.26.3
CVE-2026-39836	stdlib	v1.26.2	1.25.10, 1.26.3
CVE-2026-39835	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-39830	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-39829	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-39828	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-39827	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-39825	stdlib	v1.26.2	1.25.10, 1.26.3
CVE-2026-39823	stdlib	v1.26.2	1.25.10, 1.26.3
CVE-2026-39821	golang.org/x/net	v0.51.0	0.55.0
CVE-2026-39820	stdlib	v1.26.2	1.25.10, 1.26.3
CVE-2026-33814	stdlib	v1.26.2	1.25.10, 1.26.3
CVE-2026-33814	golang.org/x/net	v0.51.0	0.53.0
CVE-2026-33811	stdlib	v1.26.2	1.25.10, 1.26.3
CVE-2026-27145	stdlib	v1.26.2	1.25.11, 1.26.4
CVE-2026-27136	golang.org/x/net	v0.51.0	0.55.0
CVE-2026-25681	golang.org/x/net	v0.51.0	0.55.0
CVE-2026-25680	golang.org/x/net	v0.51.0	0.55.0

MEDIUM (7)

CVE ID	Package	Installed	Fixed
CVE-2026-46598	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-42507	stdlib	v1.26.2	1.25.11, 1.26.4
CVE-2026-39834	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-39833	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-39832	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-39831	golang.org/x/crypto	v0.49.0	0.52.0
CVE-2026-39826	stdlib	v1.26.2	1.25.10, 1.26.3

Signed-off-by: Antonio Gamez Diaz <antonio.gamez@suse.com>

antgamdia added 9 commits May 21, 2026 19:40

Add upgrade chart CI pipeline

4a23f8a

Signed-off-by: Antonio Gamez Diaz <antonio.gamez@suse.com>

Update DB to 17.5

c471fd5

Signed-off-by: Antonio Gamez Diaz <antonio.gamez@suse.com>

Actually update DB to 17.5

4bbe906

Signed-off-by: Antonio Gamez Diaz <antonio.gamez@suse.com>

Add init container for DB data migration

63e520c

Signed-off-by: Antonio Gamez Diaz <antonio.gamez@suse.com>

Replace busybox with bci-busybox

375e83d

Signed-off-by: Antonio Gamez Diaz <antonio.gamez@suse.com>

Replace k8s kubectl with bci kubectl

f012e21

Signed-off-by: Antonio Gamez Diaz <antonio.gamez@suse.com>

Fix tag

21af155

Signed-off-by: Antonio Gamez Diaz <antonio.gamez@suse.com>

Upgrade prometheus chart to 29.10.0

f99abfb

Signed-off-by: Antonio Gamez Diaz <antonio.gamez@suse.com>

Upgrade prometheus version to v3.12.0

9ef6258

Signed-off-by: Antonio Gamez Diaz <antonio.gamez@suse.com>

antgamdia added the dependencies Pull requests that update a dependency file label Jun 8, 2026

antgamdia added 2 commits June 12, 2026 17:04

Update version

1cf1522

Signed-off-by: Antonio Gamez Diaz <antonio.gamez@suse.com>

Update helm version

6be4031

Signed-off-by: Antonio Gamez Diaz <antonio.gamez@suse.com>

antgamdia marked this pull request as ready for review June 12, 2026 15:41

antgamdia requested a review from Copilot June 17, 2026 08:11

Copilot started reviewing on behalf of antgamdia June 17, 2026 08:12 View session

Copilot AI reviewed Jun 17, 2026

View reviewed changes

Comment thread charts/trento-server/Chart.yaml

Comment on lines 24 to 28

version: ">0.0.0"

condition: postgresql.enabled

- name: prometheus

version: ~25.21.0

version: 29.10.1

repository: https://prometheus-community.github.io/helm-charts/

nelsonkopliku reviewed Jun 19, 2026

View reviewed changes

Base automatically changed from TRNT-4394 to main June 24, 2026 09:58

antgamdia added 2 commits June 24, 2026 12:04

Merge branch 'main' into TRNT-4394-1

df94e5b

Bump up chart version

309f2a7

Signed-off-by: Antonio Gamez Diaz <antonio.gamez@suse.com>

Extract common chart outside (#205)

171b27a

Signed-off-by: Antonio Gamez Diaz <antonio.gamez@suse.com>

antgamdia mentioned this pull request Jul 20, 2026

[CVE Fix] Update prometheus to v3.13.1 #252

Merged

antgamdia marked this pull request as draft August 17, 2026 09:41

Navigation Menu

Uh oh!

Update Prometheus chart from v25 to v29 - #204

Update Prometheus chart from v25 to v29#204
antgamdia wants to merge 14 commits into
mainfrom
TRNT-4394-1

antgamdia commented Jun 8, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

nelsonkopliku left a comment •

edited

Loading

Uh oh!

github-actions Bot commented Jun 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

antgamdia commented Jun 8, 2026

Step 1.2: Update Chart Dependency

Step 1.3: Test in Dev Environment

Phase 2: Prometheus 2.x → 3.x Upgrade (Optional but Recommended)

Step 2.1: Pre-Upgrade Preparation

Step 2.2: Breaking Changes Impact Assessment

HIGH IMPACT (Likely affects your setup)

MEDIUM IMPACT (May affect queries/dashboards)

LOW IMPACT (Unlikely to affect you)

Step 2.3: Upgrade Execution Plan

Step 2.4: Rollback Plan

Testing Checklist

Chart Upgrade Tests (Phase 1)

Prometheus 3.x Upgrade Tests (Phase 2 - if proceeding)

Risk Assessment

Recommended Approach

Immediate (Low Risk)

Near Term (Plan & Test)

Later (When Ready)

Commands Reference

Related Documentation

Sign-off

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

nelsonkopliku left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Jun 24, 2026

Summary

CVE Scan Results

🆕 NEW: quay.io/prometheus-operator/prometheus-config-reloader:v0.91.0

🆕 NEW: quay.io/prometheus/alertmanager:v0.32.1

🆕 NEW: quay.io/prometheus/node-exporter:v1.11.1

🆕 NEW: quay.io/prometheus/prometheus:v3.12.0

🆕 NEW: quay.io/prometheus/pushgateway:v1.11.3

🆕 NEW: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.0

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

nelsonkopliku left a comment •

edited

Loading

🆕 NEW: `quay.io/prometheus-operator/prometheus-config-reloader:v0.91.0`

🆕 NEW: `quay.io/prometheus/alertmanager:v0.32.1`

🆕 NEW: `quay.io/prometheus/node-exporter:v1.11.1`

🆕 NEW: `quay.io/prometheus/prometheus:v3.12.0`

🆕 NEW: `quay.io/prometheus/pushgateway:v1.11.3`

🆕 NEW: `registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.0`