Skip to content

Commit c49855f

Browse files
elelayshelelaysh
authored
Upgrade prometheus stack to latest LTS versions (#943)
* CVE-2025-68121 go crypto/tls issue * Ignore Python 2.7.5 vulnerabilities in filebeat and opensearch python is not used at runtime in these images * Ignore CVE-2021-38297 in prometheus tools * Ignore issues in rescue kernel It's not normally booted * Ignore CVE-2022-21797 requirements-dev.txt * Ignore CVE-2023-24531 CVE-2023-29402 CVE-2023-29405 go env and go commands not used * Ignore CVE-2023-3128 Azure AD not used * Ignore CVE-2024-24790 not affected by ip IsPrivate filtering * Ignore CVE-2024-8986 not self-built grafana components * Ignore CVE-2025-22871 not servers forwarding data * Ignore CVE-2026-33186 -- not running go gRPC server * Bump ark repo timestamps * Ignore CVE-2024-45337 opensearch datasource no ssh * Ignore CVE-2026-33937 Handlebars.compile() javascript injection reviewed Handlebars.compile usage for vulnerability: not affected * Rebuilt images from latest timestamps * Switch to prometheus-community prometheus * Prevent prometheus configuration in fatimage build * Set node_exporter 1.11.1, prometheus 3.5.2, alertmanager 0.31.1 * Switch to prometheus.prometheus.alertmanager Warning: there are some config file changes and variable changes * Store alertmanager db in appliances_state_dir for persistence accross rebuilds. * Remove obsolete links to cloudalchemy roles in doc and comments * Bump images * Adjust grype.yaml following prometheus stack upgrade * Bump alertmanager 0.32.0 to fix CVE * Ignore CVE-2026-33186 (GO-2026-4762) for ondemand-dex We don't enable the gRPC interface in deployments * Ignore CVE-2024-45337 in apptainer's gocryptfs It doesn't use ssh * TMP: Ignore CVE-2026-39324 in OpenOnDemand Preliminary checks indicate OOD is not affected * TMP: exclude podman images Pending an update of the opensearch/filebeat and mysql images docker.io/opensearchproject/opensearch 2.9.0 docker.io/library/mysql 8.0.30 docker.elastic.co/beats/filebeat-oss 7.12.1 * Latest timestamps * Rebuilt images * Ensure our .grype.yaml is used * Revert "Ensure our .grype.yaml is used" This reverts commit 287421b. * move path-based ignores to excludes * Change ignores to use the GHSA when it's the primary ID in grype otherwise they still appear in the table output. Could also change the table output to CVE with the same effect * TMP: mask grafana vulnerability * Fix forgotten reference to local alertmanager role * Checked Rocky Linux 8 rclone vulnerabilities v1.57.0-DEV with go1.16.12 * GH: output image name and id to summary * GH: show scanned image name in summary * GH: more output to summary * Remove leftover parts of cockpit CVE-2026-4631 Cockpit's remote login lack of sanitization. It couldn't be exploited before because we removed cockpit-ws (in bootstrap.yml) so cockpit web interface is not present. * grype: remove unused files instead of ignoring * Fix Cleanup /tmp there was no expansion in the command: needs to be a shell * Remove .grype.yaml comment now that /tmp is correctly cleaned-up * Remove unused packer ansible skip-tags * Use python3.9 interpreter for mysql role to install a recent version of pymysql. This is less intrusive than trying to use python3.9 interpreter as much as possible (need to use platform-python anyway for firewalld and selinux python bindings, which is python 3.6 on RL8) * Note that ansible.posix.firewalld need platform-python in our ansible/roles/firewalld, called from bootstrap.yml This was discovered when trying to use python3.9 as ansible interpreter as much as possible on RL8 * Upgrade prometheus to latest LTS 3.5.3 * Update alertmanager to latest 0.32.1 * Rebuilt images * Ignore CVE-2026-27143 - go compiler overflow check loops induction vars Ignoring at the moment since projects have not had time to rebuild yet. There is a very high level of false positive on general tools (just check the stdlib version) and no known exploitation. See https://access.redhat.com/security/cve/cve-2026-27143 for status * Ignore CVE-2026-41176 and CVE-2026-41179 rclone rcd,--rc vulnerabilities We don't run rclone with remote control * Use python3.9 interpreter for stackhpc.openhpc upgrade.yml * Replace rclone binary with a no-op script as a precaution against the many vulnerabilities reported by grype * Rebuilt prometheus-slurm-exporter (0.22) * Rebuilt images * Remove grype ignore prometheus-slurm-exporter Rebuilt 0.22 version is now free of those * Use tagged version of stackhpc/prometheus-community-ansible
1 parent 2ca7966 commit c49855f

32 files changed

Lines changed: 417 additions & 427 deletions

‎.github/workflows/fatimage.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -53,8 +53,8 @@ jobs:
5353

5454
- name: Record settings for CI cloud
5555
run: |
56-
echo "CI_CLOUD: ${CI_CLOUD}"
57-
echo "PACKER_ON_ERROR: ${PACKER_ON_ERROR}"
56+
echo "CI_CLOUD: ${CI_CLOUD}" | tee -a "$GITHUB_STEP_SUMMARY"
57+
echo "PACKER_ON_ERROR | tee -a ${PACKER_ON_ERROR}"
5858
5959
- name: Setup ssh
6060
run: |
@@ -120,8 +120,8 @@ jobs:
120120
sleep 5
121121
done
122122
IMAGE_NAME=$(openstack image show -f value -c name "$IMAGE_ID")
123-
echo "image-name=${IMAGE_NAME}" >> "$GITHUB_OUTPUT"
124-
echo "image-id=$IMAGE_ID" >> "$GITHUB_OUTPUT"
123+
echo "image-name=${IMAGE_NAME}" | tee -a "$GITHUB_OUTPUT" "$GITHUB_STEP_SUMMARY"
124+
echo "image-id=$IMAGE_ID" | tee -a "$GITHUB_OUTPUT" "$GITHUB_STEP_SUMMARY"
125125
echo "$IMAGE_ID" > image-id.txt
126126
echo "$IMAGE_NAME" > image-name.txt
127127

‎.github/workflows/nightly-cleanup.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ jobs:
2828

2929
- name: Record which cloud CI is running on
3030
run: |
31-
echo "CI_CLOUD: ${CI_CLOUD}"
31+
echo "CI_CLOUD: ${CI_CLOUD}" | tee -a "$GITHUB_STEP_SUMMARY"
3232
3333
- name: Setup environment
3434
run: |

‎.github/workflows/scan.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ jobs:
7070
run: |
7171
IMAGE_NAME=$(jq --arg version "$MATRIX_BUILD" -r '.cluster_image[$version]' "$JSON_PATH")
7272
echo "IMAGE_NAME=${IMAGE_NAME}" >> "$GITHUB_ENV"
73-
echo "image-name=${IMAGE_NAME}" >> "$GITHUB_OUTPUT"
73+
echo "image-name=${IMAGE_NAME}" | tee -a "$GITHUB_OUTPUT" "$GITHUB_STEP_SUMMARY"
7474
env:
7575
MATRIX_BUILD: ${{ matrix.build }}
7676
JSON_PATH: ${{ env.JSON_PATH }}

‎.github/workflows/workflow-cleanup.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,8 +34,8 @@ jobs:
3434

3535
- name: Input Variables
3636
run: |
37-
echo "CI_CLOUD: ${CI_CLOUD}"
38-
echo "CLUSTER_NAME: ${CLUSTER_NAME}"
37+
echo "CI_CLOUD: ${CI_CLOUD}" | tee -a "$GITHUB_STEP_SUMMARY"
38+
echo "CLUSTER_NAME: ${CLUSTER_NAME}" | tee -a "$GITHUB_STEP_SUMMARY"
3939
4040
- name: Check Cluster Name not empty
4141
run: |

‎.grype.yaml‎

Lines changed: 191 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,191 @@
1+
---
2+
# ignore rules for grype, with justification
3+
ignore:
4+
5+
# go crypto/tls vulnerability: programs not used with TLS
6+
- vulnerability: CVE-2025-68121
7+
package:
8+
location: /usr/bin/ondemand_exporter
9+
# prometheus 3.5.1 still has an older go runtime
10+
- vulnerability: CVE-2025-68121
11+
package:
12+
location: "/usr/local/bin/prometheus"
13+
- vulnerability: CVE-2025-68121
14+
package:
15+
location: "/usr/local/bin/promtool"
16+
- vulnerability: CVE-2025-68121
17+
package:
18+
location: "/usr/sbin/ondemand-dex"
19+
- vulnerability: CVE-2025-68121
20+
package:
21+
location: "/usr/sbin/ondemand-dex-session"
22+
- vulnerability: CVE-2025-68121
23+
package:
24+
location: "/usr/share/grafana/bin/grafana"
25+
- vulnerability: CVE-2025-68121
26+
package:
27+
location: "/usr/share/grafana/bin/grafana-cli"
28+
- vulnerability: CVE-2025-68121
29+
package:
30+
location: "/usr/share/grafana/bin/grafana-server"
31+
- vulnerability: CVE-2025-68121
32+
package:
33+
location: /var/lib/podman/.local/share/containers/storage/overlay/b51397a6db0ae651df3ffd51be823f98a26ab18ac7033847fedbac792798ae18/diff/usr/share/filebeat/filebeat
34+
- vulnerability: CVE-2025-68121
35+
package:
36+
location: /var/lib/podman/.local/share/containers/storage/overlay/efeebaada56fcf04784f6d67852667327a8e50d18bbf9aea6d3556865e894f59/diff/usr/local/bin/gosu
37+
38+
# go crypto/tls vulnerability: programs used with trusted TLS servers
39+
- vulnerability: CVE-2025-68121
40+
package:
41+
location: /usr/local/bin/alertmanager
42+
- vulnerability: CVE-2025-68121
43+
package:
44+
location: /var/lib/grafana/plugins/grafana-opensearch-datasource/gpx_opensearch-datasource_linux_amd64
45+
46+
# go compiler bug introduces potential unverified memory access wr loops with induction variables on under or overflow
47+
- vulnerability: CVE-2026-27143
48+
49+
# system dep, what can we do?
50+
- vulnerability: CVE-2025-68121
51+
package:
52+
name: podman
53+
- vulnerability: CVE-2025-68121
54+
package:
55+
location: /usr/bin/podman
56+
- vulnerability: CVE-2025-68121
57+
package:
58+
location: "/usr/libexec/podman/**"
59+
60+
# go crypto/tls vulnerability: programs run by users not admins
61+
- vulnerability: CVE-2025-68121
62+
package:
63+
location: "/usr/bin/apptainer"
64+
- vulnerability: CVE-2025-68121
65+
package:
66+
location: "/usr/libexec/apptainer/**"
67+
68+
# Python 2.7 vulnerabilities in filebeat and opensearch ignored: python not used at runtime
69+
# CVE-2014-4650 CGIHTTPServer module in Python 2.7.5, in filebeat and opensearch images
70+
# CVE-2016-0718, CVE-2016-9063 Expat
71+
# CVE-2017-1000158 integer overflow in the PyString_DecodeEscape
72+
# CVE-2018-1000802 Command Injection vulnerability in shutil
73+
- package: # filebeat
74+
location: /var/lib/podman/.local/share/containers/storage/overlay/174f5685490326fc0a1c0f5570b8663732189b327007e47ff13d2ca59673db02/diff/usr/bin/python2.7
75+
- package: # filebeat
76+
location: /var/lib/podman/.local/share/containers/storage/overlay/174f5685490326fc0a1c0f5570b8663732189b327007e47ff13d2ca59673db02/diff/usr/lib64/libpython2.7.so.1.0
77+
- package: # filebeat
78+
location: /var/lib/podman/.local/share/containers/storage/overlay/6b0b788550f0cdfdceded05ec82b17c5bd3801b6a7795fecb4a18d1103d5d548/diff/usr/bin/python2.7
79+
- package: # filebeat
80+
location: /var/lib/podman/.local/share/containers/storage/overlay/6b0b788550f0cdfdceded05ec82b17c5bd3801b6a7795fecb4a18d1103d5d548/diff/usr/lib64/libpython2.7.so.1.0
81+
- package: # opensearch
82+
location: /var/lib/podman/.local/share/containers/storage/overlay/6042fe893e2746bb7637efe59d35909d895c9060b43950db261e692ad3dfb834/diff/usr/bin/python2.7
83+
- package: # opensearch
84+
location: /var/lib/podman/.local/share/containers/storage/overlay/6042fe893e2746bb7637efe59d35909d895c9060b43950db261e692ad3dfb834/diff/usr/lib64/libpython2.7.so.1.0
85+
86+
# kernel rescue image: won't be booted
87+
# CVE-2021-43267, CVE-2021-47378, ...
88+
- package:
89+
location: /boot/vmlinuz-0-rescue-*
90+
91+
# CVE-2023-24531 `go env` command is not used
92+
- vulnerability: CVE-2023-24531
93+
package:
94+
location: /var/lib/grafana/plugins/grafana-opensearch-datasource/gpx_opensearch-datasource_linux_amd64
95+
96+
# CVE-2023-3128 grafana Azure AD auth bypass by spoofing -- not used
97+
- vulnerability: GHSA-mpv3-g8m3-3fjc
98+
package:
99+
location: /var/lib/grafana/plugins/grafana-opensearch-datasource/gpx_opensearch-datasource_linux_amd64
100+
101+
# CVE-2024-24790 IsPrivate, IsLoopback, etc broken for IPv4-mapped IPv6 addresses -- not affected
102+
- vulnerability: CVE-2024-24790
103+
package:
104+
location: /var/lib/grafana/plugins/grafana-opensearch-datasource/gpx_opensearch-datasource_linux_amd64
105+
106+
# CVE-2024-8986 Grafana plugin SDK Information Leakage about git source repository -- not affected
107+
- vulnerability: GHSA-xxxw-3j6h-q7h6
108+
package:
109+
location: /usr/share/grafana/bin/grafana
110+
- vulnerability: GHSA-xxxw-3j6h-q7h6
111+
package:
112+
location: /var/lib/grafana/plugins/grafana-opensearch-datasource/gpx_opensearch-datasource_linux_amd64
113+
114+
# CVE-2025-22871 request smuggling in net/http server (bare LF) -- no server forwarding chunked data here
115+
- vulnerability: CVE-2025-22871
116+
package:
117+
location: /usr/bin/ondemand_exporter
118+
- vulnerability: CVE-2025-22871
119+
package:
120+
location: /var/lib/grafana/plugins/grafana-opensearch-datasource/gpx_opensearch-datasource_linux_amd64
121+
122+
# CVE-2026-33186 (GO-2026-4762) gRPC-Go server auth bypass -- not running go server
123+
- vulnerability: GHSA-p77j-4mvh-x3m3
124+
package:
125+
location: /usr/bin/apptainer
126+
- vulnerability: GHSA-p77j-4mvh-x3m3
127+
package:
128+
location: /usr/local/bin/amtool
129+
- vulnerability: GHSA-p77j-4mvh-x3m3
130+
package:
131+
location: /usr/local/bin/promtool
132+
- vulnerability: GHSA-p77j-4mvh-x3m3
133+
package:
134+
location: /var/lib/grafana/plugins/grafana-opensearch-datasource/gpx_opensearch-datasource_linux_amd64
135+
136+
# CVE-2026-33186 (GO-2026-4762) gRPC-Go server auth bypass -- no auth to start with
137+
- vulnerability: GHSA-p77j-4mvh-x3m3
138+
package:
139+
location: /usr/local/bin/prometheus
140+
141+
# CVE-2026-33186 (GO-2026-4762) gRPC-Go server auth bypass -- not affected in our deployments
142+
# XXX: grpc version bump is in DEX master but it needs a new DEX release before OOD release to produce the ondemand-dex package
143+
# DEX doesn't use grpc/authz but has custom interceptors. I couldn't tell if it's vulnerable to the attack.
144+
# Regardless, the gRPC API is off by default (https://dexidp.io/docs/configuration/api/#configuration)
145+
# Our deployments don't enable it. Check for the commented-out `grpc:` block in `/etc/ood/dex/config.yaml` to confirm.
146+
- vulnerability: GHSA-p77j-4mvh-x3m3
147+
package:
148+
location: /usr/sbin/ondemand-dex
149+
- vulnerability: GHSA-p77j-4mvh-x3m3
150+
package:
151+
location: /usr/sbin/ondemand-dex-session
152+
153+
154+
# CVE-2026-33186 (GO-2026-4762) gRPC-Go server auth bypass -- TMP disable to check ignores are working
155+
# FIXME: should upgrade grafana to Grafana 12.4.2
156+
- vulnerability: GHSA-p77j-4mvh-x3m3
157+
package:
158+
location: /usr/share/grafana/bin/grafana
159+
160+
# CVE-2024-45337 (GO-2024-3321) Misuse of ServerConfig.PublicKeyCallback -- not using ssh
161+
- vulnerability: GHSA-v778-237x-gjrc
162+
package:
163+
location: /usr/libexec/apptainer/bin/gocryptfs
164+
- vulnerability: GHSA-v778-237x-gjrc
165+
package:
166+
location: /var/lib/grafana/plugins/grafana-opensearch-datasource/gpx_opensearch-datasource_linux_amd64
167+
168+
# CVE-2026-33937 Handlebars.compile() javascript injection
169+
# Handlebars.compile() is only used by the shell app via hbs. All uses seem safe:
170+
# - protected by `typeof input !== 'string'` as https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2w6w-674q-4c4q
171+
# - or from string by directly reading a file on disk
172+
- vulnerability: GHSA-2w6w-674q-4c4q
173+
package:
174+
location: /var/www/ood/apps/sys/shell/yarn.lock
175+
# Handlebars.compile() is only used by webpack.config.js and input from string by directly reading a file on disk
176+
- vulnerability: GHSA-2w6w-674q-4c4q
177+
package:
178+
location: /opt/jupyter-py39/lib/python3.9/site-packages/jupyterlab/staging/yarn.lock
179+
180+
# CVE-2026-39324 Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization
181+
# Preliminary checks indicate OOD is not affected, as a Ruby on Rails application.
182+
- vulnerability: GHSA-33qg-7wpp-89cq
183+
package:
184+
location: /opt/ood/ondemand/root/usr/share/gems/3.3/ondemand/4.1.4-1/specifications/rack-session-2.1.1.gemspec
185+
- vulnerability: GHSA-33qg-7wpp-89cq
186+
package:
187+
location: /var/www/ood/apps/sys/dashboard/Gemfile.lock
188+
189+
# Exclude podman images from scan, pending MySQL+OpenSearch+Filebeat upgrade
190+
exclude:
191+
- /var/lib/podman/.local/share/**

‎ansible/bootstrap.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -218,7 +218,7 @@
218218
tags: cockpit
219219
tasks:
220220
- name: Remove RHEL cockpit # noqa: no-changed-when
221-
ansible.builtin.command: dnf -y remove cockpit-ws
221+
ansible.builtin.command: dnf -y remove cockpit-ws cockpit-system cockpit-bridge
222222
register: dnf_remove_output
223223
ignore_errors: true # Avoid failing if a lock or other error happens
224224

‎ansible/cleanup.yml‎

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@
3838
ansible.builtin.command: cloud-init clean --logs --seed
3939

4040
- name: Cleanup /tmp # noqa: no-changed-when
41-
ansible.builtin.command: rm -rf /tmp/*
41+
ansible.builtin.shell: rm -rvf /tmp/*
4242

4343
- name: Delete files triggering vulnerability scans
4444
ansible.builtin.file:
@@ -53,6 +53,23 @@
5353
# chrony role: only used for role dev, venv never created on disk
5454
- /etc/ansible-init/playbooks/roles/mrlesmithjr.chrony/poetry.lock
5555
- /etc/ansible-init/playbooks/roles/mrlesmithjr.chrony/requirements.txt
56+
- /etc/ansible-init/playbooks/roles/mrlesmithjr.chrony/requirements-dev.txt
57+
# netbox collection: only used for role dev
58+
- /usr/lib/ansible-init/lib/python3.9/site-packages/ansible_collections/netbox/netbox/poetry.lock
59+
# esbuild in OOD
60+
- /var/www/ood/apps/sys/dashboard/node_modules/@esbuild/linux-x64/bin/esbuild
61+
- /usr/lib/rstudio-server/bin/quarto/bin/tools/x86_64/esbuild
62+
63+
- name: Replace rclone with a no-op script
64+
ansible.builtin.copy:
65+
content: |
66+
#!/bin/sh
67+
echo "The rclone executable has been removed in ansible-slurm-appliance images due to too many security warnings." 1>&2
68+
exit 1
69+
dest: /usr/bin/rclone
70+
owner: root
71+
group: root
72+
mode: "0555"
5673

5774
- name: Stop journald
5875
# Stop journald from writing data to the journal after we have cleared it.

‎ansible/fatimage.yml‎

Lines changed: 17 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -188,9 +188,9 @@
188188
when: "'filebeat' in group_names"
189189

190190
- ansible.builtin.import_role:
191-
# can't only run cloudalchemy.node_exporter/tasks/install.yml as needs vars from preflight.yml and triggers service start
191+
# no prometheus.prometheus.node_exporter/tasks/install.yml
192192
# however starting node exporter is ok
193-
name: cloudalchemy.node_exporter
193+
name: prometheus.prometheus.node_exporter
194194
when: "'node_exporter' in group_names"
195195

196196
- name: Open Ondemand exporter
@@ -206,8 +206,15 @@
206206

207207
- name: Install alertmanager
208208
ansible.builtin.include_role:
209-
name: alertmanager
210-
tasks_from: install.yml
209+
name: prometheus.prometheus.alertmanager
210+
vars:
211+
alertmanager_skip_configure: true
212+
# must be overridden because the alertmanager password is undefined at this staged
213+
# so it won't pass "Validating arguments against arg spec 'main'"
214+
alertmanager_web_config:
215+
basic_auth_users: {}
216+
http_server_config: {}
217+
tls_server_config: {}
211218
when: "'alertmanager' in group_names"
212219

213220
- name: Download HPL source
@@ -221,58 +228,12 @@
221228
gather_facts: true
222229
tasks:
223230
- ansible.builtin.import_role:
224-
name: cloudalchemy.prometheus
225-
tasks_from: preflight.yml
226-
227-
# can't run cloudalchemy.prometheus/tasks/install.yml as it triggers a unit start
228-
# so below is a partial extraction of this:
229-
- name: Create prometheus system group
230-
ansible.builtin.group:
231-
name: prometheus
232-
system: true
233-
state: present
234-
235-
- name: Create prometheus system user
236-
ansible.builtin.user:
237-
name: prometheus
238-
system: true
239-
shell: "/usr/sbin/nologin"
240-
group: prometheus
241-
createhome: false
242-
home: "{{ prometheus_db_dir }}"
243-
244-
- name: Download prometheus binary to local folder
245-
become: false
246-
ansible.builtin.get_url:
247-
# yamllint disable-line rule:line-length
248-
url: "https://github.com/prometheus/prometheus/releases/download/v{{ prometheus_version }}/prometheus-{{ prometheus_version }}.linux-{{ go_arch }}.tar.gz"
249-
dest: "/tmp/prometheus-{{ prometheus_version }}.linux-{{ go_arch }}.tar.gz"
250-
checksum: "sha256:{{ __prometheus_checksum }}"
251-
mode: "0644"
252-
register: _download_archive
253-
until: _download_archive is succeeded
254-
retries: 5
255-
delay: 2
256-
257-
- name: Unpack prometheus binaries
258-
become: false
259-
ansible.builtin.unarchive:
260-
remote_src: true
261-
src: "/tmp/prometheus-{{ prometheus_version }}.linux-{{ go_arch }}.tar.gz"
262-
dest: "/tmp"
263-
creates: "/tmp/prometheus-{{ prometheus_version }}.linux-{{ go_arch }}/prometheus"
264-
265-
- name: Propagate official prometheus and promtool binaries
266-
ansible.builtin.copy:
267-
remote_src: true
268-
src: "/tmp/prometheus-{{ prometheus_version }}.linux-{{ go_arch }}/{{ item }}"
269-
dest: "{{ _prometheus_binary_install_dir }}/{{ item }}"
270-
mode: "0755"
271-
owner: root
272-
group: root
273-
with_items:
274-
- prometheus
275-
- promtool
231+
name: prometheus.prometheus.prometheus
232+
vars:
233+
prometheus_skip_configure: true
234+
# prometheus_alert_rules contain undefined variables at this time, causing
235+
# an assertion failure in arg check
236+
prometheus_alert_rules: []
276237

277238
- hosts: grafana
278239
become: true

‎ansible/filter_plugins/utils.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212

1313

1414
def prometheus_node_exporter_targets(hosts, hostvars, env_key, group):
15-
"""Return a mapping in cloudalchemy.nodeexporter prometheus_targets
15+
"""Return a mapping in prometheus.prometheus.prometheus prometheus_targets
1616
format.
1717
1818
hosts: list of inventory_hostnames

0 commit comments

Comments
 (0)