Skip to content

graylog: v2.0.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 27 Aug 21:51
graylog-2.0.0
76c6539
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

2.0.0 (2026-08-27)

⚠ BREAKING CHANGES

  • graylog: appVersion moves from 7.0 to 7.1.8. graylog.image.tag and datanode.image.tag default to appVersion, so upgrading moves the running Graylog and Data Node images unless you pin both tags (#181) (eee5bd8)
  • values: global.imagePullSecrets, graylog.image.imagePullSecrets and datanode.image.imagePullSecrets now take {name: <secret>} objects instead of bare strings. Schema validation rejects the old string form (#93) (cdb719c)
  • mongodb: the default replica set is now 3 data-bearing members with no arbiter, replacing 2 members plus 1 arbiter. Upgrading on the defaults adds a member and drops the arbiter, so budget for a third data volume (#127) (47edf85)
  • mongodb: the chart now sets MongoDB container resources, which nothing could override before. A pod reserves 300m/1152Mi instead of the operator's 1000m/800M, and upgrading rolls the replica set (#176) (e49b97f)
  • pods and containers now run under a restricted security context: runAsNonRoot: true, seccompProfile: RuntimeDefault, allowPrivilegeEscalation: false, and all capabilities dropped except NET_BIND_SERVICE on graylog and the file-ownership set on datanode. A custom image that runs as root or needs other capabilities will not start (#100) (cb9bd63)
  • values: removed datanode.persistence.enabled, datanode.persistence.data.existingClaim, datanode.persistence.data.selector, datanode.persistence.data.dataSource, datanode.persistence.nativeLibs.existingClaim, datanode.persistence.nativeLibs.selector, graylog.persistence.mountPath and graylog.persistence.selector. None of them were wired to anything (6571951)
  • geo-ip: the MaxMind database update runs as a sidecar on the Graylog pod instead of a CronJob. graylog.config.geolocation.maxmindGeoIp.cronSchedule moves to graylog.config.geolocation.sidecar.schedule, and postInstallRun is gone (#129) (e9c0354)
  • ingress: ingress.forwarder splits into two channels, ingress.forwarder.messageChannel and ingress.forwarder.configChannel, each with its own className, annotations, labels, hosts and tls. Existing forwarder ingress values need rewriting, not renaming (#160) (29c1430)
  • datanode: the native-libs volume claim template changes name from nativeLibs to native-libs. volumeClaimTemplates is immutable, so Kubernetes rejects the upgrade for anyone running with datanode.persistence.nativeLibs.enabled=true. Delete the StatefulSet with --cascade=orphan first (#75) (5fc7e22)
  • graylog: terminationGracePeriodSeconds is now 300, and a preStop hook drains the journal before shutdown. Pod deletion, node drains and rolling upgrades take up to five minutes per pod (#147) (c643cd0)
  • PodDisruptionBudgets are on by default for both graylog and datanode. A single-replica deployment blocks node drains until you relax the budget
  • helpers: an explicit graylog.config.network.externalUri now wins over the LoadBalancer Service lookup, and a bare hostname gets the scheme and app port appended. Setting both a LoadBalancer service and externalUri changes the advertised http_external_uri (e3c965d)
  • the chart renames the init script ConfigMap from the fixed init-script-cm to <release>-graylog-init-cm, so two releases can share a namespace. External references to the old name break (#79) (25653e2)
  • the chart writes the generated root password to the backup Secret instead of printing it in NOTES.txt. Anything scraping the install output for the password must read the Secret (33499f2)
  • probes: both StatefulSets now get a startupProbe, on by default. It allows 330s before the kubelet restarts the container, so an install that takes longer restarts in a loop until you raise startupProbe.failureThreshold (#169) (b411145)
  • probes: removed graylog.livenessProbe.successThreshold and datanode.livenessProbe.successThreshold. The schema does not reject unknown keys, so either one still validates and does nothing (#169) (b411145)

Features

  • Bring Your Own Opensearch (#135) (5d531c1)
  • Allowing for custom labels and annotations to rendered kubernetes manifests. (#160) (29c1430)
  • data-node: Adding sysctlInit datanode init container to set vm.max_map_count (8270c06)
  • geo-ip: Setting up side car geoip update, working downloads (#129) (e9c0354)
  • Safe Graylog Journal Draining (#147) (c643cd0)
  • Updating datanode and graylog health check and startup probes (#169) (b411145)
  • Updating to Graylog, and Datanode to 7.1.8 (#181) (eee5bd8)

Bug Fixes

  • correct imagePullSecrets schema to use LocalObjectReference format (#93) (cdb719c)
  • datanode: use with for each secret field (#77) (8bcd2d3)
  • encode GRAYLOG_HTTP_TLS_KEY_PASSWORD (#76) (992c615)
  • geo-ip: Updating GeoIP default image and secret handling (#168) (64aed49)
  • helpers: Prefer an explicit externalUri over the Service lookup (e3c965d)
  • ingress: point defaultBackend at the fallback Service port (91bee91)
  • mongodb: let MongoDB container resources be configured (#176) (e49b97f)
  • rename native-libs pvc template (#75) (5fc7e22)
  • secrets: Accept secret peppers of exactly 64 characters (59f44af)
  • secrets: Adding graylog-root-sha2 to automatic password generation (21fcb15)
  • secrets: Adding graylog-root-sha2 to automatic password generation (9390114)
  • service-accounts: Fixing bug in service account automount (#130) (fdff2a7)
  • StatefulSet checksums (#83) (bd8c9a3)
  • use release-specific templated names (#79) (25653e2)
  • use selectorLabels (#80) (1b7f6ee)
  • use toYaml with each nodeSelector (#78) (2fab1bd)
  • values: Remove unused persistence configuration values (6571951)

Documentation

  • chart: add an upgrade guide and document the commit-driven release (#182) (7400c0d)
Assets 3
Loading