Skip to content

v1.11.3

Choose a tag to compare

View all tags
@OisinKyne OisinKyne released this 26 Oct 14:31
v1.11.3
c8be66d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Obol Logo

This is CDVN's v1.11.3 release and is a recommended update for all operators. It makes the bundled monitoring private by default. Charon and the clients are unchanged from v1.11.2. Feedback is welcome and appreciated, please use github issues or discord if you have trouble with this release.

Update

# Stop the node
docker compose down
# Save your local .env / custom overrides
git stash
# Update your local copy of this repo
git pull
# Checkout this release
git checkout v1.11.3
# Re-apply your stashed changes
git stash apply
# Restart the node
docker compose up -d

Monitoring is now private by default

This release tightens the default monitoring setup. Charon, the clients and remote-write to Obol's monitoring are unaffected.

  • Grafana listens on 127.0.0.1 only. To view it from another machine, use an SSH tunnel and open http://localhost:3000: 
    ssh -L 3000:127.0.0.1:3000 <user>@<node>
    If you need Grafana on another address, set MONITORING_IP_GRAFANA, and only behind a provider or network firewall: ports published by Docker are not filtered by host firewalls such as ufw.
  • Grafana is read-only. Visitors can view every dashboard, but can't make changes, and there is no login form. Dashboards and datasources are provisioned from this repository.
  • Grafana starts with a fresh database in a Docker volume (grafana-data) and runs as a non-root user. Your old data/grafana folder is no longer used.
  • The log collector (logging.yml) now reads container logs through a read-only Docker API proxy (a new docker-socket-proxy container) instead of mounting the Docker socket.
  • Lighthouse metrics (the single-file docker-compose.yml layout): port 5054 is now published on 127.0.0.1 only.

Important

Anything you created in the Grafana UI, such as custom dashboards, alert rules or contact points, does not carry over to the fresh Grafana. Export custom dashboards before updating (Share > Export). The README's Security section explains how to set them up again, either as files under grafana/dashboards/ or by re-enabling logins with your own admin password.

After updating

  1. Check your previous Grafana data. The script lists any accounts, tokens, datasources or plugins in the old data/grafana that this stack doesn't create. It may need sudo: 
    ./grafana/security-check.sh
    If it reports anything, please let us know at security@obol.tech.
  2. Delete the old Grafana data, which is no longer used: 
    sudo rm -rf data/grafana

What's Changed

Full Changelog: v1.11.2...v1.11.3

Assets 2
Loading