[release-v0.35] Prepare for release v0.35.2 (#4624)

* prometheus.operator.*: fix UI issues (#4538)

(cherry picked from commit 11e0087)

* Fix nil reference oauth2 (#4548)

* Fix nil reference oauth2

* Update CHANGELOG.md

Co-authored-by: Robert Fratto <[email protected]>

---------

Co-authored-by: Robert Fratto <[email protected]>
(cherry picked from commit bbfbf37)

* pkg/metrics/wal: always write series records to WAL, even on rollback (#4619)

If a new series is introduced in a storage.Appender instance, that
series should be written to the WAL once the storage.Appender is closed,
even on Rollback.

Previously, new series would only be written to the WAL when calling
Commit. However, because the series is stored in memory regardless,
subsequent calls to Commit may write samples to the WAL which reference
a series ID which that was never written.

Port of prometheus/prometheus#12592

(cherry picked from commit 3837d47)

* Fix issue with fips on behalf of @andrewimeson (#4622)

(cherry picked from commit 234b056)

* agentctl: add journald support (#4544)

Add journald support into agentctl so `grafana-agentctl test-logs`
functions properly when using a config which reads log entries from the
systemd journal.

Fixes #4520.

(cherry picked from commit f254860)

* [release-v0.35] prepare for release v0.35.2

(cherry picked from commit 138dc34)

---------

Co-authored-by: mattdurham <[email protected]>

CHANGELOG.md

@@ -7,21 +7,45 @@ This document contains a historical list of changes between releases. Only
 changes that impact end-user behavior are listed; changes to documentation or
 internal API changes are not present.
 
+v0.35.2 (2023-07-27)
+--------------------
+
+### Bugfixes
+
+- Fix issue where the flow mode UI would show an empty page when navigating to
+  an unhealthy `prometheus.operator` component or a healthy
+  `prometheus.operator` component which discovered no custom resources.
+  (@rfratto)
+
+- Fix panic when using `oauth2` without specifying `tls_config`. (@mattdurham)
+
+- Fix issue where series records would never get written to the WAL if a scrape
+  was rolled back, resulting in "dropped sample for series that was not
+  explicitly dropped via relabelling" log messages. (@rfratto)
+
+- Fix RPM file digests so that installation on FIPS-enabled systems succeeds. (@andrewimeson)
+
+### Other changes
+
+- Compile journald support into builds of `grafana-agentctl` so
+  `grafana-agentctl test-logs` functions as expected when testing tailing the
+  systemd journal. (@rfratto)
+
 v0.35.1 (2023-07-25)
 --------------------
 
 ### Bugfixes
 
 - Fix incorrect display of trace IDs in the automatic_logging processor of static mode's traces subsystem.
-  Users of the static mode's service graph processor are also advised to upgrade, 
+  Users of the static mode's service graph processor are also advised to upgrade,
   although the bug should theoretically not affect them. (@ptodev)
 
 v0.35.0 (2023-07-18)
 --------------------
 
 > **BREAKING CHANGES**: This release has breaking changes. Please read entries
 > carefully and consult the [upgrade guide][] for specific instructions.
- 
+
 ### Breaking changes
 
 - The algorithm for the "hash" action of `otelcol.processor.attributes` has changed.

cmd/grafana-agentctl/Dockerfile

@@ -20,6 +20,7 @@ RUN --mount=type=cache,target=/root/.cache/go-build \
     --mount=type=cache,target=/go/pkg/mod \
     GOOS="$TARGETOS" GOARCH="$TARGETARCH" GOARM="${TARGETVARIANT#v}" \
     RELEASE_BUILD="${RELEASE_BUILD}" VERSION="${VERSION}" \
+    GO_TAGS="promtail_journal_enabled" \
     make agentctl
 
 FROM ubuntu:lunar

component/common/config/types.go

@@ -292,16 +292,19 @@ func (o *OAuth2Config) Convert() *config.OAuth2 {
 	if o == nil {
 		return nil
 	}
-	return &config.OAuth2{
+	oa := &config.OAuth2{
 		ClientID:         o.ClientID,
 		ClientSecret:     config.Secret(o.ClientSecret),
 		ClientSecretFile: o.ClientSecretFile,
 		Scopes:           o.Scopes,
 		TokenURL:         o.TokenURL,
 		EndpointParams:   o.EndpointParams,
-		TLSConfig:        *o.TLSConfig.Convert(),
 		ProxyConfig: config.ProxyConfig{
 			ProxyURL: o.ProxyURL.Convert(),
 		},
 	}
+	if o.TLSConfig != nil {
+		oa.TLSConfig = *o.TLSConfig.Convert()
+	}
+	return oa
 }

component/common/config/types_test.go

@@ -160,6 +160,24 @@ func TestHTTPClientConfigOath2ClientSecretFile(t *testing.T) {
 	require.NoError(t, err)
 }
 
+func TestOath2TLSConvert(t *testing.T) {
+	var exampleRiverConfig = `
+	oauth2 {
+		client_id = "client_id"
+		client_secret_file = "/path/to/file.oath2"
+		scopes = ["scope1", "scope2"]
+		token_url = "token_url"
+		endpoint_params = {"param1" = "value1", "param2" = "value2"}
+	}
+`
+
+	var httpClientConfig HTTPClientConfig
+	err := river.Unmarshal([]byte(exampleRiverConfig), &httpClientConfig)
+	require.NoError(t, err)
+	newCfg := httpClientConfig.Convert()
+	require.NotNil(t, newCfg)
+}
+
 func TestHTTPClientBadConfig(t *testing.T) {
 	var exampleRiverConfig = `
 	bearer_token = "token"

component/prometheus/operator/common/crdmanager.go

@@ -205,7 +205,11 @@ func (c *crdManager) DebugInfo() interface{} {
 	for _, pm := range c.debugInfo {
 		info.DiscoveredCRDs = append(info.DiscoveredCRDs, pm)
 	}
-	info.Targets = compscrape.BuildTargetStatuses(c.scrapeManager.TargetsActive())
+
+	// c.scrapeManager can be nil if the client failed to build.
+	if c.scrapeManager != nil {
+		info.Targets = compscrape.BuildTargetStatuses(c.scrapeManager.TargetsActive())
+	}
 	return info
 }
 

docs/sources/operator/deploy-agent-operator-resources.md

@@ -58,7 +58,7 @@ To deploy the `GrafanaAgent` resource:
       labels:
         app: grafana-agent
     spec:
-      image: grafana/agent:v0.35.0
+      image: grafana/agent:v0.35.2
       integrations:
         selector:
           matchLabels:

docs/sources/operator/getting-started.md

@@ -74,7 +74,7 @@ To install Agent Operator:
           serviceAccountName: grafana-agent-operator
           containers:
           - name: operator
-            image: grafana/agent-operator:v0.35.0
+            image: grafana/agent-operator:v0.35.2
             args:
             - --kubelet-service=default/kubelet
     ---

docs/sources/static/configuration/integrations/node-exporter-config.md

@@ -29,7 +29,7 @@ docker run \
   -v "/proc:/host/proc:ro,rslave" \
   -v /tmp/agent:/etc/agent \
   -v /path/to/config.yaml:/etc/agent-config/agent.yaml \
-  grafana/agent:v0.35.0 \
+  grafana/agent:v0.35.2 \
   --config.file=/etc/agent-config/agent.yaml
 ```
 
@@ -68,7 +68,7 @@ metadata:
   name: agent
 spec:
   containers:
-  - image: grafana/agent:v0.35.0
+  - image: grafana/agent:v0.35.2
     name: agent
     args:
     - --config.file=/etc/agent-config/agent.yaml
@@ -368,7 +368,7 @@ the Agent is running on is a no-op.
   # Perf software profilers that should be collected.
   perf_software_profilers:
     [- <string>]
-  
+
   # Disable perf cache profilers.
   [perf_disable_cache_profilers: <boolean> | default = false]
 

docs/sources/static/configuration/integrations/process-exporter-config.md

@@ -21,7 +21,7 @@ docker run \
   -v "/proc:/proc:ro" \
   -v /tmp/agent:/etc/agent \
   -v /path/to/config.yaml:/etc/agent-config/agent.yaml \
-  grafana/agent:v0.35.0 \
+  grafana/agent:v0.35.2 \
   --config.file=/etc/agent-config/agent.yaml
 ```
 
@@ -38,7 +38,7 @@ metadata:
   name: agent
 spec:
   containers:
-  - image: grafana/agent:v0.35.0
+  - image: grafana/agent:v0.35.2
     name: agent
     args:
     - --config.file=/etc/agent-config/agent.yaml

docs/sources/static/set-up/install/install-agent-docker.md

@@ -33,7 +33,7 @@ To run a Grafana Agent Docker container on Linux, run the following command in a
 docker run \
   -v WAL_DATA_DIRECTORY:/etc/agent/data \
   -v CONFIG_FILE_PATH:/etc/agent/agent.yaml \
-  grafana/agent:v0.35.0
+  grafana/agent:v0.35.2
 ```
 
 Replace `CONFIG_FILE_PATH` with the configuration file path on your Linux host system.
@@ -50,7 +50,7 @@ To run a Grafana Agent Docker container on Windows, run the following command in
 docker run ^
   -v WAL_DATA_DIRECTORY:C:\etc\grafana-agent\data ^
   -v CONFIG_FILE_PATH:C:\etc\grafana-agent ^
-  grafana/agent:v0.35.0-windows
+  grafana/agent:v0.35.2-windows
 ```
 
 Replace the following:

packaging/grafana-agent-flow/rpm/gpg-sign.sh

@@ -18,6 +18,7 @@ echo "%_gpg_name Grafana Labs <[email protected]>
 %_gpg_path /root/.gnupg
 %_gpgbin /usr/bin/gpg
 %_gpg_digest_algo sha256
+%_binary_filedigest_algorithm 8
 %__gpg /usr/bin/gpg
 %__gpg_sign_cmd     %{__gpg} \
          gpg --no-tty --batch --yes --no-verbose --no-armor \

packaging/grafana-agent/rpm/gpg-sign.sh

@@ -18,6 +18,7 @@ echo "%_gpg_name Grafana Labs <[email protected]>
 %_gpg_path /root/.gnupg
 %_gpgbin /usr/bin/gpg
 %_gpg_digest_algo sha256
+%_binary_filedigest_algorithm 8
 %__gpg /usr/bin/gpg
 %__gpg_sign_cmd     %{__gpg} \
          gpg --no-tty --batch --yes --no-verbose --no-armor \

pkg/metrics/wal/wal.go

@@ -861,6 +861,16 @@ func (a *appender) UpdateMetadata(ref storage.SeriesRef, _ labels.Labels, m meta
 
 // Commit submits the collected samples and purges the batch.
 func (a *appender) Commit() error {
+	if err := a.log(); err != nil {
+		return err
+	}
+
+	a.clearData()
+	a.w.appenderPool.Put(a)
+	return nil
+}
+
+func (a *appender) log() error {
 	a.w.walMtx.RLock()
 	defer a.w.walMtx.RUnlock()
 
@@ -870,6 +880,9 @@ func (a *appender) Commit() error {
 
 	var encoder record.Encoder
 	buf := a.w.bufPool.Get().([]byte)
+	defer func() {
+		a.w.bufPool.Put(buf) //nolint:staticcheck
+	}()
 
 	if len(a.pendingSeries) > 0 {
 		buf = encoder.Series(a.pendingSeries, buf)
@@ -931,12 +944,11 @@ func (a *appender) Commit() error {
 		}
 	}
 
-	//nolint:staticcheck
-	a.w.bufPool.Put(buf)
-	return a.Rollback()
+	return nil
 }
 
-func (a *appender) Rollback() error {
+// clearData clears all pending data.
+func (a *appender) clearData() {
 	a.pendingSeries = a.pendingSeries[:0]
 	a.pendingSamples = a.pendingSamples[:0]
 	a.pendingHistograms = a.pendingHistograms[:0]
@@ -945,6 +957,43 @@ func (a *appender) Rollback() error {
 	a.sampleSeries = a.sampleSeries[:0]
 	a.histogramSeries = a.histogramSeries[:0]
 	a.floatHistogramSeries = a.floatHistogramSeries[:0]
+}
+
+func (a *appender) Rollback() error {
+	// Series are created in-memory regardless of rollback. This means we must
+	// log them to the WAL, otherwise subsequent commits may reference a series
+	// which was never written to the WAL.
+	if err := a.logSeries(); err != nil {
+		return err
+	}
+
+	a.clearData()
 	a.w.appenderPool.Put(a)
 	return nil
 }
+
+// logSeries logs only pending series records to the WAL.
+func (a *appender) logSeries() error {
+	a.w.walMtx.RLock()
+	defer a.w.walMtx.RUnlock()
+
+	if a.w.walClosed {
+		return ErrWALClosed
+	}
+
+	if len(a.pendingSeries) > 0 {
+		var encoder record.Encoder
+		buf := a.w.bufPool.Get().([]byte)
+		defer func() {
+			a.w.bufPool.Put(buf) //nolint:staticcheck
+		}()
+
+		buf = encoder.Series(a.pendingSeries, buf)
+		if err := a.w.wal.Log(buf); err != nil {
+			return err
+		}
+		buf = buf[:0]
+	}
+
+	return nil
+}

pkg/metrics/wal/wal_test.go

@@ -99,6 +99,35 @@ func TestStorage(t *testing.T) {
 	require.Equal(t, expectedExemplars, actualExemplars)
 }
 
+func TestStorage_Rollback(t *testing.T) {
+	walDir := t.TempDir()
+	s, err := NewStorage(log.NewNopLogger(), nil, walDir)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, s.Close())
+	})
+
+	app := s.Appender(context.Background())
+
+	payload := buildSeries([]string{"foo", "bar", "baz", "blerg"})
+	for _, metric := range payload {
+		metric.Write(t, app)
+	}
+
+	require.NoError(t, app.Rollback())
+
+	var collector walDataCollector
+
+	replayer := walReplayer{w: &collector}
+	require.NoError(t, replayer.Replay(s.wal.Dir()))
+
+	require.Len(t, collector.series, 4, "Series records should be written on Rollback")
+	require.Len(t, collector.samples, 0, "Samples should not be written on rollback")
+	require.Len(t, collector.exemplars, 0, "Exemplars should not be written on rollback")
+	require.Len(t, collector.histograms, 0, "Histograms should not be written on rollback")
+	require.Len(t, collector.floatHistograms, 0, "Native histograms should not be written on rollback")
+}
+
 func TestStorage_DuplicateExemplarsIgnored(t *testing.T) {
 	walDir := t.TempDir()
 

pkg/operator/defaults.go

@@ -2,7 +2,7 @@ package operator
 
 // Supported versions of the Grafana Agent.
 var (
-	DefaultAgentVersion   = "v0.35.0"
+	DefaultAgentVersion   = "v0.35.2"
 	DefaultAgentBaseImage = "grafana/agent"
 	DefaultAgentImage     = DefaultAgentBaseImage + ":" + DefaultAgentVersion
 )

pkg/river/encoding/riverjson/riverjson.go

@@ -87,15 +87,6 @@ func encodeFieldAsStatements(prefix []string, field rivertags.Field, fieldValue
 		fullName := mergeStringSlice(prefix, field.Name)
 
 		switch {
-		case fieldValue.IsZero():
-			// It shouldn't be possible to have a required block which is unset, but
-			// we'll encode something anyway.
-			return []jsonStatement{jsonBlock{
-				Name: strings.Join(fullName, "."),
-				Type: "block",
-				Body: nil,
-			}}
-
 		case fieldValue.Kind() == reflect.Map:
 			// Iterate over the map and add each element as an attribute into it.
 
@@ -137,6 +128,19 @@ func encodeFieldAsStatements(prefix []string, field rivertags.Field, fieldValue
 			return statements
 
 		case fieldValue.Kind() == reflect.Struct:
+			if fieldValue.IsZero() {
+				// It shouldn't be possible to have a required block which is unset, but
+				// we'll encode something anyway.
+				return []jsonStatement{jsonBlock{
+					Name: strings.Join(fullName, "."),
+					Type: "block",
+
+					// Never set this to nil, since the API contract always expects blocks
+					// to have an array value for the body.
+					Body: []jsonStatement{},
+				}}
+			}
+
 			return []jsonStatement{jsonBlock{
 				Name:  strings.Join(fullName, "."),
 				Type:  "block",