DevOps & SRE Weekly Digest — 2026-09-16

Table of Contents

The Week in One Paragraph

Security-hardening week. Grafana 13.2.2 / 13.1.6 / 13.0.9 / 12.4.11 patch three CVEs across all supported lines. cert-manager v1.21.2 stops ACME and Vault issuer response bodies leaking into status conditions and Events — a genuine information-disclosure fix — alongside a batch of panic and data-race repairs. Traefik v3.7.13 fixes five security advisories and a basic-auth user-enumeration path. Kyverno v1.19.1 closes a PolicyException scope bypass (GHSA-5cjf-wwfg-pj4c). On the feature side, Terraform v1.16.3 continues the 1.16 fast-follow cadence while v1.17.0-beta1 previews variables-in-provider-requirements and GA policy support; Helm v4.3.0 / v3.22.0 shipped with the announcement that v3.22.0 is the last Helm 3 minor release; and Argo CD v3.6.0-rc1 opens the next minor with progressive-sync metrics and a pile of new health checks.

All items below were published between September 9 and September 16, 2026, and every claim links to a primary source.

🚨 Top Stories

1. Grafana 13.2.2 (plus 13.1.6 / 13.0.9 / 12.4.11) — three CVEs patched across all supported lines

What happened: Grafana 13.2.2 shipped September 15, 2026, with backports to the 13.1, 13.0, and 12.4 lines. Headline items:

• Security fixes for CVE-2026-15815, CVE-2026-76154, and CVE-2026-79656 (details are on the release page / Grafana security advisories).
• Bug fixes: dashboard v2 import preserving query-variable refresh settings, and a provisioning full-sync folder-rename UID collision fix.

Why it matters: Grafana is the front door to your observability stack and often sits internet-adjacent or broadly exposed internally. Coordinated patches across four release lines signal issues the Grafana security team considers important enough to backport widely — treat them as such even before scoring is public.

Who is affected: All self-hosted Grafana deployments on 13.2.x and earlier supported lines.

Recommended action: Upgrade to 13.2.2 (or the patch for your line: 13.1.6, 13.0.9, 12.4.11) in the next maintenance window. Read the linked advisories once published to confirm whether your configuration (auth model, plugins, public dashboards) changes the priority. If Grafana is exposed beyond your VPN/SSO boundary, treat as urgent.

2. Terraform v1.16.3 — more 1.16-line bug fixes; v1.17.0-beta1 previews policy GA

What happened: Terraform v1.16.3 shipped September 16, 2026 — the fourth release in four weeks on the 1.16 line. Fixes:

• destroy=false handling around create_before_destroy instances (#39169).
• Function result comparison with multiple marks (#39170) and mark-filter logic erroneously failing validations (#39171).
• Import provider resolution (#39185).

Also this week: v1.17.0-beta1 (September 9) previews variables and locals in provider requirements, a -minimal-refresh planning option that only refreshes resources with proposed changes, and Terraform Policy going GA (the -policies flag no longer requires experimental features).

Why it matters: The 1.16 line’s continued fast-follow cadence (1.16.0 → 1.16.3 in three weeks) confirms last week’s guidance to skip early 1.16 patches. The 1.17 beta’s -minimal-refresh is worth attention from anyone with large states where refresh dominates plan time; variables in provider requirements removes a long-standing templating limitation.

Recommended action: Pin 1.16.3 as your 1.16 entry point. Evaluate 1.17.0-beta1 in CI against your largest statefiles to measure -minimal-refresh plan-time impact; note the new format_version field in JSON output if you consume terraform show -json programmatically.

3. cert-manager v1.21.2 — issuer response-body disclosure fixed, panic and race repairs

What happened: cert-manager v1.21.2 shipped September 11, 2026. Security-relevant changes:

• ACME issuer response bodies are no longer reflected into Issuer status conditions or Kubernetes Events — only bounded ACME problem documents are surfaced; everything else reports by HTTP status code alone (#9239). ACME response bodies are also capped at 16 MiB against unbounded-body DoS (#9222).
• Same treatment for the Vault issuer: non-Vault HTTP response bodies from spec.vault.server no longer copied into Ready conditions and Events.
• Go and dependency updates to fix reported vulnerabilities; ambient AWS credential use tightened for namespaced Vault issuers.
• Reliability fixes: validating-webhook panics on AdmissionReview requests omitting optional fields (now denied rather than silently allowed), certificates-issuing controller panic, HTTP-01 self-check data race, February 29 cron renewal windows across non-leap century years, Gateway API dnsNames dedup.

Why it matters: Issuer status and Events are readable by anyone with RBAC read on those resources — reflecting arbitrary HTTP response bodies into them is a real information-disclosure path if an attacker can influence what an ACME or Vault endpoint returns. The release notes say plainly: all users should upgrade.

Recommended action: Upgrade to v1.21.2. If you consume Events for cert alerting, expect issuer failure messages to change shape (status-code-only instead of body excerpts) and adjust parsers accordingly.

4. Helm v4.3.0 / v3.22.0 — Helm 3 end-of-life announced, v3.22.0 is the final minor

What happened: Helm v4.3.0 and Helm v3.22.0 shipped September 10, 2026. Notable in v4.3.0:

• Ownership verification before deleting resources during uninstall (#31584).
• helm rollback --description flag to record rollback reasons (#31580).
• SOURCE_DATE_EPOCH honored for reproducible chart archives (#32162).
• Performance: concurrent status computation to prevent multi-minute delays (#32043); GnuPG keybox (pubring.kbx) keyring support for provenance (#32281).

The bigger signal: v3.22.0 is the last Helm 3 minor release — patches continue (3.22.1 scheduled October 14), but the line enters maintenance per the Helm v3 end-of-life announcement.

Why it matters: Helm 3 → 4 migration planning is now a dated problem, not an abstract one. Tooling that embeds Helm 3 (CI images, GitOps renderers, internal CLIs) needs a migration track.

Recommended action: If still on Helm 3, plan the move to the Helm 4 line while 3.22.x patches continue. Inventory anything parsing Helm output or using Helm as a library — those break first.

5. Argo CD v3.6.0-rc1 — progressive-sync observability, broader health checks

What happened: Argo CD v3.6.0-rc1 shipped September 16, 2026 (with v3.5.3 and v3.4.9 stable patches on September 14). 3.6.0-rc1 highlights:

• ApplicationSet progressive-sync metrics: app-refresh counts, progressive-sync scenario surfaced into conditions (#29202, #29244, #27820).
• New built-in health checks: Kyverno policies, TLSRoute, AWS ACK resources, CloudNativePG Backup and Database CRDs, Kro resources; hibernate/rehydrate actions for CNPG Clusters.
• Dex TLS MinVersion configurable; Dex storage type/config configurable from argocd-cm.
• CI hardening: Zizmor enabled to enforce secure GitHub Actions configuration.

Why it matters: Progressive sync has been operationally opaque — you could see it happen but not alert on it. Metrics and condition reasons turn staged rollouts into something you can put SLOs around.

Recommended action: Stable-line users: absorb v3.5.3 (fixes include a UI SSO 401 retry loop and repository cleanup on revision change). Test 3.6.0-rc1 in staging if you use ApplicationSet progressive sync — the new metrics are the payoff.

☸️ Kubernetes & Cloud Native

• Kubernetes: no new releases this week — v1.37.0 (August 26) remains current; supported patches are v1.36.4 / v1.35.8 / v1.34.11 (August 20). Watch the releases page for v1.37.1, now roughly three weeks overdue by the usual cadence.
• Helm v4.3.0 / v3.22.0 (September 10) — see Top Story #4; Helm 3 minor-release line is now closed.
• cert-manager v1.21.2 (September 11) — see Top Story #3.
• Kyverno v1.19.1 (September 10) — promotes last week’s RC to GA. Security-heavy patch: fixes CVE-2026-39821 (x/net) and CVE-2026-56853 (Go), an IVPol PolicyException scope bypass (GHSA-5cjf-wwfg-pj4c), apiCall.service egress blocklist hardening (including an IPv6-embedded-IPv4 bypass), a data race in image-evaluator prefetch, and globalcontext deadlocks. Release notes.
• containerd 2.4.0-rc.0 (September 15) — first RC of the 2.4 line, a non-LTS release: shorter support window, and the point where previously deprecated features may be removed. Highlights: mount manager for image mounts in CRI, runtimeFeatures.UserNamespacesHostNetwork defaulting to true. Stability-first shops should stay on the 2.3 LTS line. Release notes.
• Cilium 1.20.2 / 1.19.8 / 1.18.14 (September 15) — patch wave across supported lines following last week’s 1.21.0-pre.2. Release notes.
• Linkerd edge-26.9.2 (September 15) — dependency bumps plus proxy-init v2.4.10 and cni-plugin v1.7.0 upgrades. Release notes.
• Traefik v3.7.13 (September 10) — five security advisories fixed (GHSA-qqjf-53cj-pwvv, GHSA-f52w-8j3h-j724, GHSA-v67p-phpq-fc8x, GHSA-w4v4-9rw7-5326, GHSA-8fcf-v89g-xpg6) plus server-hardening fixes: h2c upgrade headers and request trailer values no longer forwarded to backends, opaque request targets denied, and basic-auth singleflight user-enumeration closed. Also relevant to Kubernetes shops: docs now warn about the frozen state of the Ingress API. Release notes.

☁️ Cloud Platforms

Cloud provider news feeds (AWS What’s New, Azure Updates, Google Cloud release notes, Cloudflare blog) were not reachable for verification from this environment this week, so this digest sticks to what could be confirmed against primary sources rather than relaying unverified items. Two cross-cloud signals from verified releases: Argo CD 3.6.0-rc1 adds built-in health checks for AWS ACK resources, and cert-manager v1.21.2 tightens ambient AWS credential use for namespaced Vault issuers — both relevant if you run cloud-controller patterns on EKS.

🏗️ Infrastructure as Code & Platform Engineering

• Terraform v1.16.3 and v1.17.0-beta1 (September 16 / September 9) — see Top Story #2. Release notes.
• Backstage v1.55.0 (September 15, with v1.54.7 / v1.54.8 patches September 11–15) — this minor carries breaking changes: deprecated catalog APIs removed (catalog.enableRelationsCompatibility compatibility layer gone — relations now always use targetRef; CodeOwnersProcessor and AnnotateScmSlugEntityProcessor removed in favor of community modules; deprecated catalog.stitchingStrategy.mode key removed) and an Elasticsearch 8 upgrade for the search backend module. Read the migration notes before upgrading your portal. Release notes.
• Crossplane v2.4.1 (September 15, plus v2.3.6 / v2.2.6 / v1.20.13) — fixes the provider-upgrade wedge where an outgoing package revision failed to relinquish CRD control, leaving the incoming revision permanently unhealthy (cannot establish control of object) and requiring manual owner-reference surgery. Also bumps Go to 1.26.7, gRPC to v1.83.2 (fixing GHSA-2v4p-qf9q-27wj), and x/crypto to v0.56.0. Release notes.
• Nomad v2.0.6 (September 9) — security bump of go-getter, a client fix preventing the Alloc FS API from accessing the secrets dir when symlinked into a task, scheduler fixes for feasibility-check skipping and retried evaluations delaying placement under load, and Vault integration fixes (change_mode triggered on every token renewal; dead tasks’ tokens kept being renewed). Release notes.
• Terragrunt v1.1.5 (September 14) — shared-source performance work worth real money at scale: units resolving the same module source now share one remote probe, cutting first-run Git commands from 304 to 7 in a 100-units-one-module benchmark (roughly 5s → 0.3s against a local Git server). Also warns on duplicate dependency blocks pointing at the same config_path, and adds an experimental offline CAS mode. Release notes.
• Argo CD v3.5.3 / v3.6.0-rc1 — see Top Story #5.

📊 Observability & SRE

• Grafana 13.2.2 / 13.1.6 / 13.0.9 / 12.4.11 (September 15) — three CVEs patched; see Top Story #1. Release notes.
• Prometheus 3.15.0-rc.0 (September 14) — first RC of the next minor. Operationally interesting: runtime log-level changes via runtime.log_level on config reload (with --log.level deprecated), auto-GOMEMLIMIT refresh at runtime for container memory-limit changes, Unix-domain-socket scraping, zstd-compressed scrape responses behind a feature flag, a PromQL fix for range queries with unaligned ends inflating peakSamples, and XOR2 float chunk encoding stabilized — check Thanos-sidecar compatibility before enabling, since it reads TSDB directly. Release notes.
• OpenTelemetry Collector v1.67.0 / v0.161.0 (September 14) — several breaking removals of deprecated APIs (ZapOptions, LoggingOptions, the old config-watcher interfaces from v0.155.0, and others) plus a scraper shutdown fix: a scrape running longer than its interval could delay shutdown by an extra scrape. Clear deprecation warnings on your current version before upgrading. Release notes.
• Jaeger v2.21.0 (September 15) — breaking: v1 HTTP endpoints the UI no longer calls are removed; ClickHouse storage feature gate promoted to stable; Elasticsearch backend now rejects five unsupported config keys at startup and surfaces failed _msearch items instead of silently dropping traces. Release notes.
• Grafana Mimir 3.2.1 / 3.1.6 (September 10) — patch releases for the Mimir 3.x lines. Releases.

SRE angle: Three of this week’s observability releases (OTel Collector, Jaeger, Prometheus RC) remove or deprecate configuration surface. The pattern to copy into your own upgrade practice: treat “deprecated config removed” as a pre-upgrade gate — grep rendered configs and Helm values for deprecated keys before rolling, not after the crash-loop.

🔐 DevSecOps & Infrastructure Security

Sources: Grafana 13.2.2, cert-manager v1.21.2, Traefik v3.7.13, Kyverno v1.19.1, Crossplane v2.4.1, Nomad v2.0.6. Where no CVE is published in the release notes, none is claimed here; GHSA identifiers reference GitHub Security Advisories.

🛠️ Tools & Releases Worth Watching

• Grafana 13.2.2 — the security patch wave; also fixes a provisioning full-sync UID collision that could bite GitOps-managed dashboards. GitHub
• Terraform v1.17.0-beta1 — evaluate -minimal-refresh against large statefiles and variables-in-provider-requirements for module templating; GA policy support lands here. GitHub
• cert-manager v1.21.2 — security hardening plus real reliability fixes (webhook panics, HTTP-01 race, Feb-29 cron renewals). GitHub
• Helm v4.3.0 — ownership verification before uninstall deletes, rollback descriptions, reproducible chart archives; and the Helm 3 EOL announcement makes migration planning concrete. GitHub
• Terragrunt v1.1.5 — shared-source probe dedup delivers an order-of-magnitude speedup for run --all over large estates. GitHub

💡 SRE Takeaways of the Week

1. Patch Grafana this week. Three CVEs across 13.2.2 / 13.1.6 / 13.0.9 / 12.4.11; prioritize any instance reachable without SSO.
2. Upgrade cert-manager to v1.21.2. Issuer response-body reflection into Events is an information-disclosure issue; the release says all users should upgrade. Adjust any Event-parsing alerts afterward.
3. Start the Helm 3 → 4 migration plan. v3.22.0 is the final Helm 3 minor; only patches remain. Inventory embedded Helm usage in CI images and GitOps tooling.
4. Adopt Terraform 1.16.3, then beta-test 1.17 for -minimal-refresh plan-time wins on large states — and watch the new format_version field if you parse JSON output.
5. Gate observability upgrades on deprecation cleanup. OTel Collector v0.161.0 and Jaeger v2.21.0 both removed deprecated config/endpoints; sweep rendered configs for deprecated keys before rolling, and hold containerd 2.4.0-rc.0 to lab clusters only (non-LTS, deprecations removed).

Sources

• Grafana 13.2.2 — grafana/grafana
• Terraform v1.16.3 — hashicorp/terraform
• Terraform v1.17.0-beta1 — hashicorp/terraform
• cert-manager v1.21.2 — cert-manager/cert-manager
• Helm v4.3.0 — helm/helm
• Helm v3.22.0 — helm/helm
• Helm v3 end of life — helm.sh blog
• Argo CD v3.6.0-rc1 — argoproj/argo-cd
• Argo CD v3.5.3 — argoproj/argo-cd
• Kyverno v1.19.1 — kyverno/kyverno
• Traefik v3.7.13 — traefik/traefik
• containerd v2.4.0-rc.0 — containerd/containerd
• Cilium 1.20.2 — cilium/cilium
• Linkerd edge-26.9.2 — linkerd/linkerd2
• Backstage v1.55.0 — backstage/backstage
• Crossplane v2.4.1 — crossplane/crossplane
• Nomad v2.0.6 — hashicorp/nomad
• Terragrunt v1.1.5 — gruntwork-io/terragrunt
• Prometheus 3.15.0-rc.0 — prometheus/prometheus
• OpenTelemetry Collector v0.161.0 — open-telemetry/opentelemetry-collector
• Jaeger v2.21.0 — jaegertracing/jaeger
• Grafana Mimir releases — grafana/mimir
• Kubernetes releases — kubernetes/kubernetes
• GitHub Security Advisories — github.com/advisories