DevOps & SRE Weekly Digest — 2026-09-30

Table of Contents

The Week in One Paragraph

GA and patch-day week. OpenTofu v1.13.0 went GA (September 30) — WinRM provisioner support is gone, base64gzip produces equivalent-but-not-identical output, and this is the last series with 32-bit builds. Kubernetes patch day (September 23) shipped v1.37.1 / v1.36.5 / v1.35.9 / v1.34.12 with a cluster-wide DRA scheduling bugfix and a kube-scheduler crash fix. containerd patched CVE-2026-53493, an image-pull DoS via crafted OCI index graph amplification, across every supported line (1.7.36 / 2.0.13 / 2.1.x / 2.2.9 / 2.3.6 / 2.4.1). Grafana ran a coordinated security patch day (September 29) fixing four CVEs across five release lines. Prometheus 3.15.0 went GA with Unix-socket scraping and the Agent-mode WAL corruption fix, and Grafana Tempo v3.1.0 GA’d with query-based trace redaction.

All items below were published between September 23 and September 30, 2026, and every claim links to a primary source.

🚨 Top Stories

1. OpenTofu v1.13.0 GA — WinRM removed, base64gzip diff churn, last 32-bit series

What happened: OpenTofu v1.13.0 shipped September 30, 2026 (blog post). Highlights and compatibility notes:

• Windows on ARM64 is now a supported platform with official packages.
• New functions let module authors reduce unknowns during planning by hinting facts OpenTofu cannot infer.
• Two early experiments: built-in linting and Symbol Libraries (reusable collections of values, functions, and type aliases importable like modules).
• Breaking: WinRM connection type for provisioners removed (deprecated in v1.12 — migrate Windows targets to OpenSSH).
• Breaking-adjacent: base64gzip output is equivalent but not byte-identical (new DEFLATE implementation) — expect one-time update/replace diffs where it’s used in resource arguments.
• macOS 13 Ventura+ required; v1.13 is the final series with official 32-bit builds (*_386, *_arm), supported until August 1, 2027.

Why it matters: GA means the rc1 guidance from last week is now production-relevant: the base64gzip change will generate noisy plans on upgrade, and WinRM removal is a hard break for Windows provisioner workflows.

Who is affected: Anyone provisioning Windows over WinRM, anyone using base64gzip in managed resource arguments, teams on macOS < 13, and anyone on 32-bit runners.

Recommended action: Upgrade in CI first and inventory base64gzip usage before rolling out — pre-communicate the expected one-time diffs. Plan the WinRM → SSH migration now, and start 32-bit → 64-bit moves well before the August 2027 EOL.

2. Kubernetes patch day — v1.37.1, v1.36.5, v1.35.9, v1.34.12 (September 23)

What happened: All four supported Kubernetes lines received patches. Notable fixes (CHANGELOG-1.37, CHANGELOG-1.36):

• DeviceTaintRule bug (v1.37.1): a rule with no spec.deviceSelector incorrectly matched every device cluster-wide, tainting all DRA devices NoSchedule/NoExecute — i.e., a single malformed rule could unschedule all GPU/device workloads. It now matches nothing; use an explicit empty selector (deviceSelector: {}) to target all devices.
• Kube-scheduler crash: a ResourceClaim whose device request counts overflow the int range no longer crashes the scheduler or skips the firstAvailable fallback (v1.37.1 and v1.36.5).
• Windows kube-proxy panic when enumerating an HNS load balancer without port mappings (v1.37.1 and v1.36.5).
• kubeadm no longer persists a node-specific systemd-resolved resolvConf path into the cluster-wide kubelet-config ConfigMap.
• All lines rebuilt with Go 1.26.8.

Why it matters: The DeviceTaintRule fix is the headline — if you adopted DRA taints on 1.37.0, a missing selector was a footgun with cluster-wide blast radius. The scheduler crash fix matters for anyone pushing large DRA claims.

Who is affected: Cluster operators on 1.37.0 using DeviceTaintRules, Windows nodes running kube-proxy, and kubeadm-managed clusters.

Recommended action: Patch to v1.37.1 (or your line’s patch) in the next window. If you use DeviceTaintRules, audit existing rules for missing deviceSelector and make selectors explicit. For managed Kubernetes, track when your provider picks up these patches.

3. containerd CVE-2026-53493 — image-pull DoS via crafted OCI index; patch every line

What happened: containerd 2.4.1 / 2.3.6 / 2.2.9 (and 1.7.36 / 2.0.13 per the advisory) shipped September 24 fixing GHSA-pg57-6jwg-q645 / CVE-2026-53493: image-pull denial of service via crafted OCI index graph amplification (CWE-400, Moderate). Affected: ≤ 1.7.35; 2.0.x < 2.0.13; 2.1.x < 2.2.9; 2.3.x < 2.3.6; 2.4.0. The 2.4.1 patch also fixes failed-start cleanup leaking tasks (blocking container removal), SELinux relabeling failures on unsupported filesystems, and hardens unpacking to filter ID-mapping labels from image annotations.

Why it matters: containerd sits under nearly every Kubernetes node. A pull-time DoS that triggers on a crafted image index is exploitable by anything that can get your nodes to pull a hostile image — think admission gaps, not just direct attackers.

Recommended action: Treat as a priority node-fleet patch. Confirm your nodes’ containerd version (not just the kubelet version), and coordinate with your managed provider’s node-image cadence if you run EKS/GKE/AKS.

4. Grafana security patch day — four CVEs across 12.4.12 / 13.0.10 / 13.1.7 / 13.2.3

What happened: On September 29, Grafana shipped security patches across four release lines (13.2.3, 13.1.7, 13.0.10, 12.4.12):

• CVE-2026-81841 (GHSA-4jjr-w7m9-wx5q, Moderate 5.3, CWE-862 Missing Authorization) — pausing a shared (public) dashboard did not revoke its access.
• CVE-2026-81842 (GHSA-37j9-5rxj-3hwp, Moderate 4.3, CWE-863 Incorrect Authorization) — a user with edit permission on one folder could act beyond it.
• CVE-2026-13719 (GHSA-46f2-3vm3-9h7j, Moderate 4.3, CWE-200) — an authenticated user could list alert rules they shouldn’t see.
• CVE-2026-13720 (GHSA-9q62-r26p-xcjv, Moderate 5.4, CWE-285) — an Editor could set file-provisioning metadata.

Why it matters: All four are authorization flaws. CVE-2026-81841 is the one with real external exposure: if you ever paused a public dashboard link assuming access stopped, it didn’t.

Recommended action: Upgrade your line’s patch release (12.4.12 / 13.0.10 / 13.1.7 / 13.2.3). Audit shared/public dashboard links — any paused link should be treated as having remained live. Rotate anything sensitive exposed through them.

5. Prometheus 3.15.0 GA — Unix-socket scraping, runtime log-level reload, Agent WAL fix lands

What happened: Prometheus 3.15.0 shipped September 24 (LTS line also patched: v3.13.4, September 29). Highlights:

• Unix Domain Socket scraping support (#12024).
• OpenMetrics 2.0 scrape format implemented.
• runtime.log_level can now be changed on config reload; --log.level is deprecated.
• --auto-gomemlimit.refresh-interval re-detects container memory limits at runtime — useful when limits change without pod restarts.
• The Agent-mode WAL corruption fix from rc.1 (failed WAL write no longer corrupts the WAL) is in GA.
• PromQL fixes: subqueries evaluating past the parent’s last step wasted storage I/O and inflated peakSamples against query.max-samples.

Why it matters: WAL corruption in Agent mode was a crash-loop / data-loss risk for remote-write fleets — that fix alone justifies the upgrade. Runtime GOMEMLIMIT refresh removes a class of OOM kills on vertically-resized pods.

Recommended action: Upgrade server and Agent fleets to 3.15.0 (canary agents first if you’re cautious about the WAL path). LTS users on 3.13: take 3.13.4. Plan the --log.level → runtime.log_level migration in your config management.

☸️ Kubernetes & Cloud Native

• Kubernetes v1.37.1 / v1.36.5 / v1.35.9 / v1.34.12 — see Top Story #2. v1.38.0-alpha.1 also cut September 28, opening the next minor cycle.
• containerd 2.4.1 / 2.3.6 / 2.2.9 — see Top Story #3. Beyond the CVE, 2.3.6 enables the mount manager for image mounts in CRI and masks /proc/interrupts plus CPU thermal-throttle sysfs paths in containers by default.
• prometheus-operator v0.94.1 — September 23. Restores update permission on finalizer subresources in the operator’s ClusterRole, required when OwnerReferencesPermissionEnforcement runs with blockOwnerDeletion — without it, deletions wedge. Small but load-bearing RBAC fix.
• Rook v1.20.8 — September 29. Ceph operator patch: OSD prepare pods now run on host network for host-provider setups, Helm chart gains default HTTPRoute backend parameters.
• Tekton Pipeline v1.15.3 (LTS) — September 22, just at the window edge. Patch on the LTS line.

☁️ Cloud Platforms

Cloud provider official update channels (AWS What’s New, Azure Updates, Google Cloud, Cloudflare blog) were not reachable from this run’s research environment, so this section stays short rather than padded with unverified items. Adjacent signals worth tracking:

• Kubernetes provider lag: the September 23 patch wave (Top Story #2) now needs to land in EKS/GKE/AKS. Map v1.37.1/v1.36.5/v1.35.9 availability against your control-plane and node-pool auto-upgrade settings — the DeviceTaintRule and scheduler fixes are worth not waiting a full cycle on.
• containerd rollout: CVE-2026-53493 remediation on managed Kubernetes depends on your provider’s node image refresh, not your cluster upgrade. Check node image release notes for containerd ≥ 1.7.36 / 2.0.13 / 2.2.9 / 2.3.6 / 2.4.1.

🏗️ Infrastructure as Code & Platform Engineering

• OpenTofu v1.13.0 — see Top Story #1. The GA to test this week if you’re on OpenTofu.
• Terraform v1.17.0-beta2 — September 23. Terraform Policy is now GA — the -policies flag on plan/apply/query no longer needs experimental builds, and query policies evaluate resources discovered by list blocks. Also: variables and locals in provider requirements, a new -minimal-refresh planning option (only refresh resources with proposed changes), and a fix where pow/log panicked on non-numeric results. -minimal-refresh is the one to watch for large-state plans.
• Backstage v1.55.3 / v1.55.2 / v1.54.9 — September 29. Follow-up patches to last week’s v1.55 line fixing TechDocs generation for documented MkDocs Markdown extension configurations. If you upgraded to 1.55 and TechDocs builds broke, this is your fix. v1.56.0-next.1 also shipped for next-line testing.
• Ansible v2.22.0b2 — September 29, plus rc1s for v2.21.5 / v2.20.10 / v2.19.14 the same day. Second beta of the next ansible-core line — GA is near; run it against your collections now.

📊 Observability & SRE

• Prometheus 3.15.0 GA / v3.13.4 — see Top Story #5.
• Grafana Tempo v3.1.0 GA — September 29. Ships everything from the RCs covered last week: query-based trace redaction (TraceQL selector instead of enumerating trace IDs), TraceQL metrics arithmetic with sampling-aware extrapolation, Kafka SASL/TLS improvements, experimental trace diff/summaries, and vParquet5 as the default block format for new writes (vParquet3/4 reads continue — no migration).
• Grafana Alloy v1.20.0 / v1.20.1 — September 25/28. Breaking changes to check before upgrading: discovery.hetzner no longer exports __meta_hetzner_datacenter for hcloud role targets (relabeling rules silently stop matching); otelcol.receiver.filelog’s top_n = 0 now means “track all files” instead of default; Kafka plaintext credentials translate to a SASL/PLAIN block. v1.20.1 fixes Loki batch-size accounting and makes loki_write_sent_bytes_total/dropped_bytes_total count uncompressed bytes.
• OpenTelemetry Collector v0.162.0 / v1.67.0 — September 28. Breaking: the queuebatch processor is renamed to queue_batch — update configs before upgrading. Also: keepalive config enabled by default in confighttp (behind a feature gate), batch partition idle timeout now configurable (default raised to 90s), and new otelcol_memorylimiter_refused_requests metric for the memory limiter extension.

🔐 DevSecOps & Infrastructure Security

• CVE-2026-53493 (containerd) — see Top Story #3. Image-pull DoS via crafted OCI index graph amplification, Moderate, CWE-400. Patched in 1.7.36 / 2.0.13 / 2.2.9 / 2.3.6 / 2.4.1. Action: priority node-fleet patch.
• Grafana CVE-2026-81841 / 81842 / 13719 / 13720 — see Top Story #4. All authorization-class, all Moderate. CVE-2026-81841 (paused public dashboards staying accessible) deserves an audit of your shared links independent of the upgrade.
• No new CISA advisories directly targeting core infrastructure tooling surfaced in this window from reachable sources.

Operational guidance: both fixes this week are “patch the fleet, then audit assumptions” — nodes for containerd, shared links for Grafana. Neither requires emergency change-freeze-breaking action, but neither should wait a month either.

🛠️ Tools & Releases Worth Watching

• Grafana Tempo v3.1.0 — query-based trace redaction is the standout: for compliance-driven teams, redacting spans by TraceQL selector beats hunting trace IDs one by one. grafana/tempo
• Terraform v1.17.0-beta2 — -minimal-refresh could meaningfully cut plan times on large states; policy GA unblocks pipeline policy checks without experimental builds. Beta for testing. hashicorp/terraform
• Prometheus 3.15.0 — Unix-socket scraping plus runtime GOMEMLIMIT refresh are genuinely useful for sidecar and vertically-scaled deployments. prometheus/prometheus
• containerd 2.4.1 — security patch plus real bug fixes (leaked tasks blocking container removal, SELinux relabeling failures). containerd/containerd
• prometheus-operator v0.94.1 — one-line RBAC fix that unblocks deletion workflows under OwnerReferencesPermissionEnforcement. prometheus-operator/prometheus-operator

💡 SRE Takeaways of the Week

1. Patch containerd across the fleet. CVE-2026-53493 affects every line ≤ 1.7.35 / < 2.0.13 / < 2.2.9 / < 2.3.6 / 2.4.0. On managed Kubernetes, verify your provider’s node image carries the fix — don’t assume.
2. Upgrade Grafana and audit paused public dashboards. CVE-2026-81841 means “paused” links stayed live; treat any paused shared dashboard as exposed until proven otherwise.
3. Test OpenTofu v1.13.0 in CI before rolling out. Expect one-time base64gzip diffs, plan WinRM → SSH migration, and schedule 32-bit → 64-bit moves before August 2027.
4. Take the Kubernetes September 23 patches. If you use DRA on 1.37, the DeviceTaintRule fix is not optional. Audit existing rules for missing deviceSelector.
5. Rename queuebatch → queue_batch before OTel Collector v0.162.0. Breaking config change hiding in an otherwise routine release — grep your collector configs now.

Sources

• OpenTofu v1.13.0 — opentofu/opentofu
• OpenTofu 1.13.0 blog post — opentofu.org
• Terraform v1.17.0-beta2 — hashicorp/terraform
• Kubernetes CHANGELOG-1.37 — kubernetes/kubernetes
• Kubernetes CHANGELOG-1.36 — kubernetes/kubernetes
• Kubernetes releases — kubernetes/kubernetes
• containerd 2.4.1 — containerd/containerd
• containerd GHSA-pg57-6jwg-q645 (CVE-2026-53493)
• Grafana 13.2.3 — grafana/grafana
• Grafana 13.1.7 — grafana/grafana
• Grafana 13.0.10 — grafana/grafana
• Grafana 12.4.12 — grafana/grafana
• CVE-2026-81841 — GHSA-4jjr-w7m9-wx5q
• CVE-2026-81842 — GHSA-37j9-5rxj-3hwp
• CVE-2026-13719 — GHSA-46f2-3vm3-9h7j
• CVE-2026-13720 — GHSA-9q62-r26p-xcjv
• Prometheus 3.15.0 — prometheus/prometheus
• Prometheus v3.13.4 — prometheus/prometheus
• Grafana Tempo v3.1.0 — grafana/tempo
• Grafana Alloy v1.20.0 — grafana/alloy
• Grafana Alloy v1.20.1 — grafana/alloy
• OpenTelemetry Collector v0.162.0 — open-telemetry/opentelemetry-collector
• prometheus-operator v0.94.1 — prometheus-operator/prometheus-operator
• Rook v1.20.8 — rook/rook
• Backstage v1.55.3 — backstage/backstage
• Ansible v2.22.0b2 — ansible/ansible
• Tekton Pipeline v1.15.3 — tektoncd/pipeline