From 6cd6ee618e598b85da1e68d7d7183639a2f86f19 Mon Sep 17 00:00:00 2001
From: Thore Cimbal <cfx@riot.8shield.net>
Date: Fri, 21 Aug 2026 12:00:00 +0000
Subject: [PATCH] monitoring: the two charts on a floating range were the two
 left behind

Every other release in this repo pins an exact version. Exactly two used a
range, and exactly those two stopped receiving updates: 0.12.6 is the last 0.x
alloy chart and 5.37.0 the last 5.x kube-state-metrics, so both ranges had been
sitting on a ceiling that reads as 'stays current'. A pinned version at least
looks stale.

Rendered both versions of each chart against our real values before changing
anything, because a chart jump moved an internal endpoint out from under a
network rule earlier today. Same objects, same selectors, same service names;
kube-state-metrics names its targetPort instead of numbering it and swaps
endpoints for endpointslices, neither of which our policies or scrapes touch.

nginx for the docs server goes along: 1.26-alpine carried two criticals,
1.31.4-alpine measures clean.
---
 apps/monitoring/alloy.yaml                   | 8 +++++++-
 apps/monitoring/kube-state-metrics.yaml      | 7 ++++++-
 apps/production/element-web-docs-server.yaml | 3 ++-
 3 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/apps/monitoring/alloy.yaml b/apps/monitoring/alloy.yaml
index 3a2e11b..f131092 100644
--- a/apps/monitoring/alloy.yaml
+++ b/apps/monitoring/alloy.yaml
@@ -8,7 +8,13 @@ spec:
   chart:
     spec:
       chart: alloy
-      version: "0.x"
+      # ⚠️ Bis 2026-08-21 stand hier "0.x". Das sah nach "bleibt aktuell" aus
+      # und war eine DECKE: 0.12.6 ist die letzte 0er-Fassung des Charts, seither
+      # erschienen 1.x-Fassungen, die der Bereich nie erreichen konnte. Alloy blieb
+      # dadurch auf v1.7.5 stehen (2 CRITICAL) waehrend v1.16.3 keine traegt.
+      # Jetzt fest wie jeder andere Release in diesem Repo - eine feste Nummer ist
+      # sichtbar veraltet, ein gedeckelter Bereich nicht.
+      version: "1.9.0"
       sourceRef:
         kind: HelmRepository
         name: grafana
diff --git a/apps/monitoring/kube-state-metrics.yaml b/apps/monitoring/kube-state-metrics.yaml
index 22d452d..9d2bc34 100644
--- a/apps/monitoring/kube-state-metrics.yaml
+++ b/apps/monitoring/kube-state-metrics.yaml
@@ -8,7 +8,12 @@ spec:
   chart:
     spec:
       chart: kube-state-metrics
-      version: "5.x"
+      # ⚠️ Bis 2026-08-21 "5.x" - dieselbe Decke wie bei alloy: 5.37.0 ist die
+      # letzte 5er-Fassung, aktuell ist 8.4.0. Stand deshalb auf App v2.15.0
+      # (1 CRITICAL); v2.20.0 traegt keine. Beide Renderings verglichen:
+      # gleiche Objekte, gleiche Selektoren, targetPort 8080 -> benannt "http"
+      # (derselbe Port), RBAC endpoints -> endpointslices.
+      version: "8.4.0"
       sourceRef:
         kind: HelmRepository
         name: prometheus-community
diff --git a/apps/production/element-web-docs-server.yaml b/apps/production/element-web-docs-server.yaml
index bfe70b6..96e87cb 100644
--- a/apps/production/element-web-docs-server.yaml
+++ b/apps/production/element-web-docs-server.yaml
@@ -34,7 +34,8 @@ spec:
           mountPath: /html
       containers:
       - name: nginx
-        image: nginx:1.26-alpine
+        # 1.26-alpine trug 2 CRITICAL; 1.31.4-alpine gemessen: 0 CRITICAL, 0 HIGH.
+        image: nginx:1.31.4-alpine
         ports:
         - containerPort: 8080
         volumeMounts: