June 2018 - Zuul-announce - lists.opendev.org

zuul-jobs: Deprecation of the "emit-ara-html" role in favor of "ara-report"
by David Moreau Simard 14 Oct '18

14 Oct '18

Hello, The "emit-ara-html" [1] role, typically part of Zuul base jobs, has been used to generate ARA [2] static HTML Ansible reports. These files end up being stored as part of the logs of a job in the "ara" directory. This role has been superseded by "ara-report" [3] which provides the same functionality and defaults out of the box. This new role adds support for saving raw databases and is meant to be compatible with the use of the ARA sqlite WSGI middleware. This new middleware implementation may be of particular interest for Zuul operators since it translates to improved job performance and reduced storage overhead. For reference, the OpenStack Infrastructure implementation can be found here [4]. The announcement to openstack-dev can be found here [5] for additional details and context. Please refer to the ARA documentation for more details [6]. Feel free to reply to this thread or reach out to us in #zuul if you have any questions! [1]: https://git.zuul-ci.org/cgit/zuul-jobs/tree/roles/emit-ara-html [2]: https://github.com/openstack/ara [3]: https://git.zuul-ci.org/cgit/zuul-jobs/tree/roles/ara-report/README.rst [4]: https://review.openstack.org/#/q/project:openstack-infra/puppet-openstackci… [5]: http://lists.openstack.org/pipermail/openstack-dev/2018-March/128902.html [6]: https://ara.readthedocs.io/en/latest/advanced.html David Moreau Simard Senior Software Engineer | OpenStack RDO dmsimard = [irc, github, twitter]

1 1

Nodepool 3.1.0 released
by corvus＠inaugust.com 30 Jun '18

30 Jun '18

The Zuul team is pleased to announce the release of Nodepool 3.1.0. Download it from PyPI: https://pypi.org/project/nodepool/ The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/nodepool/releasenotes.html#relnotes-3-1-0 Upgrade Notes ============= * Nodepool can now support multiple node labels, although the OpenStack and static node drivers do not yet support specifying multiple labels, so this is not yet a user-visible change. This does, however, require shutting down all launcher processes before restarting them. Running multiple launchers with mixed support of multi-label will cause errors, so a full shutdown is required. New Features ============ * Nodepool now defaults to building qcow2 diskimages instead of failing if the diskimage doesn’t specify an image format and the diskimage isn’t used by any provider. This makes it more convenient to build images without uploading them to a cloud provider. * Added support for specifying security-groups for the nodes in openstack driver. Pool.security-groups takes list of SGs to attach to the server. * The static driver now pre-registers its nodes with ZooKeeper at startup and on configuration changes. A single node may be registered multiple times, based on the value of max-parallel-jobs. Bug Fixes ========= * Fixed a bug where if a request handler is paused and an exception is thrown within the handler, the handler was not properly unpaused and the request remained in the list of active handlers.

1 0

Unintended variable disclosure on Ansible unreachable tasks despite no_log
by Tobias.Henkel＠bmw.de 19 Jun '18

19 Jun '18

Dear Zuul operators, We discovered that if nodes become offline during the build the no_log attribute of a task got ignored. If the unreachable error occurred in a task used with a loop variable (ex: with_items), the contents of the loop items would be printed in the console. This could lead to accidentally leaking credentials or secrets. We have reported this issue to the Ansible project and the CVE-2018-10855 [1] was assigned to the bug. Further information can be found in StoryBoard: https://storyboard.openstack.org/#!/story/2002177 In Zuul, This is fixed by https://review.openstack.org/574788 which is included in version 3.1.0. It is strongly adviced to update to latest master and restart any running zuul-executor processes. We have audited zuul-jobs and have not found an instance where a sensitive variable like a secret would have been used in a loop. In Ansible, users are encouraged to update to the latest supported dot releases as soon as possible. The fix for Ansible [2] is available in 2.5.5 (released June 14th) and 2.4.5rc1. Sorry for any inconveniences. Kind regards Tobias [1]: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10855 [2]: https://github.com/ansible/ansible/pull/41414/files -- BMW Car IT GmbH Tobias Henkel Software engineer Moosacher Straße 86 80809 München Tel.: +49 89 189311-48 Fax: +49 89 189311-20 Mail: tobias.henkel(a)bmw.de<mailto:tobias.henkel@bmw.de> Web: http://www.bmw-carit.de<http://www.bmw-carit.de/> ----------------------------------------------------------------------------- BMW Car IT GmbH Geschäftsführer: Kai-Uwe Balszuweit und Christian Salzmann Sitz und Registergericht: München HRB 134810 -----------------------------------------------------------------------------

2 1

Zuul 3.1.0 released
by corvus＠inaugust.com 16 Jun '18

16 Jun '18

The Zuul team is pleased to announce the release of Zuul 3.1.0. Download it from PyPI: https://pypi.org/project/zuul/ The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/zuul/releasenotes.html#relnotes-3-1-0 New Features ============ * Zuul now uses Ansible 2.5. * The GitHub driver can determine the required status checks of pull requests which are needed for entering a gate pipeline. This eliminates the need to hard code required status checks in the gate pipeline and makes interoperation with other GitHub apps much more flexible. * Zuul is now ables to start with an invalid configuration. When reading configuration files from project repositories, if an issue is detected, Zuul will store the issue and skip the broken block of configuration. Issues are then reported in the scheduler log at the end of the configuration phase. * A mqtt connection driver is added to feature build report over MQTT message. * Files (and irrelevant-files) matchers are now overridable. Zuul now uses only branch matchers to collect job variants. Once those variants are collected, they are combined, and the files and irrelevant-files attributes are inherited and overridden as any other job attribute. The final values are used to determine whether the job should ultimately run. * The GitHub driver now supports the pipeline.require.<github source>.merged requirement. * The json log contains now also the role name and the uuid similar to the task entry. Bug Fixes ========= * Untrusted playbooks no longer see ‘Executing local code is prohibited’ when using the zuul_return Ansible task.

1 0