January 2019 - Zuul-announce - lists.opendev.org

Potential disclosure of secrets defined in untrusted projects
by corvus＠inaugust.com 24 Jan '19

24 Jan '19

A potential vector for exposure or unauthorized use of secrets was recently discovered. The vulnerability is removed in version 3.5.0 and affects all versions after 3.0.0 and prior to 3.5.0. The vulnerability only applies in very specific circumstances; if these apply to you, it is recommended to upgrade immediately and consider auditing and replacing affected secrets. It may have been possible to expose a secret, or use resources protected by a secret, if a job using a secret was defined in an untrusted project on a system with an independent pre-merge post-review pipeline -- that is, a pipeline with post-review set to true, manager set to independent, and which operated on changes before they merged -- and that job relied on the allowed-projects attribute to restrict access to it. An example of such a pipeline is a "restricted check" pipeline, where reviewers may trigger builds after core reviewers with additional permissions leave a vote or label. To take advantage of the vulnerability, a user would have to create (but not cause to be merged) a change in the target repository which removed the allowed-projects access restriction, and then create a change in a repository they control which used the "Depends-On" feature to depend on the change in the target repository, and then cause that change to be enqueued in an independent pre-merge post-review pipeline. To prevent disclosure or use in this situation, allowed-projects is now automatically set to the current project when a secret is used in a job defined in an untrusted project, and it can not be overridden.

1 0

Zuul 3.5.0 released
by corvus＠inaugust.com 24 Jan '19

24 Jan '19

The Zuul team is pleased to announce the release of Zuul 3.5.0. Download it from PyPI: https://pypi.org/project/zuul The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/zuul/releasenotes.html#relnotes-3-5-0 Security Issues =============== * Jobs with secrets in untrusted projects now automatically set allowed-projects. It is possible to circumvent the use of allowed-projects in untrusted projects by creating a change which Depends-On a change which alters a project definition. This behavior may be unexpected, so documentation has been updated with warnings to avoid relying on it in sensitive cases. It may have been possible to expose a secret, or use resources protected by a secret, if a job using a secret was defined in an untrusted project on a system with an independent pre-merge post-review pipeline – that is, a pipeline with post-review set to true, manager set to independent, and which operated on changes before they merged. To prevent disclosure or use in this situation, allowed-projects is now automatically set to the current project when a secret is used in a job defined in an untrusted project, and it can not be overridden. Upgrade Notes ============= * The zuul_return module has been converted to an Ansible action plugin. Job playbooks no longer need to use delegate_to or a localhost only play with this module as action plugin by default run on localhost. New Features ============ * The executor.min_avail_mem setting now takes cgroup limits into account. There is also a new metric zuul.executor.<executor>.pct_used_ram_cgroup available. * The job.secrets.pass-to-parent attribute has been added to allow secrets to be made available to playbooks in parent jobs (for example, to allow for jobs which are designed to use secrets, but leave it to child jobs to actually supply them). See also the Secret documentation. * The restriction on using known_hosts in playbooks has been lifted. * The executors emit a new timer zuul.executor.<executor>.starting_builds with the time jobs spent during starting. Bug Fixes ========= * Untrusted playbooks no longer see ‘Adding hosts ssh with ansible_user to the inventory is prohibited’ when using the add_host Ansible task on localhost. * Fixed an issue where a trailing slash on the baseurl of a git driver connection config could cause an indefinite job hang.

1 0

Nodepool 3.4.0 released
by corvus＠inaugust.com 16 Jan '19

16 Jan '19

The Zuul team is pleased to announce the release of Nodepool 3.4.0. Download it from PyPI: https://pypi.org/project/nodepool The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/nodepool/releasenotes.html#relnotes-3-4-0 Upgrade Notes ============= * A change to the ZooKeeper schema to support a new DELETED node state will require a total shutdown of all Nodepool launchers before restarting any of them with this version. New Features ============ * A new configuration option is available under the ‘pools’ attribute of an OpenStack provider. This config value, ‘node-attributes’, can contain a dictionary of arbitrary key-value pairs and will be stored with the node data within ZooKeeper. Bug Fixes ========= * Fixes a regression of missing task statistics with OpenstackSDK versions greater than 0.19.0.

1 0

Zuul 3.4.0 released
by corvus＠inaugust.com 12 Jan '19

12 Jan '19

The Zuul team is pleased to announce the release of Zuul 3.4.0. Download it from PyPI: https://pypi.org/project/zuul The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/zuul/releasenotes.html#relnotes-3-4-0 Upgrade Notes ============= * The zuul-web service now requires access to ZooKeeper, as a result you may need to update your firewall allow access from the service. Additionally, zuul.conf should now contain a zookeeper configuration section. * The zuul.nodepool statistics have been moved under zuul.nodepool.requests to allow sub-stats to work correctly. For example zuul.nodepool.requested has become zuul.nodepool.requests.requested.total. The previously missing label and size counters are now available at zuul.nodepool.requests.<state>.<size|label>. For more info see the monitoring documentation. New Features ============ * Jobs may now return artifact URLs and they will be stored in the SQL database (if configured). See Returning artifact URLs for usage. * One or more zuul executors can now be added to a executor.zone. This is helpful if a cloud does not have any public IP addresses for nodepool nodes. Now you’ll be able to have a zuul executor on the same private network as your nodepool nodes. * The Ansible inventory file now includes nodepool.host_id variable if the node was launched using the OpenStack Nodepool driver. * A new scheduler option, scheduler.relative_priority, can be used to instruct Nodepool to fulfull requests from less-busy projects more quickly.

1 0

Heads up that build-puppet-role role will change behavior
by Tobias Urdin 11 Jan '19

11 Jan '19

Hello, The openstack-infra/zuul-jobs repo will be updated by [1] causing the "build-puppet-module" role to stop using the "puppet module build" command and instead use the PDK (Puppet Development Kit) gem to build the modules. The only change is that there will be no folder created in the pkg folder inside your module but only the actual tarball, the naming and location of the tarball (in the "pkg" folder) is still the same. There will be a grace period until [1] is merged, if you require a version folder of your module being created in the pkg folder you must do this manually or revert to using the "puppet module build" command which is deprecated and will be removed in a future release of Puppet. Best regards Tobias [1] https://review.openstack.org/#/c/627534

1 0