November 2022 - Zuul-announce - lists.opendev.org

Potential log upload credential exposure in zuul-jobs
by James E. Blair 16 Nov '22

16 Nov '22

Clark Boylan recently discovered that some of the log upload roles in the zuul-jobs repo were missing `no_log: true` settings and can write credentials to the job-output.json file. These are written to the file after the logs have been uploaded, and so are not included in the uploaded logs. This means that accidental exposure in typical usage is unlikely. A malicious user could write a cleanup-run playbook to read in the contents of the file and send the credentials off-host. The zuul-jobs repo has been updated to correct this problem, so if you include it in your tenant configuration directly, it will automatically be updated. If you use a local mirror of zuul-jobs, you should update it immediately. The update to zuul-jobs is this commit: https://opendev.org/zuul/zuul-jobs/commit/622baa65bfa02a592024a867c5bd94a8a…

1 0

Zuul 8.0.1 released
by James E. Blair 03 Nov '22

03 Nov '22

The Zuul team is pleased to announce the release of Zuul 8.0.1. Download it from PyPI: https://pypi.org/project/zuul Find container images at: https://hub.docker.com/u/zuul The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/zuul/8.0.1/releasenotes.html Bug Fixes ========= * An error which prevented results from appearing in the web UI on the "Buildsets" tab has been corrected.

1 0

Zuul 8.0.0 released
by James E. Blair 01 Nov '22

01 Nov '22

The Zuul team is pleased to announce the release of Zuul 8.0.0. Download it from PyPI: https://pypi.org/project/zuul Find container images at: https://hub.docker.com/u/zuul The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/zuul/8.0.0/releasenotes.html New Features ============ * Read-level access to tenants or the tenant list may now be restricted to authorized users using the tenant.access-rules and api-root.access-rules attributes. * The rebase merge-mode is now supported for GitHub. Upgrade Notes ============= * Support for Ansible version 5 has been removed. Migrate any existing jobs which rely on this version to Ansible version 6 before upgrading. * In preparation for expanded access control features in the web interface, and REST API, the admin-rule tenant configuration object has been renamed to authorization-rule. When applied to a tenant, the tenant attribute is still admin-rules since it determines admin access to that tenant. This change will allow similar rules to be applied to non-admin level access in the future. Tenant configs should now follow this example: - authorization-rule: name: example-rule - tenant: name: example-tenant admin-rules: - example-rule The old form is still permitted for backwards compatability, but will be removed in a later version of Zuul. * The default merge mode used by Zuul for preparing git repos was previously merge-resolve in all cases, but is now merge for all drivers except Gerrit, where merge-resolve is still the default. This makes the merge operations performed by Zuul more closely match the operations that will be performed by the code review systems. Bug Fixes ========= * The use of implied branch matchers in jobs where override-checkout was specified could cause some jobs to include unintended variants. Specifically: job variants with implied branch matchers on branches which are substring matches of a branch specified in the override-checkout job attribute may have been used when not intended. * This has been corrected so that the same job variant matching process happens whether the change’s branch or the branch specified by override-checkout is used.

1 0

Nodepool 8.0.0 released
by James E. Blair 01 Nov '22

01 Nov '22

The Zuul team is pleased to announce the release of Nodepool 8.0.0. Download it from PyPI: https://pypi.org/project/nodepool Find container images at: https://hub.docker.com/u/zuul The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/nodepool/8.0.0/releasenotes.html New Features ============ * The AWS driver now support specifying volume IOPS and throughput; see: providers.[aws].pools.labels.iops, providers.[aws].pools.labels.throughput, providers.[aws].diskimages.iops, and providers.[aws].diskimages.throughput. * The OpenStack, AWS, and Azure drivers now support adding tags (AKA metadata, AKA properties) to instances with dynamic data about the corresponding node request using string formatting. See providers.[openstack].pools.labels.instance-properties, providers.[aws].pools.labels.dynamic-tags, and providers.[azure].pools.labels.dynamic-tags for details. * The AWS and Azure drivers now support adding tags to images via the providers.[aws].diskimages.tags, and providers.[azure].diskimages.tags attributes. The OpenStack driver already supported similar behavior with its meta attribute. The diskimages.metadata attribute has been added and will supply default values to the provider image tag attributes mentioned above. * A new configuration option for K8s Pod type labels was added to limit the amount of ephemeral storage allocatable in a container (cf. K8s Local ephemeral storage resource documentation <https://kubernetes.io/docs/concepts/configuration/manage-resources-containe…>) This limit can be set via the integer value of providers.[kubernetes].pools.labels.storage and is treated as Megabytes. Also, a pool-scoped default value can be specified via providers.[kubernetes].pools.default-label-storage

1 0

Zuul and OpenSSL 3.x Security Vulnerabilities
by Clark Boylan 01 Nov '22

01 Nov '22

OpenSSL disclosed two security vulnerabilities [0] affecting OpenSSL 3.0 and newer. Prior to disclosure these issues were rated critical but on further analysis were degraded to high. We believe the impact to Zuul is minimal, but are sending this email as this situation has received a lot of attention. Zuul users should be informed about the inner workings of the software they run. Zuul does use OpenSSL for a number of functions. In particular, cert based client auth is performed on the Zookeeper connection (and potentially with OpenTelemetry if enabled). This means that Zuul installations connecting to a malicious Zookeeper server (or OpenTelemetry endpoint) could potentially be exploited. The official Zuul Docker images are based on Debian Bullseye which does not include OpenSSL 3.x and should not be affected. Users who have installed on Ubuntu Jammy or RHEL 9 (or any of its derivatives) should update their OpenSSL packages to avoid any problems. The Ubuntu page for this CVE [1] notes that stack protections should limit the impact of this bug on Ubuntu to denials of service further reducing the potential impact to Zuul. [0] https://www.openssl.org/news/secadv/20221101.txt [1] https://ubuntu.com/security/CVE-2022-3602

1 0