March 2022 - Zuul-announce - lists.opendev.org

Zuul 5.2.2 released
by James E. Blair 31 Mar '22

31 Mar '22

The Zuul team is pleased to announce the release of Zuul 5.2.2. Download it from PyPI: https://pypi.org/project/zuul Find container images at: https://hub.docker.com/u/zuul The release notes for 5.2.2 and 5.2.1, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/zuul/5.2.2/releasenotes.html Bug Fixes ========= * An issue introduced in Zuul version 5.2.0 which could cause jobs running on Windows nodes to fail with the error Could not find imported module support code for ‘Ansible.ModuleUtils.Legacy’” has been corrected. * Fixed an issue in the Gerrit driver introduced in 5.2.0 which could cause infinite loops while querying changes. New Features ============ * The queue.dependencies-by-topic setting is added for Zuul users who wish to emulate the Gerrit submitWholeTopic behavior for some projects without enabling it site-wide in Gerrit. * The promote administrative action now functions with all pipeline managers. Previously it would only have an impact on dependent pipelines, but it will now re-order change queues as well as changes within any type of pipeline. Upgrade Notes ============= * The promote administrative action will no longer restart jobs for changes which have not been re-ordered within their change queue.

1 0

Zuul 5.2.0 released (security)
by James E. Blair 25 Mar '22

25 Mar '22

The Zuul team announces the release of Zuul 5.2.0. Download it from PyPI: https://pypi.org/project/zuul Find container images at: https://hub.docker.com/u/zuul The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/zuul/5.2.0/releasenotes.html Security ======== * A vulnerability which allowed the execution of untrusted code on the executor was fixed. Zuul restricts the Ansible modules and plugins which can be used in the `untrusted` security context (i.e., untrusted projects). It also prohibits running programs on the Zuul executor in the untrusted security context. Ansible 2.8 and later versions support referencing builtin modules using the `ansible.builtin.<name>` alias. Playbooks which use this mechanism can bypass Zuul's security restrictions and run arbitrary local code or otherwise restricted modules. Zuul's use of bubblewrap means that any commands executed via this vulnerability would still be contained within the restricted environment, meaning that they can not access files outside of the build directory or continue running longer than the playbook. But they may have been able to access files within the build directory but outside of the `work/` directory, as well as potentially exploit any kernel or hypervisor privilege escalation vulnerabilities. The Zuul team now considers the restricted Ansible environment to be ineffective as a security mechanism and is developing plans to remove the restrictions and rely entirely on bubblewrap in the future. These changes will occur in a future release of Zuul (likely 6.0.0) and will be preceded by more details about the change. New Features ============ * Changes in dependent queues are now automatically dequeued if they no longer meet the mergability requirements set by the upstream code review system. * Zuul now matches Gerrit’s behavior when change.submitWholeTopic is set in Gerrit. When this setting is enabled in Gerrit and a change is submitted (merged), all changes with the same topic are submitted simultaneously. Zuul will now query for changes which are set to be submitted together by Gerrit when enqueing them and treat them as if they are a set of circular dependencies. If the projects are not part of pipeline queues which are configured to allow circular dependencies, then Zuul will report failure on enqueue. Be sure that the submitWholeTopic setting in Gerrit and the allow-circular-dependencies setting in Zuul match. This functionality requires an HTTP connection to Gerrit. If only an SSH connection is available, then changes submitted together will be ignored. * The ability to configure Microsoft Login as an OpenID Connect authentication provider has been added. * Zuul now reports total resource usage statistics. The following statistic is emitted: zuul.nodepool.resources.total.tenant.{tenant}.{resource} Gauge with the currently used resources by tenant in total, i.e., all nodes belonging to a tenant, regardles of their state. * It is now possible for jobs to skip retries caused by failures in ‘pre-run’ by returning retry: false: - zuul_return: data: zuul: retry: false Upgrade Notes ============= * Zuul now reports total and in-use resource usage statics separately. To distinquish those, the following statistics have been renamed: zuul.nodepool.resources.tenant.{tenant}.{resource} -> zuul.nodepool.resources.in_use.tenant.{tenant}.{resource} zuul.nodepool.resources.project.{project}.{resource}: -> zuul.nodepool.resources.in_use.project.{tenant}.{resource}

1 0

Zuul 5.1.0 released
by James E. Blair 22 Mar '22

22 Mar '22

The Zuul team is pleased to announce the release of Zuul 5.1.0. Download it from PyPI: https://pypi.org/project/zuul Find container images at: https://hub.docker.com/u/zuul The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/zuul/5.1.0/releasenotes.html New Features ============ * Added support for adding and removing merge request labels in the GitLab driver, as well as triggering pipelines on label removal (label addition was already supported). * A new buildset result MERGE_FAILURE is stored in the build database in the case where a buildset is unable to be merged by the upstream code review system. * The following new statsd metrics are available in order to monitor Zuul system performance: * zuul.tenant.<tenant>.pipeline.<pipeline>.event_enqueue_time * zuul.tenant.<tenant>.pipeline.<pipeline>.merge_request_time * zuul.tenant.<tenant>.pipeline.<pipeline>.layout_generation_time * zuul.tenant.<tenant>.pipeline.<pipeline>.job_freeze_time * zuul.tenant.<tenant>.pipeline.<pipeline>.repo_state_time * zuul.tenant.<tenant>.pipeline.<pipeline>.node_request_time * zuul.tenant.<tenant>.pipeline.<pipeline>.job_wait_time * zuul.tenant.<tenant>.pipeline.<pipeline>.event_job_time * zuul.tenant.<tenant>.pipeline.<pipeline>.read_time * zuul.tenant.<tenant>.pipeline.<pipeline>.write_time * zuul.tenant.<tenant>.pipeline.<pipeline>.read_objects * zuul.tenant.<tenant>.pipeline.<pipeline>.write_objects * zuul.tenant.<tenant>.pipeline.<pipeline>.read_znodes * zuul.tenant.<tenant>.pipeline.<pipeline>.write_znodes * zuul.tenant.<tenant>.pipeline.<pipeline>.read_bytes * zuul.tenant.<tenant>.pipeline.<pipeline>.write_bytes * zuul.tenant.<tenant>.pipeline.<pipeline>.event_process * zuul.tenant.<tenant>.pipeline.<pipeline>.handling * zuul.tenant.<tenant>.reconfiguration_time * A new command zuul-scheduler tenant-reconfigure has been added. It allows an operator to perform a reconfiguration of a single tenant. This may be helpful in clearing up issues after connection problems with the code hosting system. * New monitoring metrics specific to zuul-web are available. Upgrade Notes ============= * The buildset result MERGER_FAILURE has been renamed to MERGE_CONFLICT, and the pipeline reporter configuration merge-failure has been renamed to merge-conflict. These are more descriptive of the most common errors actually reported, and so are expected to be less confusing to users. This is also in service of a future change to support a new buildset result MERGE_FAILURE which will indicate that the change was unable to be merged in the upstream repository. When upgrading, it is recommended to stop all schedulers briefly (i.e, when the first scheduler of the new version starts, there should be no schedulers running the old version). The new scheduler will perform a database migration when it starts and update all existing MERGER_FAILURE buildset results to MERGE_CONFLICT. If old schedulers are running, they may continue to add MERGER_FAILURE entries which will need to be manually updated in order to be visible in the web UI or rest API. Deprecation Notes ================= * The merge-failure and merge-failure-message pipeline configuration options have been renamed to merge-conflict and merge-conflict-message respectively. The old settings are retained for backwards compatibility, but will be removed in a later version. Please update your usage of them as soon as possible. Bug Fixes ========= * The labels pipeline requirement in the gitlab driver erroneously treated the labels as a boolean or but should have treated them as a boolean and (i.e., all listed labels are required). The behavior has been updated to match the documentation and other drivers.

1 0