January 2023 - Zuul-announce - lists.opendev.org

Change to default value for enable_fips parameter in enable-fips playbook in zuul-jobs
by Ade Lee 23 Jan '23

23 Jan '23

Hi all, This is just an announcement that the enable_fips parameter in https://opendev.org/zuul/zuul-jobs/src/branch/master/playbooks/enable-fips/… is being changed from being True by default to being False by default. Any jobs that use this playbook (and wish to enable fips) will need to explicitly set enable_fips to True. The reason for this change is as follows: Turing FIPS on requires a reboot. For most consistent results, we want this to occur early in the node setup so that subsequent setup is not affected by a reboot. To do this, we need to run the playbook as part of a base job. Defaulting enable_fips to false allows us to add this playbook to most jobs. Descendant jobs can then simply enable FIPS mode by simply setting enable_fips mode to True. More details can be found in the change: https://review.opendev.org/c/zuul/zuul-jobs/+/866881 Thanks, Ade Lee

1 0

Nodepool 8.1.0 released
by James E. Blair 19 Jan '23

19 Jan '23

The Zuul team is pleased to announce the release of Nodepool 8.1.0. Download it from PyPI: https://pypi.org/project/nodepool Find container images at: https://hub.docker.com/u/zuul The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/nodepool/8.1.0/releasenotes.html While not addressed directly by Nodepool, note that container images starting with this release include a version of git patched to address CVE-2022-23521. Upgrade Notes ============= * In the OpenStack driver, when using `min-ram` in combination with a `flavor-name`, the first flavor to be found that satisfied the `min-ram` requirements and contained the substring `flavor-name` would be used. The order of the flavors to be searched was dependent on what the cloud returned. From this release, the available flavors are now alphabetically sorted before matching `flavor-name`.

1 0

Zuul 8.1.0 released [security]
by James E. Blair 19 Jan '23

19 Jan '23

The Zuul team is pleased to announce the release of Zuul 8.1.0. Download it from PyPI: https://pypi.org/project/zuul Find container images at: https://hub.docker.com/u/zuul The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/zuul/8.1.0/releasenotes.html Benjamin Schanzel discovered that pipeline requirements were not checked for dependent changes in a post-review independent pipeline. If an independent pipeline was configured so that it only runs jobs for reviewed code, dependent changes could be used to bypass that requirement and cause unreviewed code to be included in jobs. This vulnerability has been present since Zuul version 3.0.0. Zuul will now check pipeline requirements for all changes (including dependent changes that are only enqueued for the purpose of providing speculative git repo states). While not addressed directly by Zuul, note that container images starting with this release include a version of git patched to address CVE-2022-23521. Security Issues =============== * Non-live items are now subject to pipeline requirements for independent pipelines. Previously, an optimization for independent pipelines skipped checking that a change met the pipeline requirements. If an independent pipeline is intended only to run reviewed code, this could allow running unreviewed code by updating dependent changes. Now both non-live and live items are subject to pipeline requirements in all pipeline managers. The new allow-other-connections pipeline configuration option may now be used to ensure that only changes from connections which are mentioned in the pipeline configuration (such as triggers, reporters, or pipeline requirements) are enqueued. This allows the construction of a pipeline where, for example, code review requirements are strictly enforced, even for dependencies which are not normally directly enqueued. New Features ============ * A new pipeline attribute, pipeline.allow-other-connections, has been added to ensure that only changes from connections which are mentioned in the pipeline configuration (such as triggers, reporters, or pipeline requirements) are enqueued. * Zuul now stores the pause and resume events for a build together with their timestamp and reports them to the SQL database and via MQTT. * Individual playbooks may now be wrapped by a semaphore. Zuul will start the job and proceed up to the point of a playbook which requires a semaphore and then wait until it is able to aquire the semaphore before proceeding. It releases the semaphore after the end of that individual playbook. The same semaphore may be used for both jobs and playbooks, but an individual job may not use the same semaphore for both purposes. Upgrade Notes ============= * Additional syntax checking is performed on job configuration changes so that Zuul will report an error if a job inherits from a non-permitted parent (such as a final job, intermediate job when the child is not abstract, or a protected job in another project). Previously, these situations might only be discovered when freezing a job graph. If any jobs currently in this situation exist, they will be reported as configuration errors.

1 0

Nodepool 8.0.1 released
by James E. Blair 12 Jan '23

12 Jan '23

The Zuul team is pleased to announce the release of Nodepool 8.0.1. Download it from PyPI: https://pypi.org/project/nodepool Find container images at: https://hub.docker.com/u/zuul The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/nodepool/8.0.1/releasenotes.html New Features ============ * The nodepool command now includes a “hold” subcommand. Bug Fixes ========= * The Kubernetes driver now supports version 1.24+

1 0