- Zuul-announce - lists.opendev.org

Nodepool 4.0.0 released
by jim＠acmegating.com 23 Feb '21

23 Feb '21

The Zuul team is pleased to announce the release of Nodepool 4.0.0. Download it from PyPI: https://pypi.org/project/nodepool The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/nodepool/4.0.0/releasenotes.html Upgrade Notes ============= * TLS is now required for ZooKeeper connections. TLS support has been optional since version 3.13. If you have not already enabled it, we recommend enabling it before upgrading to 4.0.

1 0

Nodepool 3.14.0 released
by corvus＠inaugust.com 02 Dec '20

02 Dec '20

The Zuul team is pleased to announce the release of Nodepool 3.14.0. Download it from PyPI: https://pypi.org/project/nodepool The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/nodepool/3.14.0/releasenotes.html Upgrade Notes ============= * The k8s and OpenShift providers do not longer set the workingDir attribute of their container specs to /tmp. * For increased flexibility for the user, the working dir specified in the container images Dockerfile is used as the default in container nodes. Please note that this might often be the root dir (‘/’) if not specified otherwise by the respective Dockerfiles WORKDIR directive. New Features ============ * Configuration value can be set from the envirnonment variables using the %(NODEPOOL_env_name) syntax. * Basic support for specifying k8s/OpenShift nodeSelectors on Pod node labels. This allows to schedule a Pod on k8s nodes with specific labels, e.g., having certain capabilities. * Support for passing environment variables to k8s and OpenShift Pod build nodes has been added. * It is not possible to set persistent env vars in containers on run time because there is no login shell available. Thus, we need to pass in any env vars during node launch. This allows to set, e.g., http_proxy variables. Environment variables can be defined on node labels as a list of dictionaries with name and value fields as per the k8s container YAML schema.

1 0

Use TLS Zookeeper and a SQL db, or pin to Zuul / Nodepool 3.x
by corvus＠inaugust.com 04 Aug '20

04 Aug '20

Hi, As part of the upgrade path to Zuul v5, which will feature a fully distributed system (including schedulers), we need to make some incompatible changes. You can continue to continuously deploy Zuul (we will in OpenDev), but only if you have already made the required changes. As a reminder, here is the overall plan for v4/v5: http://lists.zuul-ci.org/pipermail/zuul-discuss/2020-March/001158.html And here are the required changes: * TLS ZooKeeper connections [1] * Network connectivity from all components to ZooKeeper * A SQL database [2] They are described in more detail in the release notes: https://zuul-ci.org/docs/zuul/reference/releasenotes.html#relnotes-3-19-0 Starting immediately we will begin merging the changes to implement this process. That means that if you are continuously deploying Zuul, you must either have these changes in place as of now, or pin your installation to a 3.x release while you make those changes. I encourage everyone to do this ASAP, so that you can continue to closely track Zuul development. The path from v3 to v5 is intended to be smooth and one that we can all incrementally follow. They key to this is not falling behind at the beginning. -Jim [1] https://zuul-ci.org/docs/zuul/howtos/zookeeper.html#zk-encrypted-connections [2] https://zuul-ci.org/docs/zuul/reference/drivers/sql.html#sql-driver

1 0

Behavior change for ara-report role
by corvus＠inaugust.com 25 Jul '20

25 Jul '20

Hi, We'd like to change the behavior of one of the variables in the ara-report role in order to allow the role to be run either on the Zuul executor or any worker node. We will no longer prepend zuul.executor.log_root to the ara_report_path variable. We will, however, set the default value to "{{ zuul.executor.log_root }}/ara". In short, this means that if you are running the role on the executor with the default value for ara_report_path, no change is necessary. If you are supplying a different value to ara_report_path, you will need to update the value when this change merges: https://review.opendev.org/742971 We plan to merge this change on August 10, 2020. Please let us know if this would cause a hardship for you. -Jim

1 0

Nodepool 3.13.1 released
by corvus＠inaugust.com 24 Jul '20

24 Jul '20

The Zuul team is pleased to announce the release of Nodepool 3.13.1. Download it from PyPI: https://pypi.org/project/nodepool The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/nodepool/3.13.1/releasenotes.html Bug Fixes ========= * The dependency on kazoo has been upgraded to 2.8.0 which has an important fix for using Zookeeper over TLS.

1 0

Announcing Zuul 3.19.1 (security update)
by corvus＠inaugust.com 23 Jul '20

23 Jul '20

The Zuul team announces the release of Zuul 3.19.1. This is an important security and bugfix release. Download it from PyPI: https://pypi.org/project/zuul The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/zuul/3.19.1/reference/releasenotes.html Prelude ======= This is expected to be the last 3.x release of Zuul (barring any further unanticipated bugfix releases). The next release of Zuul, 4.0.0, will require the following deployment changes: * TLS ZooKeeper connections * Network connectivity from all components to ZooKeeper * A SQL database These features are supported now, so it is important that you take this time to switch your ZooKeeper connection to use TLS, and configure a SQL connection. Even though only some Zuul components connect to ZooKeeper today, you should ensure that the [zookeeper] section is present in zuul.conf for all components, and that they have network connectivity to the ZooKeeper servers. Doing so will make the upgrade to 4.0.0 seamless. These changes are in support of ongoing work to enable multiple scheduler processes for scaling and availability. After the 4.0.0 release, it is anticipated that further upgrades to Zuul made in support of this work will be done with minimal disruption in the course of normal releases. Security Issues =============== A long-standing security vulnerability regarding executing code on the executor was corrected. The Zuul executor was designed to prohibit executing command or shell tasks on the executor itself (i.e., localhost in Ansible) from untrusted playbooks. Tobias Henkel discovered that this check has been broken for some time, likely since June of 2018. The use of bubblewrap means that any commands executed via this vulnerability would still be contained within the restricted environment, meaning that they can not access files outside of the build directory or continue running longer than the job. However, by executing arbitrary commands, users may have been able to connect to unprotected internal network services. Because this bug is so long-standing, it is possible, even likely, that users may have accidentally come to rely on it. We discovered two jobs in the zuul-jobs library which did so: dco-license and promote-docker-image. The promote-docker-image job has been altered so it no longer needs to run a command on the executor. The dco-license job has been altered to run on a node. If you would prefer to run it on the exceutor, you can create a new job in a config-project that uses the validate-dco-license role. You may want to look for other jobs in your system which may be affected by this. To aid in that, we have created a script which will examine the job-output.json files created by previous builds and output any tasks it finds which are now (once again) prohibited. This script is available here: https://opendev.org/zuul/zuul/src/branch/master/tools/find-untrusted-exec.py Bug Fixes ========= * The dependency on kazoo has been upgraded to 2.8.0 which has an important fix for using Zookeeper over TLS. * The Github access token URL has been updated in order to remove a deprecation warning.

1 0

zuul-jobs: remove default 'tox_envlist: venv' from tox roles.
by albin vass 19 Jun '20

19 Jun '20

Hey all! We're planning on aligning the tox roles to better mirror the behaviour of running tox on the command line. Most of this is already done by running the default envlist configured in tox.ini if tox_envlist is set to an empty string, and by running all test environments if set to 'ALL'. But the last step is to allow users to just run 'tox' as a job the same way it works when it is run on the command line. To do this we need to remove 'tox_envlist: venv' from the default configuration of the roles. We will deprecate this behaviour by merging [1] with a short notice period of one week since we believe this behaviour is not currently being used anywhere. [1] - https://review.opendev.org/#/c/726830/24

2 1

zuul-jobs dropping ansible 2.6 support.
by albin vass 18 Jun '20

18 Jun '20

Hi! It's been a couple of weeks since zuul stopped supporting ansible 2.6 and zuul-jobs is planning on dropping it as well. So in about two weeks from now, around the 2nd of July, we will merge [1] to officially stop supporting ansible 2.6. [1] - https://review.opendev.org/#/c/727158/3

1 0

Changing some defaults in zuul-jobs to python3
by Monty Taylor 18 Jun '20

18 Jun '20

Hey all, We’d like to change the default python version in a few places. Specifically in: build-python-release role, which is used in the build-python-release job - controlled by “release_python” var ensure-sphinx role, used in build-reno-releasenotes and build-sphinx-docs jobs - controlled by “sphinx_python”: var Both currently default to python2, which is EOL. We’ll be changing the defaults in a week, on June 25. Between now and then, if it is important to use to use those with python2, you should explicitly set the appropriate variable to python2. Thanks! Monty

1 0

Zuul 3.19.0 released (final 3.x release)
by corvus＠inaugust.com 28 May '20

28 May '20

The Zuul team is pleased to announce the release of Zuul 3.19.0. Download it from PyPI: https://pypi.org/project/zuul The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/zuul/3.19.0/reference/releasenotes.html Prelude ======= This is expected to be the last 3.x release of Zuul (barring any unanticipated bugfix releases). The next release of Zuul, 4.0.0, will require the following deployment changes: * TLS ZooKeeper connections * Network connectivity from all components to ZooKeeper * A SQL database These features are supported now, so it is important that you take this time to switch your ZooKeeper connection to use TLS, and configure a SQL connection. Even though only some Zuul components connect to ZooKeeper today, you should ensure that the [zookeeper] section is present in zuul.conf for all components, and that they have network connectivity to the ZooKeeper servers. Doing so will make the upgrade to 4.0.0 seamless. These changes are in support of ongoing work to enable multiple scheduler processes for scaling and availability. After the 4.0.0 release, it is anticipated that further upgrades to Zuul made in support of this work will be done with minimal disruption in the course of normal releases. Upgrade Notes ============= * Support for Ansible 2.6 has been removed. * Ansible 2.7 is now deprecated since it only receives security updates and will be end of life soon. * Zuul now defaults to Ansible 2.9 if no version is specified. * The default behavior of the tools/encrypt_secret.py helper script is now to strip incoming input of leading and trailing whitespace. A new --no-strip option has been added to support people with secrets that contain valid leading or trailing whitespace. * Please configure your Zuul to use TLS secured connection. Running Zuul with an unsecured connection to ZooKeeper is deprecated and will be unsupported in a future release. See zookeeper for details. New Features ============ * Zuul now supports whitelisting and configuring ansible callbacks with ansible_callback “<name>”. * Pipelines now provide a pipeline.dequeue reporter action so that reporters may run whenever an item is dequeued. The dequeue reporters will only apply if the item wasn’t a success or failure. * Support for generating dynamic Badges has been added. * The annotation levels for the file comments reported via Github checks API are now configurable in zuul_return. Each file comment entry can provide an optional level parameter [info|warning|error] that will be picked up by the Github reporter. For more details on how to provide file comments from Zuul, see the documentation of the Return Values. * The status pipeline requirements of the Github driver pipeline.require.<github source>.status now also matches on statuses reported via the Github checks API. * The tenant configuration now supports loading a different branch than master from config projects. See tenant.config-projects.<project>.load-branch. * Zuul now matches tag items against their containing branches. This makes it simpler to have release jobs in-tree. See job.branches for details. * The zuul-executor now also pauses all merger related tasks when it’s paused. Further the zuul-merger can also be paused by running zuul-merger pause. * The serial pipeline manager has been added. It is designed to handle serialized deployment pipelines where supercedent is unsuitable in the case that not all jobs run on every merge. * Add new timezone selector in web interface * Zuul now supports a TLS secured connection to ZooKeeper. Security Issues =============== * Zuul no longer adds environment variables starting with the ZUUL_ prefix to ansibles environment which could result in secrets being exposed. Bug Fixes ========= * In some cases (such as when an older version of kubectl is present on the executor, or the kubectl on the executor is from OpenShift), streaming logs from Kubernetes or OpenShift pods did not work. The log streaming system has been corrected to work with a wider range of kubectl versions and error logging has been improved.

1 0

Nodepool 3.13.0 released
by corvus＠inaugust.com 28 May '20

28 May '20

The Zuul team is pleased to announce the release of Nodepool 3.13.0. Download it from PyPI: https://pypi.org/project/nodepool The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/nodepool/3.13.0/releasenotes.html New Features ============ * Support for encrypted connections to ZooKeeper has been added. Before enabling, ensure that both Zuul and Nodepool software versions support encrypted connections. See the Zuul release notes, documentation, and associated helper scripts for more information. Both Zuul and Nodepool may need to be restarted together with the new configuration. * The docker images published to zuul/nodepool, zuul/nodepol-launcher and zuul/nodepool-builder are now built as multi-arch images and support arm64 in addition to amd64. * Entries in the diskimages section can now specify a parent image to inherit configuration values from. You can also specify images for configuration use only as abstract to consolidate common values. * There are new metrics for leaked resources: * nodepool.provider.<provider>.leaked.ports * nodepool.provider.<provider>.leaked.instances * nodepool.provider.<provider>.leaked.floatingips * Setting build-log-retention to -1 will disable the removal of old build logs. Upgrade Notes ============= * The metric nodepool.provider.<provider>.downPorts has been renamed to nodepool.provider.<provider>.leaked.ports Bug Fixes ========= * Zookeeper hosts specified as IPv6 literals will now be configured correctly.

1 0

zuul-jobs deprecation notice: install-* roles are being renamed.
by albin vass 28 Apr '20

28 Apr '20

Hi, The install-* roles are being deprecated and renamed to follow the ensure-* naming convention. The current plan is that in two weeks the roles will start throwing an error message to use the new ensure-* roles, and then move on to remove them with change [1] in about four weeks from this notice, that is 26th May 2020. All of the repositories affected in opendev should have proposed changes ready to merge that ensures the updated roles are used. [3] The proposed changes were first posted in zuul-discuss [2], unfortunately the topic was accidentally changed on most of the changes to ensure-repositories [3][4] [1] https://review.opendev.org/#/c/719322/ [2] http://lists.zuul-ci.org/pipermail/zuul-discuss/2020-April/001203.html [3] https://review.opendev.org/#/q/topic:ensure-repositories [4] https://review.opendev.org/#/q/topic:role-naming-consistency

1 0

[Mohammed Naser] ensure-tox: install inside python3 by default
by corvus＠inaugust.com 13 Mar '20

13 Mar '20

1 0

Zuul 3.18.0 released
by corvus＠inaugust.com 04 Mar '20

04 Mar '20

The Zuul team is pleased to announce the release of Zuul 3.18.0. Download it from PyPI: https://pypi.org/project/zuul The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/zuul/3.18.0/reference/releasenotes.html Security Issues =============== * The add_host host-vars blacklist is no longer effective for trusted playbook. Upgrade Notes ============= * Kubectl and socat must now be installed on Zuul executors if using Kubernetes or OpenShift pod resources from Nodepool. Additionally, Nodepool version 3.12.0 or later is required, and the "start-zuul-console" role from zuul-jobs should be run in the pre-playbook of your base job. Deprecation Notes ================= * Running the zuul processes with the -d switch to enforce running in foreground is now deprecated. Switch to use -f instead for this purpose. The -d switch will change to just enable debug logging in the future. New Features ============ * The Github driver can now report file comments via Github checks API. If a github reporter is configured to use the checks API, file comments provided via zuul_return will automatically be reported to the pull request in Github. For more details on how to provide file comments from Zuul, see the documentation of the Return Values. Bug Fixes ========= * Previously, no output from shell or command tasks on pods was placed in the job output; that has been corrected and streaming output is now available.

1 0

Nodepool 3.12.0 released
by corvus＠inaugust.com 03 Mar '20

03 Mar '20

The Zuul team is pleased to announce the release of Nodepool 3.12.0. Download it from PyPI: https://pypi.org/project/nodepool The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/nodepool/3.12.0/releasenotes.html New Features ============ * Support for resources in Google Compute Engine (GCE) has been added. * Add optional ebs-optimized on ec2 instances. * Add optional tags on ec2 instances and use cloud-image label as Name.

1 0

Zuul 3.17.0 released (security update)
by corvus＠inaugust.com 28 Feb '20

28 Feb '20

The Zuul team is pleased to announce the release of Zuul 3.17.0. Download it from PyPI: https://pypi.org/project/zuul The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/zuul/3.17.0/reference/releasenotes.html Security Issues =============== * The add_host module attributes that can be used to bypass localhost command execution are now also blacklisted using extra-vars to prevent abuse through untrusted host_vars. New Features ============ * The Github driver now has a basic support for the Github checks API. To enable reporting build results via the checks API one can configure the the new pipeline.<reporter>.<github source>.check attribute on the Github reporter. It’s also possible to trigger on a requested or completed check_run. To be able to use the checks API, zuul must be authenticated as Github app. For more information about the necessary requirements, please see the GitHub driver documentation.

1 0

Zuul 3.16.1 released
by corvus＠inaugust.com 13 Feb '20

13 Feb '20

The Zuul team is pleased to announce the release of Zuul 3.16.1. Download it from PyPI: https://pypi.org/project/zuul The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/zuul/3.16.1/reference/releasenotes.html The release is a bugfix release issued shortly after 3.16.0. Release notes for both are included below: Upgrade Notes ============= * The default for <gerrit connection>.auth_type has changed from digest to basic. Digest authentication has not been supported in Gerrit since version 2.15. If your Zuul connects to an older version of Gerrit via HTTP authentication, you may now need to explicitly set this value. New Features ============ * A new tenant option tenant.disallowed-labels (similar to tenant.allowed-labels) can be used to restrict what labels a tenant has access to. Bug Fixes since 3.16.0 ====================== * When using GitHub app authentication the fallback to anonymous access was broken for repositories not having installed the zuul app. Bug Fixes since 3.15.0 ====================== * Files matcher has been fixed to act like irrelevant files matcher when no files are present in the tested change, i.e. it now matches such empty changes instead of rejecting them.

1 0

zuul-jobs: removal of upload-afs role
by Ian Wienand 05 Feb '20

05 Feb '20

Hello, The upload-afs role is deprecated and we plan to remove it with change [1] around two weeks from this notice; that is around the 19th Feburary, 2020. The role has been moved to upload-afs-roots with change [2]. Thus you can simply rename any current users of the role without any other changes. This role allows for some very useful processing for documentation trees, where you wish to fully synchronize some diretories but leave others alone (old branch documents, say). However it is less suitable for generic copying which we have simplified into a partner role upload-afs-synchronize. This will remove the somewhat misleading generic name and make it clearer what both roles achieve. Please contact zuul-discuss [3] with any concerns. -i [1] https://review.opendev.org/705373 [2] https://review.opendev.org/705368 [3] http://lists.zuul-ci.org/cgi-bin/mailman/listinfo/zuul-discuss

1 0

Zuul 3.15.0 released
by corvus＠inaugust.com 16 Jan '20

16 Jan '20

The Zuul team is pleased to announce the release of Zuul 3.15.0. Download it from PyPI: https://pypi.org/project/zuul The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/zuul/3.15.0/overview/releasenotes.html Bug Fixes ========= * Files matcher has been fixed to act like irrelevant files matcher when no files are present in the tested change, i.e. it now matches such empty changes instead of rejecting them.

1 0

Nodepool 3.11.0 released
by corvus＠inaugust.com 16 Jan '20

16 Jan '20

The Zuul team is pleased to announce the release of Nodepool 3.11.0. Download it from PyPI: https://pypi.org/project/nodepool The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/nodepool/3.11.0/releasenotes.html New Features ============ * It is now possible to specify if AWS nodes shall get a providers.[aws].pools.public-ip-address. * The AWS driver now supports custom providers.[aws].pools.labels.userdata when launching instances. * There is a new GET /ready endpoint that can be used as a readiness probe.

1 0

Zuul 3.14.0 released
by corvus＠inaugust.com 20 Dec '19

20 Dec '19

The Zuul team is pleased to announce the release of Zuul 3.14.0. Download it from PyPI: https://pypi.org/project/zuul The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/zuul/3.14.0/releasenotes.html New Features ============ * Zuul now supports triggering a smart reconfiguration by using the command zuul-scheduler smart-reconfigure. Upgrade Notes ============= * Zuul no longer supports Ansible 2.5 for running jobs.

1 0

Zuul 3.13.0 released
by corvus＠inaugust.com 12 Dec '19

12 Dec '19

The Zuul team is pleased to announce the release of Zuul 3.13.0. Download it from PyPI: https://pypi.org/project/zuul The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/zuul/3.13.0/releasenotes.html New Features ============ * Zuul now supports Ansible 2.9 for running jobs. Upgrade Notes ============= * The default version of Ansible used by Zuul jobs has been changed to 2.8. See job.ansible-version for more information. * As a result of switching to Ansible 2.8, it is possible for the ansible_python_interpreter version of your nodeset to change to 'auto'. This could result in your jobs now running under a different version of python than prior to this release. See Ansible and Python 3 for additional info. * Ansible 2.6 for Zuul jobs has been marked deprecated and will be removed in a future release.

1 0

Upcoming Zuul release dropping support for Ansible 2.5
by corvus＠inaugust.com 10 Dec '19

10 Dec '19

Ansible 2.5 has been unsupported by the Ansible community for quite some time and therefore an upcoming release of Zuul will drop support for it as well. This process is new to us, and we have not yet formalized our support policy for older Ansible versions. We plan on doing so this week so that in the future, everyone will know when to expect changes like this. Later this week we plan to make two more releases of Zuul to aid folks in this transition: * 3.13.0 will add support for Ansible 2.9 and change the default version of Ansible from 2.7 to 2.8 * 3.14.0 will remove support for Ansible 2.5 If you wish to avoid the default value change to Ansible 2.8, be sure to override that in your configuration[1] before upgrading to 3.13. If you know you have jobs which rely on Ansible 2.5, you will want to pause your upgrades at 3.13 until you can update jobs to work with a later version. Note that since we are removing 2.5 after adding 2.9, you have the widest possible range of versions available during this window. [1] https://zuul-ci.org/docs/zuul/user/config.html#attr-job.ansible-version

1 0

Nodepool 3.10.0 released
by corvus＠inaugust.com 10 Dec '19

10 Dec '19

The Zuul team is pleased to announce the release of Nodepool 3.10.0. Download it from PyPI: https://pypi.org/project/nodepool The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/nodepool/3.10.0/releasenotes.html#relnotes-3-10-0 New Features ============ * Nodepool now supports providers.[openstack].post-upload-hook to run a user supplied script after an image has been uploaded to a cloud but before it gets used. Bug Fixes ========= * Fixed compatibility issue with openstacksdk 0.37.0 and above.

1 0

Zuul 3.12.0 released
by corvus＠inaugust.com 10 Dec '19

10 Dec '19

The Zuul team is pleased to announce the release of Zuul 3.12.0. Download it from PyPI: https://pypi.org/project/zuul The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/zuul/3.12.0/releasenotes.html#relnotes-3-12-0 New Features ============ * A new config option enable executor to not performed global merge job. Upgrade Notes ============= * The Gerrit driver now has an additional option, pipeline.reporter.<gerrit reporter>.comment which may be used to suppress reporting job results as review comments. Due to the configuration syntax for Gerrit reporters, the word “comment” may no longer be used as a review label. Other Notes =========== * The –id option to both the autohold-delete and autohold-info zuul CLI commands has been removed.

1 0

Change to configure-mirrors role to accomodate Python Setuptools update
by Clark Boylan 25 Nov '19

25 Nov '19

Hello, The recent release of setuptools 42.0.0 has broken the method used by the configure-mirrors role to ensure easy_install (the older method to install Python packages, before pip became in widespread use [1]) would only access the PyPI mirror. The prior mirror setup code would set the "allow_hosts" whitelist to the mirror host exclusively in pydistutils.cfg. This would avoid easy_install "leaking" access outside the specified mirror. Change [2] in setuptools means that pip is now used to fetch packages. Since it does not implement the constraints of the "allow_hosts" setting, specifying this option has become an error condition. This is reported as: the `allow-hosts` option is not supported when using pip to install requirements It has been pointed out [3] that this prior code would break any dependency_links [4] that might be specified for the package (as the external URLs will not match the whitelist). Overall, there is no desire to work-around this behaviour as easy_install is considered deprecated for any current use. In short, this means the only solution is to remove the now conflicting configuration from pydistutils.cfg. Due to the urgency of this update, it has been merged with [5] before our usual 2-week deprecation notice. The result of this is that older setuptools (perhaps in a virtualenv) with jobs still using easy_install may not correctly access the specified mirror. Assuming jobs have access to PyPI, they would still work, although without the benefits of a local mirror. If such jobs are firewalled from upstream they may now fail. We consider the chance of jobs using this legacy install method in this situation to be very low. Please contact zuul-discuss [6] with any concerns. We now return you to your regularly scheduled programming :) [1] https://packaging.python.org/discussions/pip-vs-easy-install/ [2] https://github.com/pypa/setuptools/commit/d6948c636f5e657ac56911b71b7a459d3… [3] https://github.com/pypa/setuptools/issues/1916 [4] https://python-packaging.readthedocs.io/en/latest/dependencies.html [5] https://review.opendev.org/695821 [6] http://lists.zuul-ci.org/cgi-bin/mailman/listinfo/zuul-discuss

1 0

Nodepool 3.9.0 released
by corvus＠inaugust.com 18 Oct '19

18 Oct '19

The Zuul team is pleased to announce the release of Nodepool 3.9.0. Download it from PyPI: https://pypi.org/project/nodepool The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/nodepool/releasenotes.html#relnotes-3-9-0 Upgrade Notes ============= * This release should only be run against Zuul 3.11.1 or greater. Earlier Zuul releases will not convert the new default python-path of auto to /usr/bin/python2 for Ansible <2.8, leading to a configuration error. It may be possible to use earlier Zuul releases if you you are only using Ansible >= 2.8, or explicitly set python-path for every image. New Features ============ * A diskimage can specify the full path to the diskimage-builder command with the dib-cmd configuration parameter. The --fake parameter of nodepool-builder (only used by CI) has been removed and replaced with explicit calls in testing fixtures. * The default python-path is now auto (instead of /usr/bin/python2). With this, Zuul 3.11.1 and greater will set the ansible_python_interpreter to auto when using Ansible >=2.8 to use automated interpreter discovery. When using earlier Ansible, it will remain the old default of /usr/bin/python2. This will remove the need to override python-path explicitly for Python 3-only distributions, which should be detected correctly automatically.

1 0

Zuul 3.11.1 released
by corvus＠inaugust.com 17 Oct '19

17 Oct '19

The Zuul team is pleased to announce the release of Zuul 3.11.1 (a bugfix release immediately following 3.11.0). Download it from PyPI: https://pypi.org/project/zuul The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/zuul/3.11.1/releasenotes.html#relnotes-3-11-1 3.11.0: Upgrade Notes ============= * The Gerrit driver will now perform query actions over HTTP if an HTTP password is configured. In this situation, the SSH connection is now only used for receiving events. The HTTP password is not required, but it is recommended since it provides more reporting options (including line comments). New Features ============ * Added the pipeline.enqueue reporter action so that reporters may be run when an item is enqueued into a pipeline. * Added the pipeline.no-jobs reporter action so that reporters may be run when an item is dequeued into a pipeline without having run any jobs. * A new zuul CLI command, autohold-info, has been added to retrieve full details for an existing autohold request. * Autohold requests are now stored in ZooKeeper, rather than in memory. As a result of this change, a new zuul CLI command, autohold-delete has been added to remove existing requests. * New scheduler options, max_hold_expiration and default_hold_expiration, are added to control how long nodes held for an autohold request remain available. The max_hold_expiration option defaults to 0, which means the held nodes will not automatically expire, and default_hold_expiration defaults to the value of max_hold_expiration. 3.11.1: Bug Fixes ========= * Fixed a regression where changes with a failing job with soft dependencies would remain in the queue indefinitely.

1 0

Zuul 3.10.2 released (security update)
by corvus＠inaugust.com 18 Sep '19

18 Sep '19

The Zuul team is pleased to announce the release of Zuul 3.10.2. Download it from PyPI: https://pypi.org/project/zuul The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/zuul/3.10.2/releasenotes.html#relnotes-3-10-2 Security Issues =============== * The synchronize rsh rsync_opts is now prohibited for security reasons as it could be used to circumvent executor host command execution restrictions. New Features ============ * The maximum starting builds depending on cpu cores can be limited using executor.max_starting_builds configuration. Bug Fixes ========= * Under specific conditions Zuul could fail to properly update git repos causing it to fall back to testing master. If jobs were meant to run against commits other than current master this lead to testing the wrong commit. Zuul now correctly updates repos and should test the correct commit in all cases. Specifically this could happen if a new branch was created off a commit in an existing branch. Then the first proposed change to this new branch would be tested against master instead.

1 0

Behavior change in upload-logs role
by Paul Belanger 05 Sep '19

05 Sep '19

Greetings, We'd like to make a change[1] to the upload-logs role in an effort to make it easier for users to view logs by default: Allow upload-logs to toggle compression of console logs We should make it easy for users to view console logs by default. Today, we compress and upload logs and by default apache / nginx will not properly display them as plain text. This commit changes the default to not compress, but allows more advanced users to enable this logic. As mostly likley it also means additional configuration for your web server. We've created a new role variable (zuul_log_compress) which will be false by default. If you wish to keep your logs compressed, you should toggle this to true. Please refer to existing ML[2] post for more discussion. [1] https://review.opendev.org/567696/ [2] http://lists.zuul-ci.org/pipermail/zuul-discuss/2018-May/000412.html

1 0

Behavior change in tox-docs
by Monty Taylor 25 Aug '19

25 Aug '19

Hi! We'd like to make a change to the tox-docs job in order to better support the promote-based work using zuul artifacts. This means we'll be changing the underlying implementation to use fetch-sphinx-tarball instead of fetch-sphinx-output, and as a result, the flags: sphinx_output_suffix sphinx_output_src won't be honored. They aren't documented as parameters to the tox-docs job, but since they are used by fetch-sphinx-output it's technically possible that someone out there could be depending on them in a passthrough manner. https://review.opendev.org/#/c/676430/ We plan to merge the change Aug 28. Thanks! Monty

2 1

Zuul 3.10.1 released
by corvus＠inaugust.com 15 Aug '19

15 Aug '19

The Zuul team is pleased to announce the release of Zuul 3.10.1. Download it from PyPI: https://pypi.org/project/zuul The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/zuul/3.10.1/releasenotes.html#relnotes-3-10-1 Bug Fixes ========= * Fixed Zuul dashboard not loading properly due to javascript dependencies missing.

1 0

Zuul 3.10.0 released
by corvus＠inaugust.com 14 Aug '19

14 Aug '19

The Zuul team is pleased to announce the release of Zuul 3.10.0. Download it from PyPI: https://pypi.org/project/zuul The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/zuul/releasenotes.html#relnotes-3-10-0 Upgrade Notes ============= * If unprotected branches are excluded on a project they now also get filtered out from jobs. * The default value for the executor.job_dir configuration setting has been changed from /tmp to /var/lib/zuul/builds. It is important for executor.job_dir and executor.git_dir to be located on the same filesystem, so this change increases the chances that they end up on the same filesystem in most default configurations. * The builds subdirectory will be created if it does not exist, however, /var/lib/zuul at least must exist and be writable by the Zuul user. * Jobs with file matchers will now automatically match if the configuration of the job is changed. This means that the Zuul configuration file no longer needs to be included in the list of files to match in order for changes to job configuration to be self-testing. * To keep the old behavior, set job.match-on-config-updates to False. * As further integration with the web interface is planned, the web.root setting in zuul.conf is marked required and future releases may error if it is missing. Please add it to your configuration now. See tenant.web-root for additional information about whitelabel tenants. New Features ============ * Allow users to perform tenant-scoped, privileged actions either through zuul-web’s REST API or zuul’s client, based on the JWT standard. The users need a valid bearer token to perform such actions; the scope is set by matching conditions on tokens’ claims; these conditions can be defined in zuul’s tenant configuration file. Zuul supports token signing and validation using the HS256 or RS256 algorithms. External JWKS are also supported for token validation only. Current tenant-scoped actions are “autohold”, “enqueue” and “dequeue”. * Config projects may now add any job to any project’s pipelines, regardless of the setting of allowed-projets (including the implicit setting of allowed-projects on jobs with secrets in untrusted projects). * It is now possible to select the merge method GitHub uses to merge a Pull Request to the base branch. * A new option, tenant.untrusted-projects.<project>.extra-config-paths has been added to allow an admin to indicate that Zuul should load extra configuration data from a specific project in a tenant. This feature may be useful to allow a project that primarily holds shared jobs or roles to include additional in-repo configuration for its own testing (which may not be relevant to other users of the project). * The merge-mode squash-merge is now supported for Github. * The job.cleanup-run attribute has been added to enable a new cleanup phase to be performed after a job execution. * Support for the Pagure code review system has been added. * Pipelines may now indicate that they supercede other pipelines with the pipeline.supercedes attribute. When a change is enqueued in a pipeline which supercedes others, it will be removed from the other pipelines. For example, a gate pipeline may supercede a check pipeline so that test resources are not spent running near-duplicate jobs simultaneously. * An option to use the URL of the Zuul build page when reporting has been added. This fetaure requires that all the pipelines in the tenant have a SQL reporter configured, and at least one of tenant.web-root or web.root must be defined. See tenant.report-build-page.

2 1

Nodepool 3.8.0 released
by corvus＠inaugust.com 13 Aug '19

13 Aug '19

The Zuul team is pleased to announce the release of Nodepool 3.8.0. Download it from PyPI: https://pypi.org/project/nodepool The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/nodepool/releasenotes.html#relnotes-3-8-0 New Features ============ * The Kubernetes driver now supports optionally loading cluster admin service account information from the standard in-cluster configuration paths if Nodepool itself is running in Kubernetes. If this method is used, installation of a kube/config file in the Nodepool launcher pod is no longer required.

1 0

Deprecation notice for download-artifact role
by corvus＠inaugust.com 29 Jul '19

29 Jul '19

Hi, If you are using the download-artifact role, please note that we are deprecating one of its parameters. The parameter "download_artifact_name" is being replaced with "download_artifact_type". For more information, see: https://zuul-ci.org/docs/zuul-jobs/general-roles.html#role-download-artifact The "download_artifact_name" parameter will be removed on August 12. Thanks, Jim

1 0

zuul-base-jobs: Changing git connection
by Andreas Jaeger 15 Jul '19

15 Jul '19

We are deprecating the git.zuul-ci.org server, it redirects already to opendev.org. Thus, there's a change ready for zuul-base-jobs to switch to the new URL. This means that everybody using zuul-base jobs, needs to add a connection to "opendev.org" to their zuul config (if not already existing), otherwise your jobs will break. The change for this is: https://review.opendev.org/667813 I've marked the change as WIP, I'll un-WIP it after the 15th of July, Andreas -- Andreas Jaeger aj(a)suse.com Twitter: jaegerandi SUSE LINUX GmbH, Maxfeldstr. 5, 90409 Nürnberg, Germany GF: Felix Imendörffer, Mary Higgins, Sri Rasiah HRB 21284 (AG Nürnberg) GPG fingerprint = 93A3 365E CE47 B889 DF7F FED1 389A 563C C272 A126

1 1

Behavior change in tox-pep8 job
by corvus＠inaugust.com 10 Jul '19

10 Jul '19

Hi, We'd like to make a change to the tox-pep8 job in zuul-jobs. We recently noted that tox-pep8 jobs run the test-setup role (which executes a test-setup.sh script if it is found). This is typically used to set up external services or configuration needed to run unit tests. But since pep8 does not typically require this, the time is wasted. We added a flag to the test-setup role to allow a job to indicate that it should be skipped. The change at https://review.opendev.org/670133 will set that flag to "true" for the tox-pep8 job, meaning that, by default, tox-pep8 will no longer run the test setup script. We don't expect this to affect many (if any!) users, however, if it does affect you, you can set the "test_setup_skip" variable to true: https://zuul-ci.org/docs/zuul-jobs/general-roles.html#rolevar-test-setup.te… You can safely do that ahead of time. We plan to merge the change on July 25. Thanks, Jim

1 0

Zuul 3.9.0 released
by corvus＠inaugust.com 20 Jun '19

20 Jun '19

The Zuul team is pleased to announce the release of Zuul 3.9.0. Download it from PyPI: https://pypi.org/project/zuul The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/zuul/releasenotes.html#new-features New Features ============ * Zuul now supports ansible 2.8 for running jobs. * Zuul now supports project.<pipeline>.fail-fast to immediately report and cancel builds on the first failure in a buildset. * Zuul now reports resource usage statistics if they are provided by nodepool. * The following statistics are emitted: * zuul.nodepool.resources.tenant.{tenant}.{resource}: Gauge with the currently used resources by tenant and counter with the summed usage by tenant. e.g. cpu seconds * zuul.nodepool.resources.project.{project}.{resource}: Gauge with the currently used resources by project and counter with the summed usage by project. e.g. cpu seconds

1 0

Nodepool 3.7.0 released
by corvus＠inaugust.com 20 Jun '19

20 Jun '19

The Zuul team is pleased to announce the release of Nodepool 3.7.0. Download it from PyPI: https://pypi.org/project/nodepool The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/nodepool/releasenotes.html#relnotes-3-7-0 New Features ============ * A new driver is available to support unprivileged Openshift cluster as a resources provider to enable pod creation within a developper project. * Provider labels for the OpenStack driver are now able to toggle providers.[openstack].pools.labels.host-key-checking. This overrides the host-key-checking value defined by providers.[openstack].pools.host-key-checking. * Provider labels for the OpenStack driver are now able to select which networks to be attached to. This overrides any networks defined by providers.[openstack].pools.networks.

1 0

Zuul 3.8.1 Released
by corvus＠inaugust.com 13 May '19

13 May '19

The Zuul team is pleased to announce the release of Zuul 3.8.1. Download it from PyPI: https://pypi.org/project/zuul The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/zuul/releasenotes.html#relnotes-3-8-1 Bug Fixes ========= * Fixed a memory leak introduced in 3.8.0.

1 0

Nodepool 3.6.0 Released
by corvus＠inaugust.com 13 May '19

13 May '19

The Zuul team is pleased to announce the release of Nodepool 3.6.0. Download it from PyPI: https://pypi.org/project/nodepool The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/nodepool/releasenotes.html#relnotes-3-6-0 Upgrade Notes ============= * The TaskManager used by the OpenStack provider has been removed. The keystoneauth1 library underneath openstacksdk has grown support for rate limiting using a FairSemaphore instead of a pool of worker threads. This should reduce the overall thread count. * The diskimage-builder stats have been reworked to be more useful. The return code and duration is now stored in nodepool.dib_image-build.<diskimage_name>.status.<rc|duration>; previously this was split for each image format. This is unnecessary and confusing since the results will always be the same, since all formats are generated from the same diskimage-builder run. An additional gauge nodepool.dib_image_build.<diskimage_name>.status.last_build is added to make it easy to show relative time of builds in dashboards. * statsd key names have changed. Because of the removal of TaskManager statsd calls are being deferred to openstacksdk. Instead of keys of the form ComputeGetServers, the openstacksdk keys are of the form compute.GET.servers. They will always start with the normalized service-type, followed by the HTTP verb, followed by a . separated list of url segments. Any service version, project-id entries in the url or .json suffixes will be removed.

1 0

New release: 3.8.0. Users should upgrade now for a security fix
by Clark Boylan 16 Apr '19

16 Apr '19

Hello, The Zuul Maintainers have released version 3.8.0. This new release includes a security fix and users should upgrade. Paul Belanger discovered that from version 3.1.0 to 3.7.1 it was possible for Zuul to load and use a config (trusted) layout change in a dynamic pre-merge context. Specifically, if Zuul is running with config errors then a logic error in loading new configs allowed changes to a config (trusted) repo to be loaded as a dynamic config. Users should update to 3.8.0 now to correct this issue. Other updates include Zuul returning FAILURE rather than SKIPPED when a job fails to have its requirements met and artifacts returned by parent jobs are now available to child jobs in the same buildset. For more information please refer to the release notes: https://zuul-ci.org/docs/zuul/releasenotes.html#relnotes-3-8-0 Thank you for flying Zuul and for your patience, Clark on behalf of the Zuul Maintainers

1 0

Zuul 3.7.1 released
by corvus＠inaugust.com 25 Mar '19

25 Mar '19

The Zuul team is pleased to announce the release of Zuul 3.7.1. Download it from PyPI: https://pypi.org/project/zuul The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/zuul/releasenotes.html#relnotes-3-7-1 Bug Fixes ========= * When using Ansible 2.7 the uri module crashed with a module failure. * The scheduler.default_ansible_version has been ignored.

1 0

Zuul 3.7.0 released
by corvus＠inaugust.com 21 Mar '19

21 Mar '19

The Zuul team is pleased to announce the release of Zuul 3.7.0. Download it from PyPI: https://pypi.org/project/zuul The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/zuul/releasenotes.html#relnotes-3-7-0 Upgrade Notes ============= * The default ansible version is now 2.7. In case this breaks any jobs this can be overridden in job.ansible-version, tenant.default-ansible-version or scheduler.default_ansible_version * In order to support several ansible versions installed simultaneously Zuul now handles them itself in virtual environments. By default Zuul installs the needed ansible versions on startup so there is no further user action required. However it is recommended to pre-install the ansible environments during installation by invoking zuul-manage-ansible. * The user value in the [fingergw] configuration section previously defaulted to zuul, but now is unset by default, which will cause fingergw not to drop privileges. It is recommended that this value be explicitly set to an unprivileged user. * The hosts value in the [zookeeper] configuration section previously defaulted to localhost:2181, but now is unset by default. This value is required and must be explicitly set (and the documentation has always indicated this). New Features ============ * Jobs may now specify which ansible version is used to run them. The ansible version to use can now be specified by job.ansible-version. * Zuul now supports ansible 2.6 for running jobs. * Zuul now supports ansible 2.7 for running jobs. * The ansible_python_interpreter variable is now whitelisted for the add_host task.

1 0

Zuul not blocking local execution of raw Ansible module
by Tobias.Henkel＠bmw.de 11 Mar '19

11 Mar '19

Dear zuul operators, I discovered that we don't check the raw Ansible module for delegation to localhost. We do not believe this would have given jobs access to the executor host as every job is sandboxed within a bubblewrap container with minimal access to the filesystem and other resources. Further information can be found in StoryBoard: https://storyboard.openstack.org/#!/story/2005037 This is fixed by https://review.openstack.org/642518 which has been included in Zuul version 3.6.1. It is strongly advised to update to 3.6.1 or latest master and restart any running zuul-executor processes. Sorry for any inconveniences Kind regards Tobias

1 0

Nodepool 3.5.0 released
by corvus＠inaugust.com 09 Mar '19

09 Mar '19

The Zuul team is pleased to announce the release of Nodepool 3.5.0. Download it from PyPI: https://pypi.org/project/nodepool The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/nodepool/releasenotes.html#relnotes-3-5-0 New Features ============ * The new Amazon Web Services (AWS) EC2 Driver allows launching EC2 instances as nodes. * A new option (build-timeout) has been added to the builder diskimage configuration to control how long the builder should wait for image builds before giving up. The default is 8 hours. * A new driver is available to support Openshift cluster as a resources provider to enable project and pod request. Known Issues ============ * The AWS driver does not support quota management at this time. * The AWS driver does not support custom image building.

1 0

Zuul 3.6.0 released
by corvus＠inaugust.com 09 Mar '19

09 Mar '19

The Zuul team is pleased to announce the release of Zuul 3.6.0. Download it from PyPI: https://pypi.org/project/zuul The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/zuul/releasenotes.html#relnotes-3-6-0 Upgrade Notes ============= * Service Workers are now disabled by default in the Javascript dashboard. Deployers who wish to enable them need to set REACT_APP_ENABLE_SERVICE_WORKER * Zuul recently added the job variable zuul.message. This can contain jinja tags which can cause problems accessing the zuul variable in the job. Because of this the message is now base64 encoded and any job evaluating this variable needs to be changed from {{ zuul.message }} to {{ zuul.message | b64decode }}. New Features ============ * Artifacts may now include a metadata field for storing arbitrary metadata about the artifacts in the SQL database. * The job.run attribute now supports a single or list of playbooks. * Support for expressing artifact or other resource dependencies between jobs running on different changes with a dependency relationship (e.g., a container image built in one project and consumed in a second project) has been added via the job.provides and job.requires job attributes. * The job.dependencies attribute may now be used to express “soft” dependencies – that is, to indicate a job should run after another completes, but only if it runs at all. For example, a deployment job which should always run, but depends on a build job which only runs if the source code is changed.

1 0

Potential disclosure of secrets defined in untrusted projects
by corvus＠inaugust.com 23 Jan '19

23 Jan '19

A potential vector for exposure or unauthorized use of secrets was recently discovered. The vulnerability is removed in version 3.5.0 and affects all versions after 3.0.0 and prior to 3.5.0. The vulnerability only applies in very specific circumstances; if these apply to you, it is recommended to upgrade immediately and consider auditing and replacing affected secrets. It may have been possible to expose a secret, or use resources protected by a secret, if a job using a secret was defined in an untrusted project on a system with an independent pre-merge post-review pipeline -- that is, a pipeline with post-review set to true, manager set to independent, and which operated on changes before they merged -- and that job relied on the allowed-projects attribute to restrict access to it. An example of such a pipeline is a "restricted check" pipeline, where reviewers may trigger builds after core reviewers with additional permissions leave a vote or label. To take advantage of the vulnerability, a user would have to create (but not cause to be merged) a change in the target repository which removed the allowed-projects access restriction, and then create a change in a repository they control which used the "Depends-On" feature to depend on the change in the target repository, and then cause that change to be enqueued in an independent pre-merge post-review pipeline. To prevent disclosure or use in this situation, allowed-projects is now automatically set to the current project when a secret is used in a job defined in an untrusted project, and it can not be overridden.

1 0

Zuul 3.5.0 released
by corvus＠inaugust.com 23 Jan '19

23 Jan '19

The Zuul team is pleased to announce the release of Zuul 3.5.0. Download it from PyPI: https://pypi.org/project/zuul The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/zuul/releasenotes.html#relnotes-3-5-0 Security Issues =============== * Jobs with secrets in untrusted projects now automatically set allowed-projects. It is possible to circumvent the use of allowed-projects in untrusted projects by creating a change which Depends-On a change which alters a project definition. This behavior may be unexpected, so documentation has been updated with warnings to avoid relying on it in sensitive cases. It may have been possible to expose a secret, or use resources protected by a secret, if a job using a secret was defined in an untrusted project on a system with an independent pre-merge post-review pipeline – that is, a pipeline with post-review set to true, manager set to independent, and which operated on changes before they merged. To prevent disclosure or use in this situation, allowed-projects is now automatically set to the current project when a secret is used in a job defined in an untrusted project, and it can not be overridden. Upgrade Notes ============= * The zuul_return module has been converted to an Ansible action plugin. Job playbooks no longer need to use delegate_to or a localhost only play with this module as action plugin by default run on localhost. New Features ============ * The executor.min_avail_mem setting now takes cgroup limits into account. There is also a new metric zuul.executor.<executor>.pct_used_ram_cgroup available. * The job.secrets.pass-to-parent attribute has been added to allow secrets to be made available to playbooks in parent jobs (for example, to allow for jobs which are designed to use secrets, but leave it to child jobs to actually supply them). See also the Secret documentation. * The restriction on using known_hosts in playbooks has been lifted. * The executors emit a new timer zuul.executor.<executor>.starting_builds with the time jobs spent during starting. Bug Fixes ========= * Untrusted playbooks no longer see ‘Adding hosts ssh with ansible_user to the inventory is prohibited’ when using the add_host Ansible task on localhost. * Fixed an issue where a trailing slash on the baseurl of a git driver connection config could cause an indefinite job hang.

1 0

Nodepool 3.4.0 released
by corvus＠inaugust.com 16 Jan '19

16 Jan '19

The Zuul team is pleased to announce the release of Nodepool 3.4.0. Download it from PyPI: https://pypi.org/project/nodepool The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/nodepool/releasenotes.html#relnotes-3-4-0 Upgrade Notes ============= * A change to the ZooKeeper schema to support a new DELETED node state will require a total shutdown of all Nodepool launchers before restarting any of them with this version. New Features ============ * A new configuration option is available under the ‘pools’ attribute of an OpenStack provider. This config value, ‘node-attributes’, can contain a dictionary of arbitrary key-value pairs and will be stored with the node data within ZooKeeper. Bug Fixes ========= * Fixes a regression of missing task statistics with OpenstackSDK versions greater than 0.19.0.

1 0

Zuul 3.4.0 released
by corvus＠inaugust.com 11 Jan '19

11 Jan '19

The Zuul team is pleased to announce the release of Zuul 3.4.0. Download it from PyPI: https://pypi.org/project/zuul The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/zuul/releasenotes.html#relnotes-3-4-0 Upgrade Notes ============= * The zuul-web service now requires access to ZooKeeper, as a result you may need to update your firewall allow access from the service. Additionally, zuul.conf should now contain a zookeeper configuration section. * The zuul.nodepool statistics have been moved under zuul.nodepool.requests to allow sub-stats to work correctly. For example zuul.nodepool.requested has become zuul.nodepool.requests.requested.total. The previously missing label and size counters are now available at zuul.nodepool.requests.<state>.<size|label>. For more info see the monitoring documentation. New Features ============ * Jobs may now return artifact URLs and they will be stored in the SQL database (if configured). See Returning artifact URLs for usage. * One or more zuul executors can now be added to a executor.zone. This is helpful if a cloud does not have any public IP addresses for nodepool nodes. Now you’ll be able to have a zuul executor on the same private network as your nodepool nodes. * The Ansible inventory file now includes nodepool.host_id variable if the node was launched using the OpenStack Nodepool driver. * A new scheduler option, scheduler.relative_priority, can be used to instruct Nodepool to fulfull requests from less-busy projects more quickly.

1 0

Heads up that build-puppet-role role will change behavior
by Tobias Urdin 11 Jan '19

11 Jan '19

Hello, The openstack-infra/zuul-jobs repo will be updated by [1] causing the "build-puppet-module" role to stop using the "puppet module build" command and instead use the PDK (Puppet Development Kit) gem to build the modules. The only change is that there will be no folder created in the pkg folder inside your module but only the actual tarball, the naming and location of the tarball (in the "pkg" folder) is still the same. There will be a grace period until [1] is merged, if you require a version folder of your module being created in the pkg folder you must do this manually or revert to using the "puppet module build" command which is deprecated and will be removed in a future release of Puppet. Best regards Tobias [1] https://review.openstack.org/#/c/627534

1 0

Zuul 3.3.1 released
by corvus＠inaugust.com 29 Nov '18

29 Nov '18

The Zuul team is pleased to announce the release of Zuul 3.3.1. Download it from PyPI: https://pypi.org/project/zuul The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/zuul/releasenotes.html#relnotes-3-3-1 Security Issues =============== * The add_host module options are restricted to a hostname, port, user and password. Previously, malicious options could be used to bypass protection and execute tasks on the executor. Only ssh and kubectl connection are authorized. Upgrade Notes ============= * The acquiring behavior of jobs with semaphores has been changed. Up to now a job requested resources and aquired the semaphore just before it started to run. However this could lead to a high amount of resource waste. Instead jobs now acquire the semaphore before requesting the resources by default. This behavior can be overridden by jobs using job.semaphore.resources-first if some waste of resources is acceptable. New Features ============ * New tenant options tenant.allowed-triggers and tenant.allowed-reporters can be used to restrict what connections a tenant has access to. * A new tenant option tenant.allowed-labels can be used to restrict what labels a tenant has access to. * A job using a semaphore now can configure if it should acquire the it before requesting resources or just before running.

1 0

Untrusted playbook task execution on executors
by Monty Taylor 29 Nov '18

29 Nov '18

Dear Zuul operators, The change to allow the use of add_host in untrusted playbooks, which was included in Zuul version 3.3.0, inadvertently opened the door for an user to abuse the ssh_executable parameter to cause a command to be run on the executor. We do not believe this would have given jobs access to the executor host as every job is sandboxed within a bubblewrap container with minimal access to the filesystem and other resources. Further information can be found in StoryBoard: https://storyboard.openstack.org/#!/story/2004405 This is fixed by https://review.openstack.org/620635 which has been included in Zuul version 3.3.1. It is strongly advised to update to 3.3.1 or latest master and restart any running zuul-executor processes. Sorry for any inconveniences. Thanks! Monty

1 0

Nodepool 3.3.1 released
by corvus＠inaugust.com 03 Nov '18

03 Nov '18

The Zuul team is pleased to announce the release of Nodepool 3.3.1. Download it from PyPI: https://pypi.org/project/nodepool/ The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/nodepool/releasenotes.html#relnotes-3-3-1 Bug Fixes ========= * The nodes by label and state statistic gauges are now correctly reset to zero if no node of a label and state exists. * Task names are now consistently normalised to CamelCase without deliminators. Some statistics sent to statsd with - or _ characters will have changed keys, for example ComputePostOs-volumes_boot is now ComputePostOsVolumesBoot.

1 0

Zuul 3.3.0 released
by corvus＠inaugust.com 03 Nov '18

03 Nov '18

The Zuul team is pleased to announce the release of Zuul 3.3.0. Download it from PyPI: https://pypi.org/project/zuul/ The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/zuul/releasenotes.html#relnotes-3-3-0 New Features ============ * A local project key file URI (eg. file:///path/to/key.pub) is now supported by the encrypt_secret.py tool. This allows encrypting secrets without directly accessing the Zuul web API to retrieve the project key. * Zuul now supports triggering a full reconfiguration by using the command zuul-scheduler full-reconfigure. * The Gerrit driver can now (optionally) report via HTTP instead of SSH. In the future, this will be used to report file and line comments (the SSH API only supports review messages). * Zuul now supports leaving file comments, though currently only when using the Gerrit driver. See the documentation for zuul_return for details. * A job now can pause itself using Return Values and let the child jobs run until they are finished. This can be used to serve some service which can be used by the child jobs. * An SSH keypair is now generated for every project and may be used in post-review jobs to access systems which trust that project. * GitHub <github connection>.rate_limit_logging now can be configured. If disabled this can save some network round trip times. This can be configured per connection. * The Zuul web dashboard has been rewritten in React. * The restriction on using add_host in playbooks has been lifted. * A new Build page in the web interface enable displaying a single Build information. * A new Notification Drawer and a ConfigErrors page in the web interface enable displaying the config-errors endpoint data. * A new Job page in the web interface enable browsing through job configuration. * Client certificate locations to be used by winrm connections can be configured now. Upgrade Notes ============= * The Zuul web dashboard is now a single index.html and static offload server needs new rewrite rules. Check the install instruction for backward compatible rewrite rules. Note that serving the web dashboard from a sub-directory requires the application to be rebuilt using the desired homepage location. Deprecation Notes ================= * Signal based triggering of a full reconfiguration via sending SIGHUP to the zuul-scheduler PID is deprecated. Use the command zuul-scheduler full-reconfigure now.

1 0

zuul-jobs: Deprecation of the "emit-ara-html" role in favor of "ara-report"
by David Moreau Simard 14 Oct '18

14 Oct '18

Hello, The "emit-ara-html" [1] role, typically part of Zuul base jobs, has been used to generate ARA [2] static HTML Ansible reports. These files end up being stored as part of the logs of a job in the "ara" directory. This role has been superseded by "ara-report" [3] which provides the same functionality and defaults out of the box. This new role adds support for saving raw databases and is meant to be compatible with the use of the ARA sqlite WSGI middleware. This new middleware implementation may be of particular interest for Zuul operators since it translates to improved job performance and reduced storage overhead. For reference, the OpenStack Infrastructure implementation can be found here [4]. The announcement to openstack-dev can be found here [5] for additional details and context. Please refer to the ARA documentation for more details [6]. Feel free to reply to this thread or reach out to us in #zuul if you have any questions! [1]: https://git.zuul-ci.org/cgit/zuul-jobs/tree/roles/emit-ara-html [2]: https://github.com/openstack/ara [3]: https://git.zuul-ci.org/cgit/zuul-jobs/tree/roles/ara-report/README.rst [4]: https://review.openstack.org/#/q/project:openstack-infra/puppet-openstackci… [5]: http://lists.openstack.org/pipermail/openstack-dev/2018-March/128902.html [6]: https://ara.readthedocs.io/en/latest/advanced.html David Moreau Simard Senior Software Engineer | OpenStack RDO dmsimard = [irc, github, twitter]

1 1

OpenStack Community Meeting - October 10 - Strategic Area Governance Update
by Chris Hoge 05 Oct '18

05 Oct '18

Following the interest in the first OpenStack Foundation community meeting, where we discussed the OpenStack Rocky release as well as quick updates from Kata, Airship, StarlingX and Zuul, we want to keep the community meetings going. The second community meeting will be October 10 at 8:00 PT / 15:00 UTC, and the agenda is for Jonathan Bryce and Thierry Carrez to share the latest plans for strategic project governance at the Foundation. These updates will include the process for creating new Strategic Focus Areas, and the lifecycle of new Foundation supported projects. We will have an opportunity to share feedback as well as a question and answer session at the end of the presentation. For a little context about the proposed plan for strategic project governance, you can read Jonathan’s email to the Foundation mailing list: http://lists.openstack.org/pipermail/foundation/2018-August/002617.html This meeting will be recorded and made publicly available. This is part of our plan to introduce bi-weekly OpenStack Foundation community meetings that will cover topics like Foundation strategic area updates, project demonstrations, and other community efforts. We expect the next meeting to take place October 24 and focus on the anticipated StarlingX release. Do you have something you'd like to discuss or share with the community? Please share them with me so that I can schedule them for future meetings. OpenStack Community Meeting - Strategic Area Governance Update Date & Time: October 10, 8:00 PT / 15:00 UTC Zoom Meeting Link: https://zoom.us/j/312447172 Agenda: https://etherpad.openstack.org/p/openstack-community-meeting Thanks! Chris Hoge Strategic Program Manager OpenStack Foundation

1 0

zuul-jobs : Removal of readthedocs playbook
by Ian Wienand 09 Aug '18

09 Aug '18

Hello, The zuul-jobs:playbooks/python/readthedocs.yaml playbook is scheduled for removal [1] in two weeks on or about 27th August, 2018 (per the deprecation policy [2]). This playbook was used to trigger documentation builds on the readthedocs.org service. The playbook uses an API endpoint that is no longer available [3]. The trigger-readthedocs role is provided for anyone wishing to migrate to the authenticated API endpoint [4]. For more details, see [5]. Thanks, -i [1] https://review.openstack.org/#/c/583836/ [2] https://docs.openstack.org/infra/zuul-jobs/deprecation.html [3] https://github.com/rtfd/readthedocs.org/commit/a66bd56bada66f99c778aa424042… [4] https://zuul-ci.org/docs/zuul-jobs/roles.html#role-trigger-readthedocs [5] http://lists.openstack.org/pipermail/openstack-dev/2018-August/132836.html

1 0

Zuul 3.2.0 released
by corvus＠inaugust.com 08 Aug '18

08 Aug '18

The Zuul team is pleased to announce the release of Zuul 3.2.0. Download it from PyPI: https://pypi.org/project/zuul/ The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/zuul/releasenotes.html#relnotes-3-2-0 New Features ============ * Zuul client got a new command ‘tenant-conf-check’. This command validates the schema of the tenant configuration and exits -1 if errors have been detected. * A new Ansible inventory variable zuul.child_jobs which is a list of the first level child jobs to be run after a job has finished successfully. * Jobs are now able to use the job.extra-vars which will use the --extra-vars flag when a job runs. * Project and project-templates may now create variables via a vars configuration entry. Jobs can access these at runtime in the same manner as job variables. * The supercedent pipeline manager has been added. It is designed to make post-merge artifact build pipelines more efficient. * The dequeue command has been added to the Zuul CLI. It allows operators to stop a given buildset at will. * It is now possible to use zuul_return to skip child jobs. You can use the zuul.child_jobs inventory variable to get a list of child jobs configured to run, then use zuul_return to modify the list. Any child job not in zuul_return zuul.child_jobs will be skipped. See Return Values for examples. Bug Fixes ========= * Project Templates are now branch-aware and behave more like project stanzas. If a template is defined on a branch, it will only apply to changes to that branch. * The timer trigger does not enqueue an event for every branch of every project anymore and it now only processes projects actually using the pipeline triggered by a timer.

1 0

Nodepool 3.2.0 released
by corvus＠inaugust.com 26 Jul '18

26 Jul '18

The Zuul team is pleased to announce the release of Nodepool 3.2.0. Download it from PyPI: https://pypi.org/project/nodepool/ The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/nodepool/releasenotes.html#in-development Upgrade Notes ============= * A new node status (ABORTED) is added to the ZooKeeper data model. It is recommended that, during your nodepool upgrade, you shut down all launcher processes before restarting any of them. Running multiple launchers with mixed support of this new node status may cause unexpected errors to be reported in the logs. New Features ============ * A new boolean pool variable ignore-provider-quota has been added to allow the provider quota to be ignored for a pool. Instead, nodepool only checks against the configured max values for the pool and the current usage based on stored data. This may be useful in circumstances where the provider is incorrectly calculating quota. * The detailed nodepool list outputs the node’s pool. * Diskimages env-vars can be set in the secure.conf file. Bug Fixes ========= * For pre-existing cloud images (not managed by nodepool), referencing them by ID was failing since they could not be found with this data, only by name.

1 0

Deprecation: zuul-info/inventory.yaml creation moved from validate-host to log-inventory role (v2)
by Ian Wienand 02 Jul '18

02 Jul '18

Hello (again), This is a follow-up to a prior mail http://lists.zuul-ci.org/pipermail/zuul-discuss/2018-June/000446.html --- The "validate-host" role [1] currently creates the "inventory.yaml" [2] file, which contains the ansible inventory information for the job. For some history, the role was originally called "debug-ansible" but renamed to "validate-host". Since it collects other ansible information, saving the inventory was added to the role shortly after the rename. As copying this inventory information requires access to the executor context, it must be run as a privileged job. However, the role also includes quite a number of other operations that do not have similar requirements. Due to not currently having an automated CI testing framework for privileged jobs, this leaves changes to these unrelated parts (like [3]) with insufficient testing coverage. The creation of the inventory file has been moved into a separate role "log-inventory" [4]. We now wish to remove the inventory creation from the "validate-host" role [5]. This will lower the surface-area of privileged jobs and also enable more straight-forward testing of the rest of the "validate-host" role [6]. For the OpenStack ecosystem, the new role will be added to the base job [7] so this should be entirely transparent. If you build your own base templates you will need to add the "log-inventory" role to continue collecting the inventory.yaml. You can do this *now*, and thus be unaffected when the creation is removed from "validate-host", with one caveat: Note that testing uncovered an issue with the original role -- the "inventory_file" variable is not set by Ansible for localhost only jobs. Thus "log-inventory" will not break any jobs where "validate-host" was working, but you should be careful not to additionally introduce it into localhost (that is to say, executor-only) jobs without considering this. Longer term, the issue has been fixed and "log-inventory" is safe to use in all contexts. A separate variable for the inventory file has been added to the executor context with [8] and is now conditionally used in "log-inventory" with [9] (thus if you are using zuul from master, you are unaffected). Per the deprecation policy for requiring new zuul features [10], this new variable will be used unconditionally to copy the file with [11] around 4 weeks after the next zuul release. Taking into consideration: * reviews posted for several weeks * pending debugging of gate issues with "validate-host" * the informational/debugging nature of the output * the relative ease of adding the new role to maintain the status quo * interaction with current users of the roles I would suggest we merge [7] - addition of "log-inventory" to base jobs in project-config [5] - removal of inventory copy from "validate-host" To complete the initial part of this transition. Thank you -i [1] https://git.openstack.org/cgit/openstack-infra/zuul-jobs/tree/roles/validat… [2] see any job results zuul-info/inventory.yaml [3] https://review.openstack.org/576351 [4] https://git.openstack.org/cgit/openstack-infra/zuul-jobs/tree/roles/log-inv… [5] https://review.openstack.org/563790 [6] https://review.openstack.org/563788 [7] https://review.openstack.org/563789 [8] https://review.openstack.org/578235 [9] https://review.openstack.org/578234 [10] https://zuul-ci.org/docs/zuul-jobs/deprecation.html [11] https://review.openstack.org/578238

1 0

Nodepool 3.1.0 released
by corvus＠inaugust.com 30 Jun '18

30 Jun '18

The Zuul team is pleased to announce the release of Nodepool 3.1.0. Download it from PyPI: https://pypi.org/project/nodepool/ The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/nodepool/releasenotes.html#relnotes-3-1-0 Upgrade Notes ============= * Nodepool can now support multiple node labels, although the OpenStack and static node drivers do not yet support specifying multiple labels, so this is not yet a user-visible change. This does, however, require shutting down all launcher processes before restarting them. Running multiple launchers with mixed support of multi-label will cause errors, so a full shutdown is required. New Features ============ * Nodepool now defaults to building qcow2 diskimages instead of failing if the diskimage doesn’t specify an image format and the diskimage isn’t used by any provider. This makes it more convenient to build images without uploading them to a cloud provider. * Added support for specifying security-groups for the nodes in openstack driver. Pool.security-groups takes list of SGs to attach to the server. * The static driver now pre-registers its nodes with ZooKeeper at startup and on configuration changes. A single node may be registered multiple times, based on the value of max-parallel-jobs. Bug Fixes ========= * Fixed a bug where if a request handler is paused and an exception is thrown within the handler, the handler was not properly unpaused and the request remained in the list of active handlers.

1 0

Unintended variable disclosure on Ansible unreachable tasks despite no_log
by Tobias.Henkel＠bmw.de 19 Jun '18

19 Jun '18

Dear Zuul operators, We discovered that if nodes become offline during the build the no_log attribute of a task got ignored. If the unreachable error occurred in a task used with a loop variable (ex: with_items), the contents of the loop items would be printed in the console. This could lead to accidentally leaking credentials or secrets. We have reported this issue to the Ansible project and the CVE-2018-10855 [1] was assigned to the bug. Further information can be found in StoryBoard: https://storyboard.openstack.org/#!/story/2002177 In Zuul, This is fixed by https://review.openstack.org/574788 which is included in version 3.1.0. It is strongly adviced to update to latest master and restart any running zuul-executor processes. We have audited zuul-jobs and have not found an instance where a sensitive variable like a secret would have been used in a loop. In Ansible, users are encouraged to update to the latest supported dot releases as soon as possible. The fix for Ansible [2] is available in 2.5.5 (released June 14th) and 2.4.5rc1. Sorry for any inconveniences. Kind regards Tobias [1]: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10855 [2]: https://github.com/ansible/ansible/pull/41414/files -- BMW Car IT GmbH Tobias Henkel Software engineer Moosacher Straße 86 80809 München Tel.: +49 89 189311-48 Fax: +49 89 189311-20 Mail: tobias.henkel(a)bmw.de<mailto:tobias.henkel@bmw.de> Web: http://www.bmw-carit.de<http://www.bmw-carit.de/> ----------------------------------------------------------------------------- BMW Car IT GmbH Geschäftsführer: Kai-Uwe Balszuweit und Christian Salzmann Sitz und Registergericht: München HRB 134810 -----------------------------------------------------------------------------

2 1

Zuul 3.1.0 released
by corvus＠inaugust.com 16 Jun '18

16 Jun '18

The Zuul team is pleased to announce the release of Zuul 3.1.0. Download it from PyPI: https://pypi.org/project/zuul/ The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/zuul/releasenotes.html#relnotes-3-1-0 New Features ============ * Zuul now uses Ansible 2.5. * The GitHub driver can determine the required status checks of pull requests which are needed for entering a gate pipeline. This eliminates the need to hard code required status checks in the gate pipeline and makes interoperation with other GitHub apps much more flexible. * Zuul is now ables to start with an invalid configuration. When reading configuration files from project repositories, if an issue is detected, Zuul will store the issue and skip the broken block of configuration. Issues are then reported in the scheduler log at the end of the configuration phase. * A mqtt connection driver is added to feature build report over MQTT message. * Files (and irrelevant-files) matchers are now overridable. Zuul now uses only branch matchers to collect job variants. Once those variants are collected, they are combined, and the files and irrelevant-files attributes are inherited and overridden as any other job attribute. The final values are used to determine whether the job should ultimately run. * The GitHub driver now supports the pipeline.require.<github source>.merged requirement. * The json log contains now also the role name and the uuid similar to the task entry. Bug Fixes ========= * Untrusted playbooks no longer see ‘Executing local code is prohibited’ when using the zuul_return Ansible task.

1 0

Zuul 3.0.3 released
by corvus＠inaugust.com 12 May '18

12 May '18

The Zuul team is pleased to announce the release of Zuul 3.0.3. Download it from PyPI: https://pypi.org/project/zuul/ The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/zuul/releasenotes.html#relnotes-3-0-3 Release Notes ============= New Features * The project.default-branch option is now documented. It has been supported since version 3.0.0, but was omitted from the documentation. * Project stanzas now support regex matching of project.name. This can be used to apply project pipelines to many projects at once. Deprecation Notes * The merge-mode and default-branch attributes may no longer appear in a Project Template stanza. Bug Fixes * Configuration loading for dynamic configuration changes (i.e., changes to zuul.yaml files) is now significantly more CPU and memory efficient, incurring only a slight penalty compared to normal changes.

1 0

Nodepool 3.0.1 released
by corvus＠inaugust.com 05 May '18

05 May '18

The Zuul team is pleased to announce the release of Nodepool 3.0.1. Download it from PyPI: https://pypi.org/project/nodepool/ The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/nodepool/releasenotes.html#relnotes-3-0-1 Release Notes ============= New Features * The connection port can now be configured in the provider diskimages section. * Added support for configuring windows static nodes. A static node can now define a connection-type. The ssh-port option has been renamed to connection-port. Deprecation Notes * ssh-port in static node config is deprecated. Please update config to use connection-port instead.

1 0

Zuul 3.0.2 released
by corvus＠inaugust.com 28 Apr '18

28 Apr '18

The Zuul team is pleased to announce the release of Zuul 3.0.2. Download it from PyPI: https://pypi.org/project/zuul/ The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/zuul/releasenotes.html#relnotes-3-0-2 There is one additional item which did not make it into the release notes included with the release: * The ``fb-re2`` python library is added as a dependency; this may required the installation of the ``re2`` library and header file in order to build. Release Notes ============= New Features * The GitHub trigger status filter status and pipeline requirements pipeline.require.<github source>.status now support regular expression matching. Bug Fixes * Story 2001441 is fixed. Failure by one Zuul reporter will not short circuit the reporting of other reporters. This ensures as much information as possible is reported for each change even if some failures occur. Note that the build set status is changed to 'ERROR' after the first failed reporter. * The zuul-changes.py script has been adapted to the new zuul-web api routes.

1 0

Breaking change notice: sphinx role will soon default to enabling the '-W' flag
by Stephen Finucane 26 Apr '18

26 Apr '18

An upcoming change [1] will update 'roles/sphinx' in zuul-jobs to default to enabling the '-W' flag for 'sphinx-build'. Previously this setting was read from the '[build_sphinx] warning-is-error' setting in 'setup.cfg' if present and default to 'False' if not. With this change, we will default to 'True' if '[build_sphinx]' is undefined. This will affect all jobs based on this role, including 'build-sphinx- docs' and 'build-reno-releasenotes', and cause these jobs to fail if the relevant documentation is emitting warnings. Please ensure these warnings are resolved or specifically configure 'sphinx_warning_is_error' to 'false' in your playbooks and jobs if you wish to retain the legacy behaviour. Regards, Stephen [1] https://review.openstack.org/#/c/559348/

1 0

Zuul 3.0.1 released
by corvus＠inaugust.com 13 Apr '18

13 Apr '18

The Zuul team is pleased to announce the release of Zuul 3.0.1. Download it from PyPI: https://pypi.org/project/zuul/ The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/zuul/releasenotes.html#id1 Release Notes ============= New Features * Git repositories will have a origin remote with refs pointing to the previous change in the speculative state. This allows jobs to determine the commits that are part of a change, which was not possible before. The remote URL is set to a bogus value which won’t work with git commands that need to talk to the remote repository. * PostgreSQL is now officially supported as database backend. See <sql connection> on how to configure database connections. * A new option for the scheduler scheduler.tenant_config_script can be used to tell Zuul to execute a script and read its yaml output as the tenants configuration. The option is exclusive with the scheduler.tenant_config option. Upgrade Notes * The alembic version table is fixed to being prefixed too. This is necessary when using <sql connection>.table_prefix. However if you are already using table_prefix you will need to rename the table alembic_version to <prefix>alembic_version before starting Zuul. Otherwise zuul will try to create the tables again and fail. If you’re not using table_prefix you can safely ignore this. Bug Fixes * Zuul role repository checkouts now honor job.override-checkout. Previously, when a Zuul role was specified for a job, Zuul would usually checkout the master branch, unless that repository appeared in the dependency chain for a patch. It will now follow the usual procedure for determining the branch to check out, including honoring job.override-checkout options. This may alter the behavior of currently existing jobs. Depending on circumstances, you may need to set job.override-checkout or copy roles to other branches of projects.

1 0

Deprecation notice: Remove support for extensions as lists in zuul-jobs/roles/stage-output - change https://review.openstack.org/540890
by Andreas Jaeger 11 Apr '18

11 Apr '18

Andrea Frittoli has updated roles/stage-output in zuul-jobs to handle dicts instead of lists for extensions - and updated all usage in OpenStack itself. His review https://review.openstack.org/540890 removes now handling of lists. Please check that none of your playbooks and jobs uses extensions with stage-output and update them. I put a WIP on the change and will remove it in two weeks so that we can merge, please update your files as needed and feel free to review the change, Andreas -- Andreas Jaeger aj(a){suse.com,opensuse.org} Twitter: jaegerandi SUSE LINUX GmbH, Maxfeldstr. 5, 90409 Nürnberg, Germany GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg) GPG fingerprint = 93A3 365E CE47 B889 DF7F FED1 389A 563C C272 A126

1 0

Zuul 3.0.0 released
by corvus＠inaugust.com 29 Mar '18

29 Mar '18

I'm very pleased to announce that Zuul version 3.0.0 has been released! Zuul v3 is a major accomplishment that is the result of years of work and experience on some of the largest and fastest-paced Open-Source software projects. Zuul was developed for the OpenStack project, but is now being used by many other organizations, and this release reflects that change in focus. Zuul v3 is a significant change from previous versions. In short, it is a fully-featured system for project gating, continuous integration, and deployment. Features include: * Support for testing and gating Gerrit and GitHub projects * Jobs are written in Ansible, making integration of testing and production deployments easy * Pluggable providers for Nodepool; jobs can run on pre-existing static nodes or OpenStack clouds * Live testing of job configuration changes * Cross-project and cross-source testing with dependencies Thanks to the many contributors from all over the world who have worked very hard to improve Zuul. You can find more information about Zuul at https://zuul-ci.org/ Over the next weeks, you can expect us to continue to refine the website and documentation for new users, as well as produce new releases frequently as we improve Zuul. Thanks, James Blair, on behalf of the Zuul team

1 0

Zuul not blocking local execution of some Ansible modules
by Tobias.Henkel＠bmw.de 23 Mar '18

23 Mar '18

Dear zuul operators, I discovered that we don't check some Ansible modules for delegation to localhost. This would make it possible to overwrite any data which is writable within the bwrap context. Further the script module allows arbitrary code execution when delegated to localhost. This could also make it theoretically possible to escape out of the bubblewrap context using further kernel vulnerabilities. This is fixed by https://review.openstack.org/555435 and it is strongly advised to update asap to latest master and restart any running zuul-executor processes. Sorry for any inconveniences Kind regards Tobias -- BMW Car IT GmbH Tobias Henkel Spezialist Entwicklung Moosacher Straße 86 80809 München Tel.: +49 89 189311-48 Fax: +49 89 189311-20 Mail: tobias.henkel(a)bmw.de<mailto:tobias.henkel@bmw.de> Web: http://www.bmw-carit.de<http://www.bmw-carit.de/> ----------------------------------------------------------------------------- BMW Car IT GmbH Geschäftsführer: Kai-Uwe Balszuweit und Christian Salzmann Sitz und Registergericht: München HRB 134810 -----------------------------------------------------------------------------

1 0

Zuul speculative Ansible plugin injection
by Tobias.Henkel＠bmw.de 16 Mar '18

16 Mar '18

Dear zuul operators, Simon Westphahl and Felix Schmidt discovered that it is possible to inject and run speculative Ansible plugins within untrusted jobs. Plugins are executed locally on the executor and allow the execution of arbitrary python code (and thus also shell code) within the bubblewrap context. This could also make it theoretically possible to escape out of the bubblewrap context using further kernel vulnerabilities. This is fixed by https://review.openstack.org/553854 and it is strongly advised to update asap to latest master and restart any running zuul-executor processes. Sorry for any inconveniences Kind regards Tobias -- BMW Car IT GmbH Tobias Henkel Spezialist Entwicklung Moosacher Straße 86 80809 München Tel.: +49 89 189311-48 Fax: +49 89 189311-20 Mail: tobias.henkel(a)bmw.de<mailto:tobias.henkel@bmw.de> Web: http://www.bmw-carit.de<http://www.bmw-carit.de/> ----------------------------------------------------------------------------- BMW Car IT GmbH Geschäftsführer: Kai-Uwe Balszuweit und Christian Salzmann Sitz und Registergericht: München HRB 134810 -----------------------------------------------------------------------------

1 0

Zuul potential untrusted information disclosure using symlinks
by Tobias.Henkel＠bmw.de 15 Mar '18

15 Mar '18

Dear zuul operators, I discovered a security issue in zuul which allows untrusted speculative jobs to inspect the local file system of a zuul-executor. In the default configuration, access outside of the working directory is constrained by bubblewrap, so information disclosure should not be possible as long as bubblewrap is enabled. If bubblewrap was disabled (not the default, and not recommended), access to files outside of the working directory is possible. This is due to a flaw in the safe path check which doesn't check for symlinks hidden in sub directories or chained symlinks. This is fixed by https://review.openstack.org/553029 and it is advised to update to latest master and restart any running zuul-executor processes. Sorry for any inconveniences Kind regards Tobias -- BMW Car IT GmbH Tobias Henkel Spezialist Entwicklung Moosacher Straße 86 80809 München Tel.: +49 89 189311-48 Fax: +49 89 189311-20 Mail: tobias.henkel(a)bmw.de<mailto:tobias.henkel@bmw.de> Web: http://www.bmw-carit.de<http://www.bmw-carit.de/> ----------------------------------------------------------------------------- BMW Car IT GmbH Geschäftsführer: Kai-Uwe Balszuweit und Christian Salzmann Sitz und Registergericht: München HRB 134810 -----------------------------------------------------------------------------

1 0

Zuul flaw in json logging
by Tobias.Henkel＠bmw.de 14 Mar '18

14 Mar '18

Dear zuul operators Simon Westphahl discovered a flaw within json logging of zuul where no_log is ignored for ansible loops. Tasks within a loop may be able to print decrypted secrets in job-output.json, despite setting no_log. This is fixed in https://review.openstack.org/552799 by Simon. All operators are encouraged to take following actions: * Update your zuul * Check if any jobs dealing with secrets also deal with them in loops using no_log. If not, you're safe * If yes, check job-output.json if secrets are contained * If yes, change your secret Sorry for any inconveniences Tobias -- BMW Car IT GmbH Tobias Henkel Spezialist Entwicklung Moosacher Straße 86 80809 München Tel.: +49 89 189311-48 Fax: +49 89 189311-20 Mail: tobias.henkel(a)bmw.de<mailto:tobias.henkel@bmw.de> Web: http://www.bmw-carit.de<http://www.bmw-carit.de/> ----------------------------------------------------------------------------- BMW Car IT GmbH Geschäftsführer: Kai-Uwe Balszuweit und Christian Salzmann Sitz und Registergericht: München HRB 134810 -----------------------------------------------------------------------------

1 0

Zuul untrusted information disclosure
by Tobias.Henkel＠bmw.de 13 Mar '18

13 Mar '18

Dear zuul operators, I recently discovered a security issue in zuul which allows untrusted speculative jobs to inspect the local file system of a zuul-executor. In the default configuration, access outside of the working directory is constrained by bubblewrap, so information disclosure should not be possible as long as bubblewrap is enabled. If bubblewrap was disabled (not the default, and not recommended), access to files outside of the working directory is possible. This is due to a flaw in the safe path check which didn't follow the search paths of ansible and thus couldn't dereference symlinks which may point to arbitrary locations in the executor file system. This issue is fixed by the changes https://review.openstack.org/552074 and https://review.openstack.org/552127 and it is strongly advised to update to the latest master. We're also currently working on similar classes of security issues so expect more fixes in the future. For the moment, running zuul without bubblewrap is considered unsafe. Sorry for any inconvenience Kind regards Your zuul team -- BMW Car IT GmbH Tobias Henkel Spezialist Entwicklung Moosacher Straße 86 80809 München Tel.: +49 89 189311-48 Fax: +49 89 189311-20 Mail: tobias.henkel(a)bmw.de<mailto:tobias.henkel@bmw.de> Web: http://www.bmw-carit.de<http://www.bmw-carit.de/> ----------------------------------------------------------------------------- BMW Car IT GmbH Geschäftsführer: Kai-Uwe Balszuweit und Christian Salzmann Sitz und Registergericht: München HRB 134810 -----------------------------------------------------------------------------

1 0

Merging feature/zuulv3 into master
by corvus＠inaugust.com 17 Jan '18

17 Jan '18

Hi, On Thursday, January 18, 2018, we will merge the feature/zuulv3 branches of both Zuul and Nodepool into master. If you continuously deploy Zuul or Nodepool from master, you should make sure you are prepared for this. The current version of the single_node_ci pattern in puppet-openstackci should, by default, install the latest released versions of Zuul and Nodepool. However, if you are running Zuul continuously deployed from a version of puppet-openstackci which is not continuously deployed, or using some other method, you may find that your system has automatically been upgraded if you have not taken action before the branch is merged. Regardless of how you deploy Zuul, if you find that your system has been upgraded, simply re-install the most current releases of Zuul and Nodepool, either from PyPI or from a git tag. They are: Nodepool: 0.5.0 Zuul: 2.6.0 Note that the final version of Zuul v3 has not been released yet. We hope to do so soon, but until we do, our recommendation is to continue using the current releases. Thanks, Jim

1 0