- Zuul-announce - lists.opendev.org

Nodepool 3.6.0 Released
by corvus＠inaugust.com 13 May '19

13 May '19

The Zuul team is pleased to announce the release of Nodepool 3.6.0. Download it from PyPI: https://pypi.org/project/nodepool The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/nodepool/releasenotes.html#relnotes-3-6-0 Upgrade Notes ============= * The TaskManager used by the OpenStack provider has been removed. The keystoneauth1 library underneath openstacksdk has grown support for rate limiting using a FairSemaphore instead of a pool of worker threads. This should reduce the overall thread count. * The diskimage-builder stats have been reworked to be more useful. The return code and duration is now stored in nodepool.dib_image-build.<diskimage_name>.status.<rc|duration>; previously this was split for each image format. This is unnecessary and confusing since the results will always be the same, since all formats are generated from the same diskimage-builder run. An additional gauge nodepool.dib_image_build.<diskimage_name>.status.last_build is added to make it easy to show relative time of builds in dashboards. * statsd key names have changed. Because of the removal of TaskManager statsd calls are being deferred to openstacksdk. Instead of keys of the form ComputeGetServers, the openstacksdk keys are of the form compute.GET.servers. They will always start with the normalized service-type, followed by the HTTP verb, followed by a . separated list of url segments. Any service version, project-id entries in the url or .json suffixes will be removed.

1 0

New release: 3.8.0. Users should upgrade now for a security fix
by Clark Boylan 16 Apr '19

16 Apr '19

Hello, The Zuul Maintainers have released version 3.8.0. This new release includes a security fix and users should upgrade. Paul Belanger discovered that from version 3.1.0 to 3.7.1 it was possible for Zuul to load and use a config (trusted) layout change in a dynamic pre-merge context. Specifically, if Zuul is running with config errors then a logic error in loading new configs allowed changes to a config (trusted) repo to be loaded as a dynamic config. Users should update to 3.8.0 now to correct this issue. Other updates include Zuul returning FAILURE rather than SKIPPED when a job fails to have its requirements met and artifacts returned by parent jobs are now available to child jobs in the same buildset. For more information please refer to the release notes: https://zuul-ci.org/docs/zuul/releasenotes.html#relnotes-3-8-0 Thank you for flying Zuul and for your patience, Clark on behalf of the Zuul Maintainers

1 0

Zuul 3.7.1 released
by corvus＠inaugust.com 25 Mar '19

25 Mar '19

The Zuul team is pleased to announce the release of Zuul 3.7.1. Download it from PyPI: https://pypi.org/project/zuul The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/zuul/releasenotes.html#relnotes-3-7-1 Bug Fixes ========= * When using Ansible 2.7 the uri module crashed with a module failure. * The scheduler.default_ansible_version has been ignored.

1 0

Zuul 3.7.0 released
by corvus＠inaugust.com 21 Mar '19

21 Mar '19

The Zuul team is pleased to announce the release of Zuul 3.7.0. Download it from PyPI: https://pypi.org/project/zuul The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/zuul/releasenotes.html#relnotes-3-7-0 Upgrade Notes ============= * The default ansible version is now 2.7. In case this breaks any jobs this can be overridden in job.ansible-version, tenant.default-ansible-version or scheduler.default_ansible_version * In order to support several ansible versions installed simultaneously Zuul now handles them itself in virtual environments. By default Zuul installs the needed ansible versions on startup so there is no further user action required. However it is recommended to pre-install the ansible environments during installation by invoking zuul-manage-ansible. * The user value in the [fingergw] configuration section previously defaulted to zuul, but now is unset by default, which will cause fingergw not to drop privileges. It is recommended that this value be explicitly set to an unprivileged user. * The hosts value in the [zookeeper] configuration section previously defaulted to localhost:2181, but now is unset by default. This value is required and must be explicitly set (and the documentation has always indicated this). New Features ============ * Jobs may now specify which ansible version is used to run them. The ansible version to use can now be specified by job.ansible-version. * Zuul now supports ansible 2.6 for running jobs. * Zuul now supports ansible 2.7 for running jobs. * The ansible_python_interpreter variable is now whitelisted for the add_host task.

1 0

Zuul not blocking local execution of raw Ansible module
by Tobias.Henkel＠bmw.de 11 Mar '19

11 Mar '19

Dear zuul operators, I discovered that we don't check the raw Ansible module for delegation to localhost. We do not believe this would have given jobs access to the executor host as every job is sandboxed within a bubblewrap container with minimal access to the filesystem and other resources. Further information can be found in StoryBoard: https://storyboard.openstack.org/#!/story/2005037 This is fixed by https://review.openstack.org/642518 which has been included in Zuul version 3.6.1. It is strongly advised to update to 3.6.1 or latest master and restart any running zuul-executor processes. Sorry for any inconveniences Kind regards Tobias

1 0

Nodepool 3.5.0 released
by corvus＠inaugust.com 09 Mar '19

09 Mar '19

The Zuul team is pleased to announce the release of Nodepool 3.5.0. Download it from PyPI: https://pypi.org/project/nodepool The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/nodepool/releasenotes.html#relnotes-3-5-0 New Features ============ * The new Amazon Web Services (AWS) EC2 Driver allows launching EC2 instances as nodes. * A new option (build-timeout) has been added to the builder diskimage configuration to control how long the builder should wait for image builds before giving up. The default is 8 hours. * A new driver is available to support Openshift cluster as a resources provider to enable project and pod request. Known Issues ============ * The AWS driver does not support quota management at this time. * The AWS driver does not support custom image building.

1 0

Zuul 3.6.0 released
by corvus＠inaugust.com 09 Mar '19

09 Mar '19

The Zuul team is pleased to announce the release of Zuul 3.6.0. Download it from PyPI: https://pypi.org/project/zuul The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/zuul/releasenotes.html#relnotes-3-6-0 Upgrade Notes ============= * Service Workers are now disabled by default in the Javascript dashboard. Deployers who wish to enable them need to set REACT_APP_ENABLE_SERVICE_WORKER * Zuul recently added the job variable zuul.message. This can contain jinja tags which can cause problems accessing the zuul variable in the job. Because of this the message is now base64 encoded and any job evaluating this variable needs to be changed from {{ zuul.message }} to {{ zuul.message | b64decode }}. New Features ============ * Artifacts may now include a metadata field for storing arbitrary metadata about the artifacts in the SQL database. * The job.run attribute now supports a single or list of playbooks. * Support for expressing artifact or other resource dependencies between jobs running on different changes with a dependency relationship (e.g., a container image built in one project and consumed in a second project) has been added via the job.provides and job.requires job attributes. * The job.dependencies attribute may now be used to express “soft” dependencies – that is, to indicate a job should run after another completes, but only if it runs at all. For example, a deployment job which should always run, but depends on a build job which only runs if the source code is changed.

1 0

Potential disclosure of secrets defined in untrusted projects
by corvus＠inaugust.com 23 Jan '19

23 Jan '19

A potential vector for exposure or unauthorized use of secrets was recently discovered. The vulnerability is removed in version 3.5.0 and affects all versions after 3.0.0 and prior to 3.5.0. The vulnerability only applies in very specific circumstances; if these apply to you, it is recommended to upgrade immediately and consider auditing and replacing affected secrets. It may have been possible to expose a secret, or use resources protected by a secret, if a job using a secret was defined in an untrusted project on a system with an independent pre-merge post-review pipeline -- that is, a pipeline with post-review set to true, manager set to independent, and which operated on changes before they merged -- and that job relied on the allowed-projects attribute to restrict access to it. An example of such a pipeline is a "restricted check" pipeline, where reviewers may trigger builds after core reviewers with additional permissions leave a vote or label. To take advantage of the vulnerability, a user would have to create (but not cause to be merged) a change in the target repository which removed the allowed-projects access restriction, and then create a change in a repository they control which used the "Depends-On" feature to depend on the change in the target repository, and then cause that change to be enqueued in an independent pre-merge post-review pipeline. To prevent disclosure or use in this situation, allowed-projects is now automatically set to the current project when a secret is used in a job defined in an untrusted project, and it can not be overridden.

1 0

Zuul 3.5.0 released
by corvus＠inaugust.com 23 Jan '19

23 Jan '19

The Zuul team is pleased to announce the release of Zuul 3.5.0. Download it from PyPI: https://pypi.org/project/zuul The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/zuul/releasenotes.html#relnotes-3-5-0 Security Issues =============== * Jobs with secrets in untrusted projects now automatically set allowed-projects. It is possible to circumvent the use of allowed-projects in untrusted projects by creating a change which Depends-On a change which alters a project definition. This behavior may be unexpected, so documentation has been updated with warnings to avoid relying on it in sensitive cases. It may have been possible to expose a secret, or use resources protected by a secret, if a job using a secret was defined in an untrusted project on a system with an independent pre-merge post-review pipeline – that is, a pipeline with post-review set to true, manager set to independent, and which operated on changes before they merged. To prevent disclosure or use in this situation, allowed-projects is now automatically set to the current project when a secret is used in a job defined in an untrusted project, and it can not be overridden. Upgrade Notes ============= * The zuul_return module has been converted to an Ansible action plugin. Job playbooks no longer need to use delegate_to or a localhost only play with this module as action plugin by default run on localhost. New Features ============ * The executor.min_avail_mem setting now takes cgroup limits into account. There is also a new metric zuul.executor.<executor>.pct_used_ram_cgroup available. * The job.secrets.pass-to-parent attribute has been added to allow secrets to be made available to playbooks in parent jobs (for example, to allow for jobs which are designed to use secrets, but leave it to child jobs to actually supply them). See also the Secret documentation. * The restriction on using known_hosts in playbooks has been lifted. * The executors emit a new timer zuul.executor.<executor>.starting_builds with the time jobs spent during starting. Bug Fixes ========= * Untrusted playbooks no longer see ‘Adding hosts ssh with ansible_user to the inventory is prohibited’ when using the add_host Ansible task on localhost. * Fixed an issue where a trailing slash on the baseurl of a git driver connection config could cause an indefinite job hang.

1 0

Nodepool 3.4.0 released
by corvus＠inaugust.com 16 Jan '19

16 Jan '19

The Zuul team is pleased to announce the release of Nodepool 3.4.0. Download it from PyPI: https://pypi.org/project/nodepool The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/nodepool/releasenotes.html#relnotes-3-4-0 Upgrade Notes ============= * A change to the ZooKeeper schema to support a new DELETED node state will require a total shutdown of all Nodepool launchers before restarting any of them with this version. New Features ============ * A new configuration option is available under the ‘pools’ attribute of an OpenStack provider. This config value, ‘node-attributes’, can contain a dictionary of arbitrary key-value pairs and will be stored with the node data within ZooKeeper. Bug Fixes ========= * Fixes a regression of missing task statistics with OpenstackSDK versions greater than 0.19.0.

1 0