- Zuul-announce - lists.opendev.org

Zuul 3.4.0 released
by corvus＠inaugust.com 12 Jan '19

12 Jan '19

The Zuul team is pleased to announce the release of Zuul 3.4.0. Download it from PyPI: https://pypi.org/project/zuul The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/zuul/releasenotes.html#relnotes-3-4-0 Upgrade Notes ============= * The zuul-web service now requires access to ZooKeeper, as a result you may need to update your firewall allow access from the service. Additionally, zuul.conf should now contain a zookeeper configuration section. * The zuul.nodepool statistics have been moved under zuul.nodepool.requests to allow sub-stats to work correctly. For example zuul.nodepool.requested has become zuul.nodepool.requests.requested.total. The previously missing label and size counters are now available at zuul.nodepool.requests.<state>.<size|label>. For more info see the monitoring documentation. New Features ============ * Jobs may now return artifact URLs and they will be stored in the SQL database (if configured). See Returning artifact URLs for usage. * One or more zuul executors can now be added to a executor.zone. This is helpful if a cloud does not have any public IP addresses for nodepool nodes. Now you’ll be able to have a zuul executor on the same private network as your nodepool nodes. * The Ansible inventory file now includes nodepool.host_id variable if the node was launched using the OpenStack Nodepool driver. * A new scheduler option, scheduler.relative_priority, can be used to instruct Nodepool to fulfull requests from less-busy projects more quickly.

1 0

Heads up that build-puppet-role role will change behavior
by Tobias Urdin 11 Jan '19

11 Jan '19

Hello, The openstack-infra/zuul-jobs repo will be updated by [1] causing the "build-puppet-module" role to stop using the "puppet module build" command and instead use the PDK (Puppet Development Kit) gem to build the modules. The only change is that there will be no folder created in the pkg folder inside your module but only the actual tarball, the naming and location of the tarball (in the "pkg" folder) is still the same. There will be a grace period until [1] is merged, if you require a version folder of your module being created in the pkg folder you must do this manually or revert to using the "puppet module build" command which is deprecated and will be removed in a future release of Puppet. Best regards Tobias [1] https://review.openstack.org/#/c/627534

1 0

Zuul 3.3.1 released
by corvus＠inaugust.com 29 Nov '18

29 Nov '18

The Zuul team is pleased to announce the release of Zuul 3.3.1. Download it from PyPI: https://pypi.org/project/zuul The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/zuul/releasenotes.html#relnotes-3-3-1 Security Issues =============== * The add_host module options are restricted to a hostname, port, user and password. Previously, malicious options could be used to bypass protection and execute tasks on the executor. Only ssh and kubectl connection are authorized. Upgrade Notes ============= * The acquiring behavior of jobs with semaphores has been changed. Up to now a job requested resources and aquired the semaphore just before it started to run. However this could lead to a high amount of resource waste. Instead jobs now acquire the semaphore before requesting the resources by default. This behavior can be overridden by jobs using job.semaphore.resources-first if some waste of resources is acceptable. New Features ============ * New tenant options tenant.allowed-triggers and tenant.allowed-reporters can be used to restrict what connections a tenant has access to. * A new tenant option tenant.allowed-labels can be used to restrict what labels a tenant has access to. * A job using a semaphore now can configure if it should acquire the it before requesting resources or just before running.

1 0

Untrusted playbook task execution on executors
by Monty Taylor 29 Nov '18

29 Nov '18

Dear Zuul operators, The change to allow the use of add_host in untrusted playbooks, which was included in Zuul version 3.3.0, inadvertently opened the door for an user to abuse the ssh_executable parameter to cause a command to be run on the executor. We do not believe this would have given jobs access to the executor host as every job is sandboxed within a bubblewrap container with minimal access to the filesystem and other resources. Further information can be found in StoryBoard: https://storyboard.openstack.org/#!/story/2004405 This is fixed by https://review.openstack.org/620635 which has been included in Zuul version 3.3.1. It is strongly advised to update to 3.3.1 or latest master and restart any running zuul-executor processes. Sorry for any inconveniences. Thanks! Monty

1 0

Nodepool 3.3.1 released
by corvus＠inaugust.com 03 Nov '18

03 Nov '18

The Zuul team is pleased to announce the release of Nodepool 3.3.1. Download it from PyPI: https://pypi.org/project/nodepool/ The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/nodepool/releasenotes.html#relnotes-3-3-1 Bug Fixes ========= * The nodes by label and state statistic gauges are now correctly reset to zero if no node of a label and state exists. * Task names are now consistently normalised to CamelCase without deliminators. Some statistics sent to statsd with - or _ characters will have changed keys, for example ComputePostOs-volumes_boot is now ComputePostOsVolumesBoot.

1 0

Zuul 3.3.0 released
by corvus＠inaugust.com 03 Nov '18

03 Nov '18

The Zuul team is pleased to announce the release of Zuul 3.3.0. Download it from PyPI: https://pypi.org/project/zuul/ The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/zuul/releasenotes.html#relnotes-3-3-0 New Features ============ * A local project key file URI (eg. file:///path/to/key.pub) is now supported by the encrypt_secret.py tool. This allows encrypting secrets without directly accessing the Zuul web API to retrieve the project key. * Zuul now supports triggering a full reconfiguration by using the command zuul-scheduler full-reconfigure. * The Gerrit driver can now (optionally) report via HTTP instead of SSH. In the future, this will be used to report file and line comments (the SSH API only supports review messages). * Zuul now supports leaving file comments, though currently only when using the Gerrit driver. See the documentation for zuul_return for details. * A job now can pause itself using Return Values and let the child jobs run until they are finished. This can be used to serve some service which can be used by the child jobs. * An SSH keypair is now generated for every project and may be used in post-review jobs to access systems which trust that project. * GitHub <github connection>.rate_limit_logging now can be configured. If disabled this can save some network round trip times. This can be configured per connection. * The Zuul web dashboard has been rewritten in React. * The restriction on using add_host in playbooks has been lifted. * A new Build page in the web interface enable displaying a single Build information. * A new Notification Drawer and a ConfigErrors page in the web interface enable displaying the config-errors endpoint data. * A new Job page in the web interface enable browsing through job configuration. * Client certificate locations to be used by winrm connections can be configured now. Upgrade Notes ============= * The Zuul web dashboard is now a single index.html and static offload server needs new rewrite rules. Check the install instruction for backward compatible rewrite rules. Note that serving the web dashboard from a sub-directory requires the application to be rebuilt using the desired homepage location. Deprecation Notes ================= * Signal based triggering of a full reconfiguration via sending SIGHUP to the zuul-scheduler PID is deprecated. Use the command zuul-scheduler full-reconfigure now.

1 0

zuul-jobs: Deprecation of the "emit-ara-html" role in favor of "ara-report"
by David Moreau Simard 15 Oct '18

15 Oct '18

Hello, The "emit-ara-html" [1] role, typically part of Zuul base jobs, has been used to generate ARA [2] static HTML Ansible reports. These files end up being stored as part of the logs of a job in the "ara" directory. This role has been superseded by "ara-report" [3] which provides the same functionality and defaults out of the box. This new role adds support for saving raw databases and is meant to be compatible with the use of the ARA sqlite WSGI middleware. This new middleware implementation may be of particular interest for Zuul operators since it translates to improved job performance and reduced storage overhead. For reference, the OpenStack Infrastructure implementation can be found here [4]. The announcement to openstack-dev can be found here [5] for additional details and context. Please refer to the ARA documentation for more details [6]. Feel free to reply to this thread or reach out to us in #zuul if you have any questions! [1]: https://git.zuul-ci.org/cgit/zuul-jobs/tree/roles/emit-ara-html [2]: https://github.com/openstack/ara [3]: https://git.zuul-ci.org/cgit/zuul-jobs/tree/roles/ara-report/README.rst [4]: https://review.openstack.org/#/q/project:openstack-infra/puppet-openstackci… [5]: http://lists.openstack.org/pipermail/openstack-dev/2018-March/128902.html [6]: https://ara.readthedocs.io/en/latest/advanced.html David Moreau Simard Senior Software Engineer | OpenStack RDO dmsimard = [irc, github, twitter]

1 1

OpenStack Community Meeting - October 10 - Strategic Area Governance Update
by Chris Hoge 05 Oct '18

05 Oct '18

Following the interest in the first OpenStack Foundation community meeting, where we discussed the OpenStack Rocky release as well as quick updates from Kata, Airship, StarlingX and Zuul, we want to keep the community meetings going. The second community meeting will be October 10 at 8:00 PT / 15:00 UTC, and the agenda is for Jonathan Bryce and Thierry Carrez to share the latest plans for strategic project governance at the Foundation. These updates will include the process for creating new Strategic Focus Areas, and the lifecycle of new Foundation supported projects. We will have an opportunity to share feedback as well as a question and answer session at the end of the presentation. For a little context about the proposed plan for strategic project governance, you can read Jonathan’s email to the Foundation mailing list: http://lists.openstack.org/pipermail/foundation/2018-August/002617.html This meeting will be recorded and made publicly available. This is part of our plan to introduce bi-weekly OpenStack Foundation community meetings that will cover topics like Foundation strategic area updates, project demonstrations, and other community efforts. We expect the next meeting to take place October 24 and focus on the anticipated StarlingX release. Do you have something you'd like to discuss or share with the community? Please share them with me so that I can schedule them for future meetings. OpenStack Community Meeting - Strategic Area Governance Update Date & Time: October 10, 8:00 PT / 15:00 UTC Zoom Meeting Link: https://zoom.us/j/312447172 Agenda: https://etherpad.openstack.org/p/openstack-community-meeting Thanks! Chris Hoge Strategic Program Manager OpenStack Foundation

1 0

zuul-jobs : Removal of readthedocs playbook
by Ian Wienand 09 Aug '18

09 Aug '18

Hello, The zuul-jobs:playbooks/python/readthedocs.yaml playbook is scheduled for removal [1] in two weeks on or about 27th August, 2018 (per the deprecation policy [2]). This playbook was used to trigger documentation builds on the readthedocs.org service. The playbook uses an API endpoint that is no longer available [3]. The trigger-readthedocs role is provided for anyone wishing to migrate to the authenticated API endpoint [4]. For more details, see [5]. Thanks, -i [1] https://review.openstack.org/#/c/583836/ [2] https://docs.openstack.org/infra/zuul-jobs/deprecation.html [3] https://github.com/rtfd/readthedocs.org/commit/a66bd56bada66f99c778aa424042… [4] https://zuul-ci.org/docs/zuul-jobs/roles.html#role-trigger-readthedocs [5] http://lists.openstack.org/pipermail/openstack-dev/2018-August/132836.html

1 0

Zuul 3.2.0 released
by corvus＠inaugust.com 09 Aug '18

09 Aug '18

The Zuul team is pleased to announce the release of Zuul 3.2.0. Download it from PyPI: https://pypi.org/project/zuul/ The release notes, included below, are also available in the documentation with hyperlink references: https://zuul-ci.org/docs/zuul/releasenotes.html#relnotes-3-2-0 New Features ============ * Zuul client got a new command ‘tenant-conf-check’. This command validates the schema of the tenant configuration and exits -1 if errors have been detected. * A new Ansible inventory variable zuul.child_jobs which is a list of the first level child jobs to be run after a job has finished successfully. * Jobs are now able to use the job.extra-vars which will use the --extra-vars flag when a job runs. * Project and project-templates may now create variables via a vars configuration entry. Jobs can access these at runtime in the same manner as job variables. * The supercedent pipeline manager has been added. It is designed to make post-merge artifact build pipelines more efficient. * The dequeue command has been added to the Zuul CLI. It allows operators to stop a given buildset at will. * It is now possible to use zuul_return to skip child jobs. You can use the zuul.child_jobs inventory variable to get a list of child jobs configured to run, then use zuul_return to modify the list. Any child job not in zuul_return zuul.child_jobs will be skipped. See Return Values for examples. Bug Fixes ========= * Project Templates are now branch-aware and behave more like project stanzas. If a template is defined on a branch, it will only apply to changes to that branch. * The timer trigger does not enqueue an event for every branch of every project anymore and it now only processes projects actually using the pipeline triggered by a timer.

1 0