On Wed, Mar 13, 2019 at 12:42:46PM -0400, Paul Belanger wrote:
On Wed, Mar 13, 2019 at 09:23:10AM -0700, James E. Blair wrote:
I'd like to reset this thread because I think we were getting off-topic.
To summarize, there has been some trepidation, some specific concerns, and some support.
I'm in the cautiously support camp, and see if possible to remove.
Okay, I might have moved directly into the yes camp :)
Reason being, we on ansible-network team have now migrated 100% into zuul for all of our testing. The majority of playbooks we'd like to run from zuul will be using ansible_connection=network_cli along with modules like vyos_config and eos_config.
For now, we are using nested ansible for testing, but we might just be able to use zuul directly, if we are planning on dropping the restriction.
The support tends to come from the perspective that our masking is incomplete enough that we're probably effectively already in this state anyway.
The specific concerns are:
- We should ensure that Zookeeper is sufficiently secure that a job
can't just connect to it and start manipulating the data. Tristan and Shrews are looking into that. We should follow up with a definitive answer as to whether the ZK ACLs are sufficient.
- We would be allowing arbitrary code execution which may allow an
attacker access to exploit a vulnerability (e.g., in the kernel) on the host.
I admit, this sounds scary, but if we 99.9% believe bubblewrap is going to provide the best protection, this should be fine. I do think our plugins provide another layer of protection, which helps limit the amount of things we can even run on the executor. So far, the majority of jobs haven't needed access to localhost that I have seen.
I've tried to digest the thread so far, but I may have missed something. Are there any other concerns about regressions which this may introduce?
-Jim
Zuul-discuss mailing list Zuul-discuss@lists.zuul-ci.org http://lists.zuul-ci.org/cgi-bin/mailman/listinfo/zuul-discuss
Zuul-discuss mailing list Zuul-discuss@lists.zuul-ci.org http://lists.zuul-ci.org/cgi-bin/mailman/listinfo/zuul-discuss