You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/en/continuous-deployment/release-notes/rn-prerelease-armory-spinnaker/armoryspinnaker_v2-38-0-rc2.md
+346-4Lines changed: 346 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -42,6 +42,89 @@ Armory scans the codebase as we develop and release software. Contact your Armor
42
42
43
43
> Breaking changes are kept in this list for 3 minor versions from when the change is introduced. For example, a breaking change introduced in 2.21.0 appears in the list up to and including the 2.24.x releases. It would not appear on 2.25.x release notes.
44
44
45
+
### Gate: Spring Security 5 Oauth2 Migration
46
+
Armory CD 2.38.0 removes deprecate Oauth2 annotations and uses Spring Security 5 DSL. In order to configure oauth2 in gate have changed to:
The following configuration properties have been restructured:
102
+
103
+
Previous Configuration:
104
+
105
+
```yaml
106
+
tasks:
107
+
days-of-execution-history:
108
+
number-of-old-pipeline-executions-to-include:
109
+
```
110
+
111
+
New configuration format
112
+
113
+
```yaml
114
+
tasks:
115
+
controller:
116
+
days-of-execution-history:
117
+
number-of-old-pipeline-executions-to-include:
118
+
optimize-execution-retrieval: <boolean>
119
+
max-execution-retrieval-threads:
120
+
max-number-of-pipeline-executions-to-process:
121
+
execution-retrieval-timeout-seconds:
122
+
```
123
+
124
+
These changes improve query performance and execution retrieval efficiency, particularly for large-scale pipeline applications.
125
+
126
+
[Orca: Performance Improvements for SQL Backend](#orca-performance-improvements-for-sql-backend)
127
+
45
128
## Known issues
46
129
<!-- Copy/paste known issues from the previous version if they're not fixed. Add new ones from OSS and Armory. If there aren't any issues, state that so readers don't think we forgot to fill out this section. -->
47
130
@@ -53,15 +136,274 @@ Each item category (such as UI) under here should be an h3 (###). List the follo
53
136
- Fixes to any known issues from previous versions that we have in release notes. These can all be grouped under a Fixed issues H3.
54
137
-->
55
138
139
+
### Security enhancement: Url Filtering/Restriction capabilities on Artifact accounts
140
+
Starting in Armory Continuous Deployment 2.36.5, we have enabled to capability to filter/restrict urls that can be accessed per artifact accounts.
141
+
This feature provides a safeguard around user input of remote urls when artifact accounts are in used in the context of a pipeline execution.
142
+
143
+
An example configuration for clouddriver-local.yml can be found below which can be added per artifact account (http, github, helm):
144
+
```yaml
145
+
artifacts:
146
+
http:
147
+
enabled: true
148
+
accounts:
149
+
- name: http_account
150
+
urlRestrictions:
151
+
allowedDomains:
152
+
- mydomain.com
153
+
- raw.github.com
154
+
- api.github.com
155
+
rejectLocalhost: true #default value
156
+
rejectLinkLocal: true #default value
157
+
rejectVerbatimIps: true #default value
158
+
rejectedIps: [] #default value
159
+
```
160
+
161
+
By default the configuration blocks any local CIDR ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), localhost, link local and raw IPs.
162
+
For full configuration details please refer to this [configuration class](https://github.com/spinnaker/spinnaker/blob/main/clouddriver/clouddriver-artifacts/src/main/java/com/netflix/spinnaker/clouddriver/artifacts/config/HttpUrlRestrictions.java)
### Orca: Webhook stage improvements and security features
182
+
183
+
184
+
```yaml
185
+
orca:
186
+
webhooks:
187
+
allowList: ["https://hooks.company.com"]
188
+
maxRequestSizeBytes: 1048576
189
+
maxResponseSizeBytes: 1048576
190
+
followRedirects: false
191
+
timeoutSeconds: 60
192
+
audit:
193
+
enabled: true
194
+
195
+
```
196
+
197
+
### Helm OCI Registry Chart Support
198
+
Docker registry provider now supports adding OCI-based registries hosting Helm repositories. This feature allows
199
+
users to download and bake Helm charts hosted in OCI-compliant registries (such as Docker Hub).
200
+
201
+
Related PRs:
202
+
-https://github.com/spinnaker/spinnaker/pull/7069
203
+
-https://github.com/spinnaker/spinnaker/pull/7089
204
+
-https://github.com/spinnaker/spinnaker/pull/7113
205
+
206
+
To enable the Helm OCI support in a Docker Registry account set a list of OCI repositories in the `helmOciRepositories`
207
+
of the Docker Registry account configuration. The `helmOciRepositories` is a list of repository names in the format `<registry>/<repository>`. For example:
208
+
```yaml
209
+
dockerRegistry:
210
+
enabled: true
211
+
primaryAccount: dockerhub # Must be one of the configured docker accounts
212
+
accounts:
213
+
- name: dockerhub
214
+
requiredGroupMembership: []
215
+
providerVersion: V1
216
+
permissions: {}
217
+
address: https://index.docker.io # (Required). The registry address you want to pull and deploy images from; e.g. https://index.docker.io
218
+
username: <username> # Your docker registry email (often this only needs to be well-formed, rather than be a real address)
219
+
password: <password>
220
+
cacheIntervalSeconds: 30# (Default: 30). How many seconds elapse between polling your docker registry.
221
+
clientTimeoutMillis: 60000# (Default: 60000). Timeout time in milliseconds for this repository.
222
+
cacheThreads: 1# (Default: 1). How many threads to cache all provided repos on. Really only useful if you have a ton of repos.
223
+
paginateSize: 100# (Default: 100). Paginate size for the docker repository _catalog endpoint.
224
+
sortTagsByDate: false # (Default: false). Sort tags by creation date.
225
+
trackDigests: false # (Default: false). Track digest changes. This is not recommended as it consumes a high QPM, and most registries are flaky.
226
+
insecureRegistry: false # (Default: false). Treat the docker registry as insecure (don’t validate the ssl cert).
227
+
repositories:
228
+
- "registry/repository"# (Default: []). An optional list of repositories to cache Docker images from. If not provided, Spinnaker will attempt to read accessible repositories from the registries _catalog endpoint
229
+
helmOciRepositories:
230
+
- "registry/HelmOciRepository"# (Default: []). An optional list of Helm OCI-Based repositories to cache helm charts from.
231
+
```
232
+
233
+
For every account with non-empty `helmOciRepositories` list, Clouddriver will cache the Helm charts from the specified OCI repositories.
234
+
235
+
The cached Helm OCI charts are defined as a new Artifact type named `helm/image` and can be used to bake Helm OCI-based charts in Spinnaker pipelines.
236
+
237
+
#### Defining retention policy for downloaded helm/image charts in Clouddriver
238
+
Optionally, users can define a retention policy for Helm OCI charts downloaded in a Clouddriver instance. This functionality
239
+
is disabled by default and it is useful for users that want to keep a local copy of a Helm OCI based chart without the need
240
+
to download it every time it is used in a pipeline. The retention policy is defined in the `clouddriver-local.yml` configuration file:
241
+
```
242
+
artifacts:
243
+
helm-oci:
244
+
clone-retention-minutes: 60
245
+
clone-retention-max-bytes: 104857600 # 100MB
246
+
```
247
+
248
+
* `clone-retention-minutes:` Default: 0. How much time to keep the downloaded helm/image chart. Values are:
249
+
* 0: no retention.
250
+
* -1: retain forever.
251
+
* any whole number of minutes, such as `60`.
252
+
* `clone-retention-max-bytes:` Default: 104857600 (100 MB). Maximum amount of disk space to use for downloaded helm/image charts. When the
253
+
maximum amount of space is reached, Clouddriver deletes the clones after returning the artifact to the pipeline, just as if retention were disabled.
254
+
255
+
#### Defining Triggers for helm/image artifacts in Spinnaker pipelines
256
+
To trigger a Spinnaker pipeline on a new version of a Helm OCI-based chart, users will need to enable the Igor poller for the `helm/image` artifact type.
257
+
This can be done by adding the following configuration to the `igor-local.yml` file:
258
+
```
259
+
helm-oci-docker-registry:
260
+
enabled: true
261
+
```
262
+
263
+
Additionally, a new trigger type (named `helm/oci`) has been implemented to allow pipelines to be triggered by new versions of `helm/image` artifacts.
264
+
```
265
+
"triggers": [
266
+
{
267
+
"account": "<accountName>",
268
+
"enabled": true,
269
+
"organization": "<org>",
270
+
"registry": "index.docker.io",
271
+
"repository": "org/repositoryName",
272
+
"type": "helm/oci"
273
+
}
274
+
],
275
+
```
276
+
277
+
278
+
### Orca: Limit the execution retrieval of Disabled pipelines
279
+
A new configuration has been added to exclude execution retrieval for disabled pipelines in Front50. This can be enabled with:
280
+
```yaml
281
+
tasks:
282
+
controller:
283
+
excludeExecutionsOfDisabledPipelines: false|true # Defaults to false
284
+
```
285
+
When enabled, Orca will call Front50 with the `enabledPipelines=true` query parameter, which returns only the
286
+
enabled pipelines for an application (Front50 [PR1520](https://github.com/spinnaker/front50/pull/1520)). This helps reduce
287
+
load for applications with numerous pipelines, especially when obsolete, disabled pipelines are retained for historical reasons.
### Orca: Performance Improvements for Pipeline Executions
329
+
330
+
This release includes several optimizations to improve pipeline execution times, particularly for complex pipeline structures.
331
+
332
+
Key Improvements
333
+
334
+
1. Memorize the `anyUpstreamStagesFailed` extension function to improve time complexity from exponential to linear
335
+
2. Optimize `getAncestorsImpl` to reduce time complexity by a factor of N, where N is the number of stages in a pipeline
336
+
3. Optimize `StartStageHandler` to only call withAuth (which calls getAncestorsImpl) when
337
+
338
+
These enhancements significantly reduce pipeline execution time, with the most notable gains observed in dense pipeline graphs. For example, in the `ComplexPipeline.kt` test scenario, execution time improved from not completing at all to approximately `160ms`.
### Orca: Read Connection Pool for SQL Execution Repository
364
+
365
+
This release introduces support for a dedicated read connection pool for specific read-only database queries in `SqlExecutionRepository`
366
+
367
+
Key Improvements
368
+
369
+
1. New "read" Connection Pool: Allows read operations to be routed to a separate connection pool.
370
+
2. Configurable Read Pool: Users can define an additional read connection pool in the SQL configuration.
371
+
3. Ensures Data Consistency: Some read queries still rely on recently written data and are not yet converted to use a read replica due to potential replication lag.
56
372
373
+
Configuration Example
57
374
375
+
To enable the read connection pool, add the following configuration:
Copy file name to clipboardExpand all lines: templates/spinnaker-release-notes.tmpl
+4-4Lines changed: 4 additions & 4 deletions
Original file line number
Diff line number
Diff line change
@@ -7,9 +7,9 @@ description: >
7
7
Release notes for Armory Continuous Deployment v{{ (ds "payload").armoryVersion }}.
8
8
---
9
9
10
-
<!--
11
-
MAKE SURE TO ADD 'LTS' OR 'FEATURE' TO THE TITLE TO INDICATE RELEASE CATEGORY.
12
-
FOR EXAMPLE, "Armory Continuous Deployment Release LTS"or"Armory Continuous Deployment Release Feature" so users know release category and support time period
10
+
<!--
11
+
MAKE SURE TO ADD 'LTS' OR 'FEATURE' TO THE TITLE TO INDICATE RELEASE CATEGORY.
12
+
FOR EXAMPLE, "Armory Continuous Deployment Release LTS"or"Armory Continuous Deployment Release Feature" so users know release category and support time period
0 commit comments