v2.21.3 Armory Continuous Deployment Release (Spinnaker™ v1.21.4)

2020/08/05 Release Notes

Note: If you’re experiencing production issues after upgrading Spinnaker, rollback to a previous working version and please report issues to http://go.armory.io/support.

Required Halyard and Operator version

Armory Spinnaker 2.21.2 requires one of the following:

• Armory Halyard 1.9.4 or later.
• Armory Spinnaker Operator 1.0.3 or later.

Breaking changes

Kubernetes deployment namespace

Upgrading to 2.20x or later introduces a breaking change in the Kubernetes provider for Spinnaker. Spinnaker now correctly interprets the namespace declared in your kubeconfig file and uses that namespace. Previously, Spinnaker deployed to the default namespace called default because of an error in how Spinnaker interpreted the namespace in the Kubernetes context.

Solutions

Armory recommends using one of the following methods, which involve explicitly setting the namespace:

• In your deployment manifests, declare the namespace you want to deploy to. Set to default if you want to maintain the previous behavior:

  apiVersion: batch/v1
  kind: Job
  metadata:
   generateName: <someName>
   # Set namespace to default if you want to maintain the previous behavior.
   namespace: <targetNamespace> 
  

• In your kubeconfig, declare the namespace you want to deploy to. Set to default if you want to maintain the previous behavior:

  contexts:
  - context:
    cluster: <someCluster>
    # Set namespace to default if you want to maintain the previous behavior.
    namespace: <targetNamespace>
  

For more information, see the following links:

• OSS Spinnaker issue #5731
• Armory KB article

Introduced in: Armory 2.20

Spinnaker metrics

Metrics data, specifically the metric names, for Spinnaker changed. These changes are not backwards compatible and may result in broken third-party dashboards, such as Grafana dashboards.

Workarounds:

• Observability Plugin: Armory is working on updates to the Observability Plugin to remedy this issue. The plugin currently supports New Relic & Prometheus. Note that this resolution requires you to make updates to use the new metric names.

  For information about how to configure the Observability Plugin, see Monitoring Spinnaker with Prometheus.

  For information about how to install a plugin, see Spinnaker’s Plugin Users Guide.

• Update existing dashboards: Change your dashboards and alerts to use the new metric names.

Although both workarounds involve updating your dashboards to use the new metric names, Armory recommends switching to the Observability plugin. Due to changes the Spinnaker project is making, the Observability plugin provides a long-term solution.

Affected versions: Armory 2.20.x or later (OSS 1.20.x)

Scheduled removal of Kubernetes V1 provider

The Kubernetes V1 provider has been removed in Spinnaker 1.21 (Armory Spinnaker 2.21). Please see the RFC for more details.

Known Issues

There are currently no known issues with this release.

Security update

We continue to make Spinnaker’s security a top priority. Although several CVEs are resolved, the following still exist:

Multiple services

CVE-2020-5410 was resolved in a previous version of Armory Spinnaker; however, this CVE introduced a regression for users of Spring Cloud and has been rolled back. Armory will continue to monitor releases for a fix.

Orca

The following CVEs have been recently identified and will be addressed in an upcoming release:

• CVE-2020-7692

Clouddriver

The following CVEs still exist in Clouddriver:

• CVE-2017-18342
• CVE-2020-1747
• CVE-2019-17638
• CVE-2020-13757
• CVE-2016-10745

All of them are embedded dependencies in the Google Cloud SDK. A version of the Google Cloud SDK addressing these CVEs has not been released. The risk to Clouddriver users is low. All four CVEs deal with untrusted input, which Clouddriver does not provide to the Google Cloud SDK. Additionally, users deploying to other cloud providers are not at risk for this vulnerability.

The following CVE also exists for Clouddriver:

• CVE-2020-7014 deals with an Elasticsearch exploit related to token generation. Clouddriver only makes use of entity tags and does not allow for token generation or authentication.

The following CVEs will be triaged as part of a future release:

• CVE-2020-7692

Terraformer

Armory has identified and is triaging the following CVEs in Terraformer, the service for the Terraform integration:

• CVE-2020-15778

Highlighted Updates

Armory

Dynamic Account Configurations with Vault

Fixed an issue where Clouddriver fails to start when you use Vault as the backend for Dynamic Account Configurations.

Spinnaker Community Contributions

There have also been numerous enhancements, fixes and features across all of Spinnaker’s other services. See their changes here:
Spinnaker v1.21.4

Detailed Updates

Bill of Materials

Here’s the bom for this version.

version: 2.21.3
timestamp: "2020-08-26 16:59:10"
services:
    clouddriver:
        commit: 8af10d5b
        version: 2.21.5
    deck:
        commit: 53d7adc3
        version: 2.21.6
    dinghy:
        commit: 8fa8c0ae
        version: 2.21.3
    echo:
        commit: 17a274cf
        version: 2.21.2
    fiat:
        commit: a7b64e03
        version: 2.21.2
    front50:
        commit: 9b3d3bac
        version: 2.21.0
    gate:
        commit: "844223e9"
        version: 2.21.6
    igor:
        commit: b3a7e1fc
        version: 2.21.2
    kayenta:
        commit: 7caca133
        version: 2.21.2
    monitoring-daemon:
        version: 2.21.0
    monitoring-third-party:
        version: 2.21.0
    orca:
        commit: 7da34395
        version: 2.21.4
    rosco:
        commit: f9f89e5a
        version: 2.21.2
    terraformer:
        commit: 516ca41a
        version: 2.21.5
dependencies:
    redis:
        version: 2:2.8.4-2
artifactSources:
    dockerRegistry: docker.io/armory

Armory

Terraformer™ - 2.21.5…2.21.5

Dinghy™ - 2.21.3…2.21.3

Armory Echo - 2.21.2…2.21.2

Armory Clouddriver - 2.21.4…2.21.5

• fix(dynamicAccounts): Server unable to start with vault (#188) (#189)

Armory Orca - 2.21.3…2.21.4

• fix(terraformer): remove deprecated method call (#147) (#148)

Armory Fiat - 2.21.2…2.21.2

Armory Front50 - 2.21.0…2.21.0

Armory Kayenta - 2.21.2…2.21.2

Armory Rosco - 2.21.2…2.21.2

Armory Deck - 2.21.6…2.21.6

Armory Gate - 2.21.6…2.21.6

Armory Igor - 2.21.2…2.21.2