v2.21.4 Armory Release (OSS Spinnaker™ v1.21.4)

Release notes for Armory Enterprise v2.21.4

2020/09/11 Release Notes

Note: If you’re experiencing production issues after upgrading Spinnaker, rollback to a previous working version and please report issues to http://go.armory.io/support.

Required Halyard and Operator version

Armory Spinnaker 2.21.2 requires one of the following:

Armory Halyard 1.9.4 or later.
Armory Spinnaker Operator 1.0.3 or later.

Breaking changes

Kubernetes deployment namespace

Upgrading to 2.20x or later introduces a breaking change in the Kubernetes provider for Spinnaker. Spinnaker now correctly interprets the namespace declared in your kubeconfig file and uses that namespace. Previously, Spinnaker deployed to the default namespace called default because of an error in how Spinnaker interpreted the namespace in the Kubernetes context.

Solutions

Armory recommends using one of the following methods, which involve explicitly setting the namespace:

In your deployment manifests, declare the namespace you want to deploy to. Set to default if you want to maintain the previous behavior:

apiVersion: batch/v1
kind: Job
metadata:
 generateName: <someName>
 # Set namespace to default if you want to maintain the previous behavior.
 namespace: <targetNamespace>

In your kubeconfig, declare the namespace you want to deploy to. Set to default if you want to maintain the previous behavior:

contexts:
- context:
  cluster: <someCluster>
  # Set namespace to default if you want to maintain the previous behavior.
  namespace: <targetNamespace>

For more information, see the following links:

OSS Spinnaker issue #5731
Armory KB article

Introduced in: Armory 2.20

Spinnaker metrics

Metrics data, specifically the metric names, for Spinnaker changed. These changes are not backwards compatible and may result in broken third-party dashboards, such as Grafana dashboards.

Workarounds:

Observability Plugin: Armory is working on updates to the Observability Plugin to remedy this issue. The plugin currently supports New Relic & Prometheus. Note that this resolution requires you to make updates to use the new metric names.

For information about how to configure the Observability Plugin, see Monitoring Spinnaker with Prometheus.

For information about how to install a plugin, see Plugin Users Guide.
Update existing dashboards: Change your dashboards and alerts to use the new metric names.

Although both workarounds involve updating your dashboards to use the new metric names, Armory recommends switching to the Observability plugin. Due to changes the Spinnaker project is making, the Observability plugin provides a long-term solution.

Affected versions: Armory 2.20.x or later (OSS 1.20.x)

Scheduled removal of Kubernetes V1 provider

The Kubernetes V1 provider has been removed in Spinnaker 1.21 (Armory Spinnaker 2.21). Please see the RFC for more details.

Known Issues

Spinnaker liveManifestCalls set to `true` can cause major pipeline errors

Enabling liveManifestCalls: true causes the environment to exhibit odd behaviors. Resources that have been deployed/changed in previous stages are not being taken in to consideration in current stages, leading to errors and issues in the pipeline deployment.

This can be especially detrimental to any pipelines that use a rollout strategy along with a strategy.spinnaker.io/max-version-history annotation, which causes inconsistent deployment target state as well as pipeline failures.

Workaround

Consult the KB Article detailing solutions on this issue for how to work around this issue.

Impact

This issue has existed for a while, but has only been documented recently. A fix has been added to OSS 1.23 and will be available in Armory 2.23.x once it is released.

Armory Support recommends turning off lifeManifestCalls by setting liveManifestCalls: false if you have any dynamic lookups in your pipelines.

Introduced In: OSS 1.12

Security update

We continue to make Spinnaker’s security a top priority. Although several CVEs are resolved, the following still exist:

Multiple services

CVE-2020-5410 was resolved in a previous version of Armory Spinnaker; however, this CVE introduced a regression for users of Spring Cloud and has been rolled back. Armory will continue to monitor releases for a fix.

Orca

The following CVEs have been recently identified and will be addressed in an upcoming release:

CVE-2020-7692

Clouddriver

The following CVEs still exist in Clouddriver:

CVE-2017-18342
CVE-2020-1747
CVE-2019-17638
CVE-2020-13757
CVE-2016-10745

All of them are embedded dependencies in the Google Cloud SDK. A version of the Google Cloud SDK addressing these CVEs has not been released. The risk to Clouddriver users is low. All four CVEs deal with untrusted input, which Clouddriver does not provide to the Google Cloud SDK. Additionally, users deploying to other cloud providers are not at risk for this vulnerability.

The following CVE also exists for Clouddriver:

CVE-2020-7014 deals with an Elasticsearch exploit related to token generation. Clouddriver only makes use of entity tags and does not allow for token generation or authentication.

The following CVEs will be triaged as part of a future release:

CVE-2020-7692

Terraformer

Armory has identified and is triaging the following CVEs in Terraformer, the service for the Terraform integration:

CVE-2020-15778

Highlighted Updates

Terraform Integration

Fixed an issue where an InvalidClientTokenId error occurs when using Named Profiles for AWS credentials with assumeRole.

Spinnaker Community Contributions

There have also been numerous enhancements, fixes and features across all of Spinnaker’s other services. See their changes here:
Spinnaker v1.21.4

Detailed Updates

Bill of Materials

Here’s the bom for this version.

Expand

version: 2.21.4
timestamp: "2020-09-11 15:39:15"
services:
    clouddriver:
        commit: 8af10d5b
        version: 2.21.5
    deck:
        commit: 5c1d7356
        version: 2.21.7
    dinghy:
        commit: 8fa8c0ae
        version: 2.21.3
    echo:
        commit: ebbfce21
        version: 2.21.3
    fiat:
        commit: a7b64e03
        version: 2.21.2
    front50:
        commit: 9b3d3bac
        version: 2.21.0
    gate:
        commit: "844223e9"
        version: 2.21.6
    igor:
        commit: b3a7e1fc
        version: 2.21.2
    kayenta:
        commit: 7caca133
        version: 2.21.2
    monitoring-daemon:
        version: 2.21.0
    monitoring-third-party:
        version: 2.21.0
    orca:
        commit: 7da34395
        version: 2.21.4
    rosco:
        commit: f9f89e5a
        version: 2.21.2
    terraformer:
        commit: c7552cb2
        version: 2.21.6
dependencies:
    redis:
        version: 2:2.8.4-2
artifactSources:
    dockerRegistry: docker.io/armory

Armory

Armory Echo - 2.21.2…2.21.3

fix(plugins): Don’t fail when debug service is not provided because diagnostics.enabled is false (#224) (#226)

Armory Gate - 2.21.6…2.21.6

Dinghy™ - 2.21.3…2.21.3

Armory Clouddriver - 2.21.5…2.21.5

Armory Rosco - 2.21.2…2.21.2

Terraformer™ - 2.21.5…2.21.6

fix(profiles): add session token for AWS assume role (#245) (#246)

Armory Fiat - 2.21.2…2.21.2

Armory Front50 - 2.21.0…2.21.0

Armory Deck - 2.21.6…2.21.7

feat(build): add details on how to build from a OSS forked release branch (#652) (#654)

Armory Igor - 2.21.2…2.21.2

Armory Kayenta - 2.21.2…2.21.2

Armory Orca - 2.21.4…2.21.4

Feedback

Was this page helpful?

Thank you for letting us know!

Sorry to hear that. Please tell us how we can improve.

Last modified March 4, 2021: (d84aa0d)