PR #556

• Drop Python 2.x, awsebcli
• Add boto3 1.11.14
• Alpine 3.10.2 -> 3.11.3
• PyYAML 3.13 -> 5.2
• ansible 2.8.5 -> 2.9.4
• awscli 1.16.250 -> 1.17.14
• crudini 0.9 -> 0.9.3
• Jinja 2.10.1 -> 2.11.1
• google/cloud-sdk 276.0.0 -> 278.0.0

Users running Docker for Mac 2.2.0.0 or later can set

export GEODESIC_MAC_FORWARD_SOCKET=true

before running Geodesic and now SSH keys added to ssh-agent on the Mac host will be available from inside the Geodesic container. You no longer need to mount and unlock keys on every invocation of Geodesic.

The Docker server socket is also forwarded if $WITH_DOCKER == "true"

Thanks to @tamsky #534

#552 Allow configuration of helm binary for destroy-namespace by setting HELM_BINARY env var

Note

Support for aws-vault version 4 was removed in this release, but restored in version 0.130.0. See #579.

Breaking Change

Update to helm 3, aws-vault 5 (#546)

helm version 2 is available as helm2 or you can set it as helm using

update-alternatives --set helm /usr/share/helm/2/bin/helm2

helm version 3 is available as helm3 and by default as helm

You can tell helmfile which helm version to use via the -b flag

helmfile -b helm2 ...

If you were installing helm yourself, using something like

apk add helm@cloudposse==2.14.3-r0

then that version of helm will be used as helm. It will share plugins with helm2 or helm3 depending on which version it is.

Update package manager indexes to bring in updated packages

Update kops, kubectl, and terraform. (#529)

Bumps awscli from 1.16.226 to 1.16.230.

• Release notes
• Changelog
• Commits

Signed-off-by: dependabot-preview[bot] [email protected]

what

• Update multiple tools from https://github.com/cloudposse/packages/pull/233
• Update aws-cli 1.16.209 -> 1.16.226
• Update ansible 2.7.12 -> 2.8.4

why

Bring in bug and security fixes and new features

Security note

PyYAML is pinned to version 3.13 because that is the latest version that awsebcli supports. This version of PyYAML has a known vulnerability, CVE-2017-18342, summarized as "the yaml.load() API could execute arbitrary code if used with untrusted data."

At the moment, the only tools Geodesic ships with that use PyYAML (as far as we have been able to determine) are awscli and awsebcli. (The yq command included in Geodesic is a golang tool and not the python-yq that uses PyYAML.)

• awscli says their tool is not affected by the vulnerability: https://github.com/aws/aws-cli/issues/3828
• We can find no public statement about awsebcli and CVE-2017-18342

Users of awsebcli or who install their own Python packages should take appropriate precautions.

Special note about this release:

Due to operational errors, the 0.121.0 release was incorrectly published twice, once as 1.121.0 and once as 0.121.0 but pointing to the wrong commit. Users may want to avoid this release in favor of the prior 0.120.4 or next 0.122.0 release to avoid confusion. However, you can verify which version you have by examining these points:

• The correct commit for release 0.121.0 is 4f55f6a44cd56a8529c3ff0e4c2961c06bc4386d
• 0.121.0 has awscli==1.16.226 while the previous release has awscli==1.16.209
• 0.121.0 does not have rootfs/usr/local/bin/codefresh-pipeline while the next release does

A typo in grafana-db broke downloading Grafana dashboards from arbitrary URLs.

Fixed in #517

Fix TF_BUCKET_PREFIX for Atlantis #512