zuul/zuul
Code Issues Proposed changes

Add support for limiting dependency processing

Browse Source 
To protect Zuul servers from accidental DoS attacks in case someone,
say, uploads a 1k change tree to gerrit, add an option to limit the
dependency processing in the Gerrit driver and in Zuul itself (since
those are the two places where we recursively process deps).

Change-Id: I568bd80bbc75284a8e63c2e414c5ac940fc1429a
This commit is contained in:
James E. Blair
2023-08-14 14:51:48 -07:00
parent bf889081d8
commit 70c34607f5
12 changed files with 212 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
releasenotes/notes/max-dependencies-7e50194dbe23aaaf.yaml Normal file
View File

@@ -0,0 +1,10 @@
---
features:
- |
Two new settings are available to protect Zuul from resource
exhaustion from processing too many dependencies among changes.
The Gerrit driver supports setting :attr:`<gerrit
connection>.max_dependencies` to limit internal dependency
processing during event processing, and a new tenant setting of
:attr:`tenant.max-dependencies` is available to limit tenant
processing while enqueing changes in pipelines.