concourse-6.7.1/release-notes/v5.1.0.md

#### <sub><sup><a name="v510-note-1" href="#v510-note-1">:link:</a></sup></sub> fix, breaking

* tl;dr: `concourse web --peer-url` and `concourse web --tsa-peer-ip` are gone in favor of `concourse web --peer-address`

  We have been doing a lot of internal refactoring and decoupling between various components. One side effect of this is that the [`web` node](https://concourse-ci.org/concourse-web.html)s no longer need to stream user artifacts to one another, which was the only reason the `concourse web --peer-url` flag was needed, so it has been removed.

  However, the SSH gateways (the "TSAs"), which also run on the [`web` node](https://concourse-ci.org/concourse-web.html)s, still need their address for the forwarded worker connections advertised to other [`web` node](https://concourse-ci.org/concourse-web.html)s. This value used to be inferred by `--peer-url`, so we've added a new `--peer-address` flag for it.


#### <sub><sup><a name="v510-note-2" href="#v510-note-2">:link:</a></sup></sub> security, breaking

* The [`web` node](https://concourse-ci.org/concourse-web.html) now defaults `X-Frame-Options` to `deny` to safeguard against clicjacking attacks. If you run Concourse in an `iframe`, you'll notice that it doesn't work anymore.

  To configure `X-Frame-Options` otherwise, see [Ingress](https://concourse-ci.org/concourse-web.html#web-ingress).


#### <sub><sup><a name="v510-note-3" href="#v510-note-3">:link:</a></sup></sub> feature

* [Steps](https://concourse-ci.org/steps.html) can now be annotated with an [`on_error` step hook](https://concourse-ci.org/on-error-step-hook.html), thanks to a PR by @amanw!


#### <sub><sup><a name="v510-note-4" href="#v510-note-4">:link:</a></sup></sub> feature

* Each step in the build log will now show how long it took to initialize and run when hovering over the icon to the right of the header. Thanks for the PR, @mockersf!


#### <sub><sup><a name="v510-note-5" href="#v510-note-5">:link:</a></sup></sub> feature

* Resources can now be annotated with [**`icon`**](https://concourse-ci.org/resources.html#resource-icon) to put pretty little icons in your pipeline and make different resource types easier to distinguish. This was also a PR by @mockersf - thanks a bunch!


#### <sub><sup><a name="v510-note-6" href="#v510-note-6">:link:</a></sup></sub> feature, security

* Resource metadata will no longer be shown by default in exposed pipelines.

  Metadata should never contain credentials or any criticial information, but for some use cases it is not desireable to show e.g. commit messages and authors even though the pipeline is public.

  The resource must now have the [**`public`**](https://concourse-ci.org/resources.html#resource-public) value set in order to show metadata, just like jobs. One caveat is build output: if a job is public, any [`get` step](https://concourse-ci.org/get-step.html) and [`put` step](https://concourse-ci.org/put-step.html)s will still show their metadata.


#### <sub><sup><a name="v510-note-7" href="#v510-note-7">:link:</a></sup></sub> feature

* [`fly execute`](https://concourse-ci.org/running-tasks.html#fly-execute) will now upload inputs and download outputs in parallel.


#### <sub><sup><a name="v510-note-8" href="#v510-note-8">:link:</a></sup></sub> feature

* The [Concourse BOSH release](https://github.com/concourse/concourse-bosh-release) now packages Ubuntu-flavored images for each core resource type instead of Alpine. This is primarily for compliance reasons. Nothing should really be affected.

  The `.tgz` distribution continues to use Alpine so the tarball doesn't get even bigger. Once we minimize the amount of resource types we package with Concourse (see [(RF)RFC #23](https://github.com/concourse/rfcs/issues/23)) we'll be removing them and standardizing on Ubuntu for simplicity's sake.


#### <sub><sup><a name="v510-note-9" href="#v510-note-9">:link:</a></sup></sub> feature

* [Generic oAuth](https://concourse-ci.org/generic-oauth.html) can now be configured with different user ID/name keys. They default to `user_id` and `user_name`, just as before.


#### <sub><sup><a name="v510-note-10" href="#v510-note-10">:link:</a></sup></sub> feature

* [Generic OIDC auth](https://concourse-ci.org/generic-oidc-auth.html) can now be configured with a different user name key. It defaults to `username`, just as before.


#### <sub><sup><a name="v510-note-11" href="#v510-note-11">:link:</a></sup></sub> feature

* Previously, workers would garbage collect containers in volumes sequentially, destroying containers first and then volumes. This meant that if a worker had thousands of volumes to remove, it would go through and destroy them one by one - meanwhile, containers were not being garbage-collected.

  Containers and volumes are now garbage-collected in parallel to each other, with a default max-in-flight of 5 containers and 5 volumes at a time. This speeds up garbage-collection overall and prevents an imbalance in volume/container counts from slowing each other down. This is especially important as workers are typically capped at 250 containers, but may have thousands of volumes and may even have a slow disk.


#### <sub><sup><a name="v510-note-12" href="#v510-note-12">:link:</a></sup></sub> feature

* The [Vault credential manager](https://concourse-ci.org/vault-credential-manager.html) can now be configured with a global shared path for credential lookup. This should make sharing credentials between teams a bit easier to manage, in lieu of [RFC #21 (per-team credential managers)](https://github.com/concourse/rfcs/pull/21). Use with care! All teams will be able to access it.


#### <sub><sup><a name="v510-note-13" href="#v510-note-13">:link:</a></sup></sub> feature

* Pipelines now have a play/pause button at the top bar, so you don't have to go all the way back to the dashboard and find the pause button there. Thanks for the PR, @robwhitby!


#### <sub><sup><a name="v510-note-14" href="#v510-note-14">:link:</a></sup></sub> feature

* URLs in resource metadata are now clickable, thanks to a PR by @Twiknight!


#### <sub><sup><a name="v510-note-15" href="#v510-note-15">:link:</a></sup></sub> fix, security

* Fixed a minor information leak that would allow unauthenticated users to fetch the step names and structure for a build whose job is not marked [**`public`**](https://concourse-ci.org/jobs.html#job-public).

  This only exposed step names, but it was still a little weird to allow it to be fetched. It will now return a `401 Unauthorized` instead.


#### <sub><sup><a name="v510-note-16" href="#v510-note-16">:link:</a></sup></sub> fix

* Previously, manually-triggered builds would cause resource checking to be performed in the job scheduling loop. This ensured that manually triggered builds ran with the latest versions available, but it also slowed down scheduling for every other job in the pipeline, because they're all scheduled one-by-one.

  In the worst case, this meant a hanging resource check could result in all builds in the pipeline being stuck in the "pending" state for a long period of time (or, "like, forever").

  So we changed things around a bit: instead, the scheduler just won't start a manually triggered build until the "last checked" timestamp of each of its resources is after the build's "created at" timestamp. And to make that [go faster](https://www.youtube.com/watch?v=LY8P--R9L4Y), when a build is manually triggered we'll short-circuit the checking interval for each of its input resources.

  With this change, if/when a resource check is hanging or slow it at least won't gum up the pipeline scheduling for all the other jobs.

  Expect more improvements in this area in the next few releases! We'll be making jobs schedule in parallel soon so they can't affect each other, and we're working on a new ["algorithm"](https://github.com/concourse/concourse/tree/master/atc/db/algorithm) that should scale a *lot* better with pipelines that have a ton of data or versions.


#### <sub><sup><a name="v510-note-17" href="#v510-note-17">:link:</a></sup></sub> fix

* The above refactoring also fixed a race condition that could result in inputs configured with [`version: every`](https://concourse-ci.org/get-step.html#get-step-version) having versions skipped when a build is manually triggered.


#### <sub><sup><a name="v510-note-18" href="#v510-note-18">:link:</a></sup></sub> feature

* The [`fly` CLI](https://concourse-ci.org/fly.html) learned two new commands: [`fly delete-target`](https://concourse-ci.org/fly.html#fly-delete-target) and [`fly edit-target`](https://concourse-ci.org/fly.html#fly-edit-target). Thanks for the PR, @pivotal-kahin-ng!


#### <sub><sup><a name="v510-note-19" href="#v510-note-19">:link:</a></sup></sub> feature

* The [`fly intercept`](https://concourse-ci.org/builds.html#fly-intercept) command can now be given a specific container `--handle` to intercept, thanks to another PR by @pivotal-kahin-ng!


#### <sub><sup><a name="v510-note-20" href="#v510-note-20">:link:</a></sup></sub> feature

* The [`fly prune-worker`](https://concourse-ci.org/administration.html#fly-prune-worker) can now be given an `--all-stalled` or `-a` flag to prune all the stalled workers, thanks to a PR by @aledeganopix4d!


#### <sub><sup><a name="v510-note-21" href="#v510-note-21">:link:</a></sup></sub> fix

* [**`version`**](https://concourse-ci.org/get-step.html#get-step-version) on a [`get` step](https://concourse-ci.org/get-step.html) will now take precedence over versions pinned via the web UI or via [**`version`**](https://concourse-ci.org/resources.html#resource-version) on a resource definition.


#### <sub><sup><a name="v510-note-22" href="#v510-note-22">:link:</a></sup></sub> fix

* The HD dashboard view got a little weird in the last couple releases - it's fixed now.


#### <sub><sup><a name="v510-note-23" href="#v510-note-23">:link:</a></sup></sub> fix

* Fixed the spacing of the pipeline view so super tall pipelines don't get clipped by the top bar.


#### <sub><sup><a name="v510-note-24" href="#v510-note-24">:link:</a></sup></sub> fix

* Fixed the `status:running` search functionality on the dashboard view.


#### <sub><sup><a name="v510-note-25" href="#v510-note-25">:link:</a></sup></sub> fix

* When viewing a pipeline build by ID (`/builds/123`), the top bar will show the breadcrumb for its pipeline and job instead of being empty.


#### <sub><sup><a name="v510-note-26" href="#v510-note-26">:link:</a></sup></sub> fix

* The breadcrumb in the top bar now uses actual links, so they can be middle-clicked and right-clicked to your heart's content.


#### <sub><sup><a name="v510-note-27" href="#v510-note-27">:link:</a></sup></sub> fix

* The groups bar on the pipeline view now has hover states for each group.


#### <sub><sup><a name="v510-note-28" href="#v510-note-28">:link:</a></sup></sub> fix

* Fixed a bug that caused credential managers to be instantiated twice, resulting in two auth loops.


#### <sub><sup><a name="v510-note-29" href="#v510-note-29">:link:</a></sup></sub> fix

* When viewing a one-off build in the web UI, the build will now render instead of chucking errors in the browser console.


#### <sub><sup><a name="v510-note-30" href="#v510-note-30">:link:</a></sup></sub> fix

* The web UI is now up-to-date with Elm 0.19! You shouldn't really notice anything, but...yay!


#### <sub><sup><a name="v510-note-31" href="#v510-note-31">:link:</a></sup></sub> fix

* Fixed a crash that would occur when a build finished that produced outputs for a resource that had been un-configured from the pipeline in the meantime.


#### <sub><sup><a name="v510-note-32" href="#v510-note-32">:link:</a></sup></sub> fix

* The [`web` node](https://concourse-ci.org/concourse-web.html) will now retry on `unexpected EOF` errors which could occur when a worker was restarted while a build was running a container on it.


#### <sub><sup><a name="v510-note-33" href="#v510-note-33">:link:</a></sup></sub> fix

* Fixed a bug with the Vault login re-try logic that caused it to go into a fast loop after reaching the maximum interval. Now it'll actually stay at the maximum interval.


#### <sub><sup><a name="v510-note-34" href="#v510-note-34">:link:</a></sup></sub> fix

* When viewing a build for a job that has a ton of builds, only the first batch of builds will be fetched and rendered instead of all of them. Older builds will be automatically loaded if the build being viewed is old, or as the user scrolls to see them.


#### <sub><sup><a name="v510-note-35" href="#v510-note-35">:link:</a></sup></sub> feature

* We're now consistently using Material Design icons everywhere in our UI - the last of the Font Awesome stragglers have been replaced!


#### <sub><sup><a name="v510-note-36" href="#v510-note-36">:link:</a></sup></sub> fix

* Fixed quite a few quirks with the dashboard search:


  * Team name autocomplete will now work even if you're not logged in.


  * Fixed the unstyled autosuggest menu in Chrome.


  * Hitting the escape key will now un-focus the search field.


  * The search autocomplete will now only appear if you press a key with the search field focused.


  * Typing `?` into the search field will no longer bring up the hotkey help pane.


#### <sub><sup><a name="v510-note-37" href="#v510-note-37">:link:</a></sup></sub> fix

* [`fly execute`](https://concourse-ci.org/running-tasks.html#fly-execute) will now print the correct URL for the build when running with `-j`.


#### <sub><sup><a name="v510-note-38" href="#v510-note-38">:link:</a></sup></sub> fix

* [`fly login`](https://concourse-ci.org/fly.html#fly-login) will now create `~/.flyrc` with stricter permissions (`0600`).


#### <sub><sup><a name="v510-note-39" href="#v510-note-39">:link:</a></sup></sub> feature

* We've added a (hopefully subtle) stripey animation to running builds in the build number list to help differentiate between errored and running builds.


#### <sub><sup><a name="v510-note-40" href="#v510-note-40">:link:</a></sup></sub> feature

* [`fly set-pipeline`](https://concourse-ci.org/setting-pipelines.html#fly-set-pipeline) will now print a copy-pasteable [`fly unpause-pipeline`](https://concourse-ci.org/managing-pipelines.html#fly-unpause-pipeline) command, thanks to a PR by @benchristel!


#### <sub><sup><a name="v510-note-41" href="#v510-note-41">:link:</a></sup></sub> fix

* With [**v5.0.0**](https://github.com/concourse/concourse/releases/tag/v5.0.0) we introduced a bit of a performance regression with loading the versions for a pipeline during scheduling. We've made an incremental change to make it a bit faster.

  This will also be fixed by the new input candidate algorithm mentioned previously.


#### <sub><sup><a name="v510-note-42" href="#v510-note-42">:link:</a></sup></sub> fix

* The dashboard will no longer crash when a pipeline is configured with a circular dependency.


#### <sub><sup><a name="v510-note-43" href="#v510-note-43">:link:</a></sup></sub> fix

* Fixed the rendering of many, many pipeline groups.