Merge pull request #192 from wireapp/release_2020_03_02

Release_2020_03_02

CHANGELOG.md

@@ -1,3 +1,24 @@
+# 2020-03-02
+
+## Breaking changes / known issues when upgrading
+
+- upgrading an existing Helm release of `wire-server` needs to be enforced (i.e. `--force`) or done by reinstalling it
+
+## Features
+
+- enable Helm v3 support
+- Helm charts:
+  - nginz: Expose internal sso settings and custom backends (#178, #191)
+  - brig: New option setUserMaxPermClients is now available for brig (#185)
+  - cannon: comply with K8s StatefulSetSpec (#187)
+
+## Other updates
+
+- Skip flaky test in brig-integration (#184)
+- Ansible: fix mc policy set (#181) - thanks @kvaps
+- Ansible: Fix setting heap size for ES (#188)
+
+
 # 2020-01-09
 
 ## Features

ansible/download_kubespray.yml

@@ -1,4 +1,6 @@
 # download a specific version of kubespray
+# Note: installing it via ansible-galaxy would re-arrange its content (roles/etcd is misplaced)
+#       the reason for this behaviour is yet to be known
 # Usage: see Makefile
 - name: download kubespray
   hosts: localhost
@@ -9,7 +11,7 @@
     # uses
     # kube_version = "v1.14.2"
     # helm_version = "v2.13.1"
-    # (if needed, these can be overridding in the hosts.ini under the [k8s-cluster:vars] section)
+    # (if needed, these can be overridden in the hosts.ini under the [k8s-cluster:vars] section)
     # also see download_cli_binaries.yml to see client-side versions of `kubectl` and `helm`.
     kubespray_version: e2f5a9748e4dbfe2fdba7931198b0b5f1f4bdc7e
   tasks:

ansible/elasticsearch.yml

@@ -4,9 +4,7 @@
   vars:
     # The following sets java heap size to 1GB (default is 2GB)
     # comment that line when deploying on machines with >= 4GB memory.
-    es_jvm_custom_parameters:
-      - "-Xmx1g"
-      - "-Xms1g"
+    es_heap_size: "1g"
 
     es_enable_xpack: false
     es_xpack_features: [] # disable features

ansible/hosts.example.ini

@@ -21,10 +21,15 @@ restund02         ansible_host=X.X.X.X
 # * 'ip' is the IP to bind to (if multiple network interfaces are in use)
 #   omit 'ip' if you only have one network interface
 #   FIXME: note that kubespray has a test for if IP == ANSIBLE_HOST?
+kubenode01        ansible_host=X.X.X.X ip=Y.Y.Y.Y
+kubenode02        ansible_host=X.X.X.X ip=Y.Y.Y.Y
+kubenode03        ansible_host=X.X.X.X ip=Y.Y.Y.Y
+
+# etcd resides on dedicated machines
 # * etcd_member_name needs to be set on all hosts that run etcd (and must be different)
-kubenode01        ansible_host=X.X.X.X ip=Y.Y.Y.Y etcd_member_name=etcd1
-kubenode02        ansible_host=X.X.X.X ip=Y.Y.Y.Y etcd_member_name=etcd2
-kubenode03        ansible_host=X.X.X.X ip=Y.Y.Y.Y etcd_member_name=etcd3
+etcd01            ansible_host=X.X.X.X ip=Y.Y.Y.Y etcd_member_name=etcd1
+etcd02            ansible_host=X.X.X.X ip=Y.Y.Y.Y etcd_member_name=etcd2
+etcd03            ansible_host=X.X.X.X ip=Y.Y.Y.Y etcd_member_name=etcd3
 
 ### databases ###
 
@@ -81,9 +86,9 @@ kubenode03
 # must be an odd number of servers! (playbooks will fail otherwise)
 # See https://coreos.com/etcd/docs/latest/v2/admin_guide.html#optimal-cluster-size
 [etcd]
-kubenode01
-kubenode02
-kubenode03
+etcd01
+etcd02
+etcd03
 
 [kube-node]
 kubenode01

ansible/minio.yml

@@ -60,7 +60,7 @@
       tags: mc-config
 
     - name: "make the 'public' bucket world-accessible"
-      shell: "mc policy public local/public"
+      shell: "mc policy set public local/public"
       run_once: true
       tags: mc-config
 

charts/brig/templates/configmap.yaml

@@ -182,5 +182,8 @@ data:
       {{- if .setSearchSameTeamOnly }}
       setSearchSameTeamOnly: {{ .setSearchSameTeamOnly }}
       {{- end }}
+      {{- if .setUserMaxPermClients }}
+      setUserMaxPermClients: {{ .setUserMaxPermClients }}
+      {{- end }}
     {{- end }}
   {{- end }}

charts/brig/templates/tests/brig-integration.yaml

@@ -51,7 +51,9 @@ spec:
     # to get certain behaviour. This doesn't work on kubernetes because brig
     # is a different pod than brig-integration and they can't both mouht the
     # same file-system.
-    command: ["brig-integration", "--pattern", "!/turn/"]
+    # The other test, "user.auth.cookies.limit", is skipped as it is flaky.
+    # This is tracked in https://github.com/zinfra/backend-issues/issues/1150.
+    command: ["brig-integration", "--pattern", "!/turn/ && !/user.auth.cookies.limit/"]
     volumeMounts:
     - name: "brig-integration"
       mountPath: "/etc/wire/integration"

charts/brig/values.yaml

@@ -69,6 +69,8 @@ config:
     setDeleteThrottleMillis: 100
     # Allow search within same team only. Default: false
     # setSearchSameTeamOnly: false|true
+    # Set max number of user clients. Default: 7
+    # setUserMaxPermClients: <int>
   smtp:
     passwordFile: /etc/wire/brig/secrets/smtp-password.txt
 turnStatic:

charts/cannon/templates/statefulset.yaml

@@ -21,6 +21,7 @@ spec:
   replicas: {{ .Values.replicaCount }}
   updateStrategy:
     type: RollingUpdate
+  podManagementPolicy: Parallel
   template:
     metadata:
       labels:
@@ -29,7 +30,6 @@ spec:
       annotations:
         checksum/configmap: {{ include (print .Template.BasePath "/configmap.yaml") . | sha256sum }}
     spec:
-      podManagementPolicy: Parallel
       terminationGracePeriodSeconds: {{ .Values.drainTimeout }} # should be higher than the sleep duration of preStop
       containers:
       - name: cannon

charts/nginz/values.yaml

@@ -280,6 +280,15 @@ nginx_conf:
       - staging
       disable_zauth: true
       basic_auth: true
+    - path: ~* ^/custom-backend/by-domain/([^/]*)$
+      disable_zauth: true
+      envs:
+      - all
+    - path: ~* ^/i/custom-backend/by-domain/([^/]*)$
+      disable_zauth: true
+      basic_auth: true
+      envs:
+      - staging
     - path: ~* ^/teams/api-docs
       envs:
       - all
@@ -303,13 +312,36 @@ nginx_conf:
       max_body_size: 256k
       envs:
       - all
+    - path: /i/sso
+      disable_zauth: true
+      basic_auth: true
+      envs:
+      - staging
     - path: /sso-initiate-bind
       envs:
       - all
+    - path: /sso/initiate-login
+      envs:
+      - all
+      disable_zauth: true
+      allow_credentials: true
+    - path: /sso/finalize-login
+      envs:
+      - all
+      disable_zauth: true
+      allow_credentials: true
     - path: /sso
       envs:
       - all
       disable_zauth: true
+    - path: /scim/v2
+      envs:
+      - all
+      disable_zauth: true
+      allow_credentials: true
+    - path: /scim
+      envs:
+      - all
     proxy:
     - path: /proxy
       envs:

terraform/examples/create-infrastructure.tf

@@ -28,6 +28,17 @@ resource "hcloud_server" "node" {
   location = "nbg1"
 }
 
+resource "hcloud_server" "etcd" {
+  count       = 3
+  name        = "etcd${count.index}"
+  image       = "ubuntu-18.04"
+  server_type = "cx41"
+  ssh_keys    = ["hetznerssh-key"]
+
+  # Nuremberg (for choices see `hcloud datacenter list`)
+  location = "nbg1"
+}
+
 resource "hcloud_server" "redis" {
   count       = 0
   name        = "redis${count.index}"
@@ -88,6 +99,14 @@ resource "null_resource" "vpnkube" {
 
   triggers = {
     ip     = "10.10.1.${10 + count.index}"
+  }
+}
+
+resource "null_resource" "vpnetcd" {
+  count = "${length(hcloud_server.etcd)}"
+
+  triggers = {
+    ip     = "10.10.1.${60 + count.index}"
     member = "etcd_${count.index}"
   }
 }
@@ -128,14 +147,15 @@ data "template_file" "inventory" {
   template = "${file("inventory.tpl")}"
 
   vars = {
-    connection_strings_node          = "${join("\n", formatlist("%s ansible_host=%s vpn_ip=%s ip=%s etcd_member_name=%s", hcloud_server.node.*.name, hcloud_server.node.*.ipv4_address, null_resource.vpnkube.*.triggers.ip, null_resource.vpnkube.*.triggers.ip, null_resource.vpnkube.*.triggers.member))}"
+    connection_strings_node          = "${join("\n", formatlist("%s ansible_host=%s vpn_ip=%s ip=%s", hcloud_server.node.*.name, hcloud_server.node.*.ipv4_address, null_resource.vpnkube.*.triggers.ip, null_resource.vpnkube.*.triggers.ip))}"
+    connection_strings_etcd          = "${join("\n", formatlist("%s ansible_host=%s vpn_ip=%s ip=%s etcd_member_name=%s", hcloud_server.etcd.*.name, hcloud_server.etcd.*.ipv4_address, null_resource.vpnetcd.*.triggers.ip, null_resource.vpnetcd.*.triggers.ip, null_resource.vpnetcd.*.triggers.member))}"
     connection_strings_cassandra     = "${join("\n", formatlist("%s ansible_host=%s vpn_ip=%s", hcloud_server.cassandra.*.name, hcloud_server.cassandra.*.ipv4_address, null_resource.vpncass.*.triggers.ip))}"
     connection_strings_elasticsearch = "${join("\n", formatlist("%s ansible_host=%s vpn_ip=%s", hcloud_server.elasticsearch.*.name, hcloud_server.elasticsearch.*.ipv4_address, null_resource.vpnes.*.triggers.ip))}"
     connection_strings_minio         = "${join("\n", formatlist("%s ansible_host=%s vpn_ip=%s", hcloud_server.minio.*.name, hcloud_server.minio.*.ipv4_address, null_resource.vpnminio.*.triggers.ip))}"
     connection_strings_redis         = "${join("\n", formatlist("%s ansible_host=%s vpn_ip=%s", hcloud_server.redis.*.name, hcloud_server.redis.*.ipv4_address, null_resource.vpnredis.*.triggers.ip))}"
     connection_strings_restund       = "${join("\n", formatlist("%s ansible_host=%s", hcloud_server.restund.*.name, hcloud_server.restund.*.ipv4_address))}"
     list_master                      = "${join("\n",hcloud_server.node.*.name)}"
-    list_etcd                        = "${join("\n",hcloud_server.node.*.name)}"
+    list_etcd                        = "${join("\n",hcloud_server.etcd.*.name)}"
     list_node                        = "${join("\n",hcloud_server.node.*.name)}"
     list_cassandra                   = "${join("\n",hcloud_server.cassandra.*.name)}"
     list_elasticsearch               = "${join("\n",hcloud_server.elasticsearch.*.name)}"

terraform/examples/inventory.tpl

@@ -1,5 +1,6 @@
 [all]
 ${connection_strings_node}
+${connection_strings_etcd}
 ${connection_strings_minio}
 ${connection_strings_elasticsearch}
 ${connection_strings_cassandra}