Fix wsd ci

.github/workflows/ci.yml

@@ -25,6 +25,11 @@ jobs:
         run: nix-build -A env
       - name: Install the environment
         run: nix-env -f . -A env -i
+      - name: Install terraform
+        uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_version: "^1.3.7"
+          terraform_wrapper: false
       - name: Check terraform init
         run: |
           cd terraform/environment

.github/workflows/offline.yml

@@ -57,6 +57,12 @@ jobs:
         env:
           DOCKER_LOGIN: '${{ secrets.DOCKER_LOGIN }}'
 
+      - name: Install terraform
+        uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_version: "^1.3.7"
+          terraform_wrapper: false
+
       - name: Deploy offline environment to hetzner
         run: |
           ./offline/cd.sh

ansible/seed-offline-containerd.yml

@@ -32,12 +32,12 @@
 ####################################################################################################
 
 
-- name: Download restund container
-  hosts: restund
-  tags: restund-containers
-  tasks:
-    - name: load restund container
-      shell: |
-        for container in $(curl -q {{ assethost_host }}/containers-other/index.txt);do
-          curl -q "{{ assethost_host }}/containers-other/$container" | ctr -n=k8s.io images import -
-        done
+#- name: Download restund container
+#  hosts: restund
+#  tags: restund-containers
+#  tasks:
+#    - name: load restund container
+#      shell: |
+#        for container in $(curl -q {{ assethost_host }}/containers-other/index.txt);do
+#          curl -q "{{ assethost_host }}/containers-other/$container" | ctr -n=k8s.io images import -
+#        done

bin/offline-cluster.sh

@@ -38,7 +38,7 @@ ansible-playbook -i $INVENTORY_FILE $ANSIBLE_DIR/setup-offline-sources.yml
 ansible-playbook -i $INVENTORY_FILE $ANSIBLE_DIR/kubernetes.yml --tags bastion,bootstrap-os,preinstall,container-engine
 
 # Install docker on the restund nodes
-ansible-playbook -i $INVENTORY_FILE $ANSIBLE_DIR/restund.yml --tags docker
+# ansible-playbook -i $INVENTORY_FILE $ANSIBLE_DIR/restund.yml --tags docker
 
 # With ctr being installed on all nodes that need it, seed all container images:
 ansible-playbook -i $INVENTORY_FILE $ANSIBLE_DIR/seed-offline-containerd.yml
@@ -53,7 +53,7 @@ ansible-playbook -i $INVENTORY_FILE $ANSIBLE_DIR/kubernetes.yml --skip-tags boot
 ansible-playbook -i $INVENTORY_FILE $ANSIBLE_DIR/cassandra.yml
 ansible-playbook -i $INVENTORY_FILE $ANSIBLE_DIR/elasticsearch.yml
 ansible-playbook -i $INVENTORY_FILE $ANSIBLE_DIR/minio.yml
-ansible-playbook -i $INVENTORY_FILE $ANSIBLE_DIR/restund.yml
+# ansible-playbook -i $INVENTORY_FILE $ANSIBLE_DIR/restund.yml
 
 # create helm values that tell our helm charts what the IP addresses of cassandra, elasticsearch and minio are:
 ansible-playbook -i $INVENTORY_FILE $ANSIBLE_DIR/helm_external.yml --skip-tags=rabbitmq-external

bin/offline-helm.sh

@@ -11,7 +11,13 @@ helm upgrade --install --wait demo-smtp ./charts/demo-smtp --values ./values/dem
 helm upgrade --install --wait rabbitmq ./charts/rabbitmq --values ./values/rabbitmq/prod-values.example.yaml --values ./values/rabbitmq/prod-secrets.example.yaml
 helm upgrade --install --wait databases-ephemeral ./charts/databases-ephemeral --values ./values/databases-ephemeral/prod-values.example.yaml
 helm upgrade --install --wait reaper ./charts/reaper
-helm upgrade --install --wait --timeout=15m0s wire-server ./charts/wire-server --values ./values/wire-server/prod-values.example.yaml --values ./values/wire-server/secrets.yaml
+helm upgrade --install wire-server ./charts/wire-server --values ./values/wire-server/prod-values.example.yaml --values ./values/wire-server/secrets.yaml
+sleep 5m
+./bin/debug_logs.sh
+sleep 5m
+./bin/debug_logs.sh
+sleep 5m
+./bin/debug_logs.sh
 # if charts/webapp directory exists
 if [ -d "./charts/webapp" ]; then
     helm upgrade --install --wait --timeout=15m0s webapp ./charts/webapp --values ./values/webapp/prod-values.example.yaml
@@ -30,6 +36,6 @@ helm upgrade --install --wait --timeout=15m0s ingress-nginx-controller ./charts/
 
 echo "Printing all pods status: "
 kubectl get pods --all-namespaces -o wide
-#./bin/debug_logs.sh
+./bin/debug_logs.sh
 # TODO: Requires certs; which we do not have in CI/CD at this point. future work =) (Would need cert-manager in offline package. That'd be neat)
 # helm upgrade --install --wait nginx-ingress-services ./charts/nginx-ingress-services --values ./values/nginx-ingress-services/values.yaml  --values ./values/nginx-ingress-services/secrets.yaml

bin/offline-secrets.sh

@@ -31,6 +31,9 @@ brig:
       secret: "$zrest"
     awsKeyId: dummykey
     awsSecretKey: dummysecret
+    rabbitmq:
+      username: wire-server
+      password: verysecurepassword
     # These are only necessary if you wish to support sign up via SMS/calls
     # And require accounts at twilio.com / nexmo.com
     setTwilio: |-
@@ -39,6 +42,11 @@ brig:
     setNexmo: |-
       key: "dummy"
       secret: "dummy"
+cannon:
+  secrets:
+    rabbitmq:
+      username: wire-server
+      password: verysecurepassword
 cargohold:
   secrets:
     awsKeyId: "$minio_access_key"
@@ -47,10 +55,16 @@ galley:
   secrets:
     awsKeyId: dummykey
     awsSecretKey: dummysecret
+    rabbitmq:
+      username: wire-server
+      password: verysecurepassword
 gundeck:
   secrets:
     awsKeyId: dummykey
     awsSecretKey: dummysecret
+    rabbitmq:
+      username: wire-server
+      password: very-secure-password
 nginz:
   secrets:
     zAuth:

offline/ci.sh

@@ -3,8 +3,8 @@ set -euo pipefail
 
 INCREMENTAL="${INCREMENTAL:-0}"
 
-# Default exclude list
-HELM_CHART_EXCLUDE_LIST="inbucket"
+# Default exclude list, temporary wire-server-enterprise exclusion due to access privileges
+HELM_CHART_EXCLUDE_LIST="inbucket,wire-server-enterprise"
 
 # Parse the HELM_CHART_EXCLUDE_LIST argument
 for arg in "$@"
@@ -156,7 +156,7 @@ wire_build_chart_release () {
   wire_build="$1"
   curl "$wire_build" | jq -r --argjson HELM_CHART_EXCLUDE_LIST "$HELM_CHART_EXCLUDE_LIST" '
   .helmCharts
-  | with_entries(select([.key] | inside($HELM_CHART_EXCLUDE_LIST) | not))
+  | with_entries(select(.key as $k | $HELM_CHART_EXCLUDE_LIST | index($k) | not))
   | to_entries
   | map("\(.key) \(.value.repo) \(.value.version)")
   | join("\n")

values/wire-server/prod-secrets.example.yaml

@@ -28,6 +28,12 @@ brig:
     #   username: wire-server
     #   password: verysecurepassword
 
+cannon:
+  secrets:
+    rabbitmq:
+      username: wire-server
+      password: verysecurepassword
+
 cargohold:
   secrets:
     # these only need to be changed if using real AWS services
@@ -49,6 +55,9 @@ gundeck:
     # these only need to be changed if using real AWS services
     awsKeyId: dummykey
     awsSecretKey: dummysecret
+    rabbitmq:
+      username: wire-server
+      password: verysecurepassword
 
 proxy:
   secrets: