feat(helmfile): Change default subdomain names. Attention, consult docs/migrations.md for upgrade deployments.

2025-12-06 07:21:36 +01:00 · 2024-08-28 11:33:39 +02:00
parent 8bca56d4ac
commit 3d84e804c2
5 changed files with 132 additions and 24 deletions
--- a/docs/migrations.md
+++ b/docs/migrations.md
@@ -5,12 +5,15 @@ SPDX-License-Identifier: Apache-2.0

 <h1>Upgrade migrations</h1>

+<!-- TOC -->
 * [Disclaimer](#disclaimer)
 * [Releases upgrades](#releases-upgrades)
  * [From v0.9.0](#from-v090)
    * [Changed openDesk defaults](#changed-opendesk-defaults)
      * [MatrixID localpart update](#matrixid-localpart-update)
-      * [Fileshare configurability](#fileshare-configurability)
+      * [File-share configurability](#file-share-configurability)
+      * [Updated default subdomains in `global.hosts`](#updated-default-subdomains-in-globalhosts)
+      * [Updated `global.imagePullSecrets`](#updated-globalimagepullsecrets)
    * [Automated migrations](#automated-migrations)
      * [Local Postfix as Relay](#local-postfix-as-relay)
      * [Updated IAM component Nubus](#updated-iam-component-nubus)
@@ -21,6 +24,7 @@ SPDX-License-Identifier: Apache-2.0
    * [`migrations` S3 bucket](#migrations-s3-bucket)
 * [Related components and artefacts](#related-components-and-artefacts)
  * [Development](#development)
+<!-- TOC -->

 # Disclaimer

@@ -28,8 +32,9 @@ We do not offer support for upgrades before we reach openDesk 1.0.

 Though we try to ease the pain when it comes to 0.x upgrades. That is what this document is for.

-Limitations:
- We assume that the PV reclaim policy is set to `delete`, so expect that PVs get deleted as soon as the related PVC was deleted and will cover an explicit delete for PVs.
+**Limitations:**
+- We assume that the PV reclaim policy is set to `delete`, so expect that PVs get deleted as soon as the related PVC was
+  deleted and will cover an explicit delete for PVs.

 # Releases upgrades

@@ -40,16 +45,16 @@ Limitations:
 #### MatrixID localpart update

 Until 0.9.0 openDesk used the LDAP entryUUID of a user to generate the user's MatrixID. Due to restrictions of the
-Matrix protocol an update of a MatrixID is not possible, therefore it was technically convenient to use the UUID
+Matrix protocol, an update of a MatrixID is not possible, therefore, it was technically convenient to use the UUID
 as it is immutable (see https://de.wikipedia.org/wiki/Universally_Unique_Identifier for more details on UUIDs.)

-From the user experience perspective that was a bad approach, so from now on by default the username, that
-is also used for logging into openDesk, is used to define the localpart of the MatrixID.
+From the user experience perspective, that was a bad approach, so from now on, by default, the username which
+is also used for logging into openDesk is used to define the localpart of the MatrixID.

 For existing installations: The changed setting only affects users that login to Element the first time. Existing
 user accounts will not be harmed. If you want existing users to get new MatrixIDs based on the new setting, you
-need to update their external ID in Synapse and deactivate the old user afterwards. The user will get a new
-Matrix account from the scratch, losing the existing contacts, chats and rooms.
+need to update their external ID in Synapse and deactivate the old user afterward. The user will get a new
+Matrix account from scratch, losing the existing contacts, chats and rooms.

 The following Admin API calls are helpful:
 - GET /_synapse/admin/v2/users/@<entryuuid>:<matrixdomain> get the user's existing external_id (auth_provider: "oidc")
@@ -58,7 +63,7 @@ The following Admin API calls are helpful:
 - POST /_synapse/admin/v1/deactivate/@<entryuuid>:<matrixdomain> deactivate old user with JSON payload:
  `{ "erase": true }`

-For more details check the Admin API documentation:
+For more details, check the Admin API documentation:
 https://element-hq.github.io/synapse/latest/usage/administration/admin_api/index.html

 You can enforce the old standard with the following setting:
@@ -70,11 +75,12 @@ functional:
        useImmutableIdentifierForLocalpart: true
 ```

-#### Fileshare configurability
+#### File-share configurability

-We provide now some configurability regarding the sharing capabilities of the Nextcloud component.
+Now we provide some configurability regarding the sharing capabilities of the Nextcloud component.

-The new default is different from the standard until now. To keep the current state after the upgrade from 0.9.0 you have to provide the following settings:
+The new default is different from the standard until now.
+To keep the current state after the upgrade from 0.9.0, you have to provide the following settings:

 ```
 functional:
@@ -86,6 +92,64 @@ functional:
      enforceSharingPasswords: false
 ```

+#### Updated default subdomains in `global.hosts`
+
+We have streamlined the subdomain names used by openDesk to be more user-friendly and to avoid the use of specific
+product names.
+
+This results in following change of default subdomain naming:
+
+- **collabora**: `collabora` → `office`
+- **cryptpad**: `cryptpad` → `pad`
+- **minioApi**: `minio` → `objectstore`
+- **minioConsole**: `minio-console` → `objectstore-ui`
+- **nextcloud**: `fs` → `files`
+- **openproject**: `project` → `projects`
+
+During upgrade, any existing environment needs to keep the old subdomains,
+cause url/link changes are not every supported and not tested at all.
+
+If you have not already defined the entire `global.hosts` dictionary in your custom environments values, please set it
+to the defaults that were used before the upgrade:
+
+```yaml
+global:
+  hosts:
+    collabora: "collabora"
+    cryptpad: "cryptpad"
+    element: "chat"
+    intercomService: "ics"
+    jitsi: "meet"
+    keycloak: "id"
+    matrixNeoBoardWidget: "matrix-neoboard-widget"
+    matrixNeoChoiceWidget: "matrix-neochoice-widget"
+    matrixNeoDateFixBot: "matrix-neodatefix-bot"
+    matrixNeoDateFixWidget: "matrix-neodatefix-widget"
+    minioApi: "minio"
+    minioConsole: "minio-console"
+    nextcloud: "fs"
+    openproject: "project"
+    openxchange: "webmail"
+    synapse: "matrix"
+    synapseFederation: "matrix-federation"
+    univentionManagementStack: "portal"
+    whiteboard: "whiteboard"
+    xwiki: "wiki"
+```
+
+#### Updated `global.imagePullSecrets`
+
+Without using a custom registry, you can pull all the openDesk images without authentication.
+Thus defining not existing imagePullSecrets creates unnecessary errors, so we removed them.
+
+You can keep the current settings by setting the `external-registry` in your custom environment values:
+
+```yaml
+global:
+  imagePullSecrets:
+    - "external-registry"
+```
+
 ### Automated migrations

 #### Local Postfix as Relay
--- a/helmfile/apps/element/values-matrix-neodatefix-bot-bootstrap.yaml.gotmpl
+++ b/helmfile/apps/element/values-matrix-neodatefix-bot-bootstrap.yaml.gotmpl
@@ -19,7 +19,7 @@ global:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}

 image:
-  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.synapseCreateUser.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.synapseCreateUser.registry | quote }}
  url: {{ .Values.images.synapseCreateUser.repository | quote }}
  tag: {{ .Values.images.synapseCreateUser.tag | quote }}
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
--- a/helmfile/apps/element/values-matrix-user-verification-service-bootstrap.yaml.gotmpl
+++ b/helmfile/apps/element/values-matrix-user-verification-service-bootstrap.yaml.gotmpl
@@ -19,7 +19,7 @@ global:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}

 image:
-  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.synapseCreateUser.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.synapseCreateUser.registry | quote }}
  url: {{ .Values.images.synapseCreateUser.repository | quote }}
  tag: {{ .Values.images.synapseCreateUser.tag | quote }}
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
--- a/helmfile/apps/services/values-certificates.yaml.gotmpl
+++ b/helmfile/apps/services/values-certificates.yaml.gotmpl
@@ -7,7 +7,48 @@ SPDX-License-Identifier: Apache-2.0
 global:
  domain: {{ .Values.global.domain | quote }}
  hosts:
-    {{ .Values.global.hosts | toYaml | nindent 4 }}
+    {{- if .Values.collabora.enabled }}
+    collabora: {{ .Values.global.hosts.collabora }}
+    {{- end }}
+    {{- if .Values.cryptpad.enabled }}
+    cryptpad: {{ .Values.global.hosts.cryptpad }}
+    {{- end }}
+    {{- if .Values.element.enabled }}
+    element: {{ .Values.global.hosts.element }}
+    matrixNeoBoardWidget: {{ .Values.global.hosts.matrixNeoBoardWidget }}
+    matrixNeoChoiceWidget: {{ .Values.global.hosts.matrixNeoChoiceWidget }}
+    matrixNeoDateFixBot: {{ .Values.global.hosts.matrixNeoDateFixBot }}
+    matrixNeoDateFixWidget: {{ .Values.global.hosts.matrixNeoDateFixWidget }}
+    synapse: {{ .Values.global.hosts.synapse }}
+    synapseFederation: {{ .Values.global.hosts.synapseFederation }}
+    whiteboard: {{ .Values.global.hosts.whiteboard }}
+    {{- end }}
+    {{- if .Values.intercom.enabled }}
+    intercomService: {{ .Values.global.hosts.intercomService }}
+    {{- end }}
+    {{- if .Values.jitsi.enabled }}
+    jitsi: {{ .Values.global.hosts.jitsi }}
+    {{- end }}
+    {{- if .Values.minio.enabled }}
+    minioApi: {{ .Values.global.hosts.minioApi }}
+    minioConsole: {{ .Values.global.hosts.minioConsole }}
+    {{- end }}
+    {{- if .Values.nextcloud.enabled }}
+    nextcloud: {{ .Values.global.hosts.nextcloud }}
+    {{- end }}
+    {{- if .Values.openproject.enabled }}
+    openproject: {{ .Values.global.hosts.openproject }}
+    {{- end }}
+    {{- if .Values.oxAppsuite.enabled }}
+    openxchange: {{ .Values.global.hosts.openxchange }}
+    {{- end }}
+    {{- if .Values.nubus.enabled }}
+    keycloak: {{ .Values.global.hosts.keycloak }}
+    nubus: {{ .Values.global.hosts.nubus }}
+    {{- end }}
+    {{- if .Values.xwiki.enabled }}
+    xwiki: {{ .Values.global.hosts.xwiki }}
+    {{- end }}

 issuerRef:
  name: {{ .Values.certificate.issuerRef.name | quote }}
--- a/helmfile/environments/default/global.gotmpl
+++ b/helmfile/environments/default/global.gotmpl
@@ -1,4 +1,5 @@
 {{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
@@ -24,11 +25,14 @@ global:
  helmRegistry: {{ env "PRIVATE_HELM_REGISTRY_URL" | quote }}
  imageRegistry: {{ env "PRIVATE_IMAGE_REGISTRY_URL" | quote }}

-  ## Define ingress/virtualservice host.
+  ## Define ingress host.
+  # Beware: Changing hostnames on an existing deployment will break links the users may already make use of.
+  #         Also some links are used directly in the portal and do not get updated after the initial
+  #         deployment.
  #
  hosts:
-    collabora: "collabora"
-    cryptpad: "cryptpad"
+    collabora: "office"
+    cryptpad: "pad"
    element: "chat"
    intercomService: "ics"
    jitsi: "meet"
@@ -37,11 +41,11 @@ global:
    matrixNeoChoiceWidget: "matrix-neochoice-widget"
    matrixNeoDateFixBot: "matrix-neodatefix-bot"
    matrixNeoDateFixWidget: "matrix-neodatefix-widget"
-    minioApi: "minio"
-    minioConsole: "minio-console"
-    nextcloud: "fs"
+    minioApi: "objectstore"
+    minioConsole: "objectstore-ui"
+    nextcloud: "files"
    nubus: "portal"
-    openproject: "project"
+    openproject: "projects"
    openxchange: "webmail"
    synapse: "matrix"
    synapseFederation: "matrix-federation"
@@ -51,8 +55,7 @@ global:
  ## Credentials to fetch images from private registry
  ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
  #
-  imagePullSecrets:
-    - "external-registry"
+  imagePullSecrets: []

  ## Define the policy to pull container images.
  ## Ref: https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy