From 3d84e804c2e93d758e42a477888faf681aa56e7e Mon Sep 17 00:00:00 2001 From: Dominik Kaminski Date: Wed, 28 Aug 2024 11:33:39 +0200 Subject: [PATCH] feat(helmfile): Change default subdomain names. Attention, consult docs/migrations.md for upgrade deployments. --- docs/migrations.md | 88 ++++++++++++++++--- ...atrix-neodatefix-bot-bootstrap.yaml.gotmpl | 2 +- ...verification-service-bootstrap.yaml.gotmpl | 2 +- .../services/values-certificates.yaml.gotmpl | 43 ++++++++- helmfile/environments/default/global.gotmpl | 21 +++-- 5 files changed, 132 insertions(+), 24 deletions(-) diff --git a/docs/migrations.md b/docs/migrations.md index 50df2b21..d089a6eb 100644 --- a/docs/migrations.md +++ b/docs/migrations.md @@ -5,12 +5,15 @@ SPDX-License-Identifier: Apache-2.0

Upgrade migrations

+ * [Disclaimer](#disclaimer) * [Releases upgrades](#releases-upgrades) * [From v0.9.0](#from-v090) * [Changed openDesk defaults](#changed-opendesk-defaults) * [MatrixID localpart update](#matrixid-localpart-update) - * [Fileshare configurability](#fileshare-configurability) + * [File-share configurability](#file-share-configurability) + * [Updated default subdomains in `global.hosts`](#updated-default-subdomains-in-globalhosts) + * [Updated `global.imagePullSecrets`](#updated-globalimagepullsecrets) * [Automated migrations](#automated-migrations) * [Local Postfix as Relay](#local-postfix-as-relay) * [Updated IAM component Nubus](#updated-iam-component-nubus) @@ -21,6 +24,7 @@ SPDX-License-Identifier: Apache-2.0 * [`migrations` S3 bucket](#migrations-s3-bucket) * [Related components and artefacts](#related-components-and-artefacts) * [Development](#development) + # Disclaimer @@ -28,8 +32,9 @@ We do not offer support for upgrades before we reach openDesk 1.0. Though we try to ease the pain when it comes to 0.x upgrades. That is what this document is for. -Limitations: -- We assume that the PV reclaim policy is set to `delete`, so expect that PVs get deleted as soon as the related PVC was deleted and will cover an explicit delete for PVs. +**Limitations:** +- We assume that the PV reclaim policy is set to `delete`, so expect that PVs get deleted as soon as the related PVC was + deleted and will cover an explicit delete for PVs. # Releases upgrades @@ -40,16 +45,16 @@ Limitations: #### MatrixID localpart update Until 0.9.0 openDesk used the LDAP entryUUID of a user to generate the user's MatrixID. Due to restrictions of the -Matrix protocol an update of a MatrixID is not possible, therefore it was technically convenient to use the UUID +Matrix protocol, an update of a MatrixID is not possible, therefore, it was technically convenient to use the UUID as it is immutable (see https://de.wikipedia.org/wiki/Universally_Unique_Identifier for more details on UUIDs.) -From the user experience perspective that was a bad approach, so from now on by default the username, that -is also used for logging into openDesk, is used to define the localpart of the MatrixID. +From the user experience perspective, that was a bad approach, so from now on, by default, the username which +is also used for logging into openDesk is used to define the localpart of the MatrixID. For existing installations: The changed setting only affects users that login to Element the first time. Existing user accounts will not be harmed. If you want existing users to get new MatrixIDs based on the new setting, you -need to update their external ID in Synapse and deactivate the old user afterwards. The user will get a new -Matrix account from the scratch, losing the existing contacts, chats and rooms. +need to update their external ID in Synapse and deactivate the old user afterward. The user will get a new +Matrix account from scratch, losing the existing contacts, chats and rooms. The following Admin API calls are helpful: - GET /_synapse/admin/v2/users/@: get the user's existing external_id (auth_provider: "oidc") @@ -58,7 +63,7 @@ The following Admin API calls are helpful: - POST /_synapse/admin/v1/deactivate/@: deactivate old user with JSON payload: `{ "erase": true }` -For more details check the Admin API documentation: +For more details, check the Admin API documentation: https://element-hq.github.io/synapse/latest/usage/administration/admin_api/index.html You can enforce the old standard with the following setting: @@ -70,11 +75,12 @@ functional: useImmutableIdentifierForLocalpart: true ``` -#### Fileshare configurability +#### File-share configurability -We provide now some configurability regarding the sharing capabilities of the Nextcloud component. +Now we provide some configurability regarding the sharing capabilities of the Nextcloud component. -The new default is different from the standard until now. To keep the current state after the upgrade from 0.9.0 you have to provide the following settings: +The new default is different from the standard until now. +To keep the current state after the upgrade from 0.9.0, you have to provide the following settings: ``` functional: @@ -86,6 +92,64 @@ functional: enforceSharingPasswords: false ``` +#### Updated default subdomains in `global.hosts` + +We have streamlined the subdomain names used by openDesk to be more user-friendly and to avoid the use of specific +product names. + +This results in following change of default subdomain naming: + +- **collabora**: `collabora` → `office` +- **cryptpad**: `cryptpad` → `pad` +- **minioApi**: `minio` → `objectstore` +- **minioConsole**: `minio-console` → `objectstore-ui` +- **nextcloud**: `fs` → `files` +- **openproject**: `project` → `projects` + +During upgrade, any existing environment needs to keep the old subdomains, +cause url/link changes are not every supported and not tested at all. + +If you have not already defined the entire `global.hosts` dictionary in your custom environments values, please set it +to the defaults that were used before the upgrade: + +```yaml +global: + hosts: + collabora: "collabora" + cryptpad: "cryptpad" + element: "chat" + intercomService: "ics" + jitsi: "meet" + keycloak: "id" + matrixNeoBoardWidget: "matrix-neoboard-widget" + matrixNeoChoiceWidget: "matrix-neochoice-widget" + matrixNeoDateFixBot: "matrix-neodatefix-bot" + matrixNeoDateFixWidget: "matrix-neodatefix-widget" + minioApi: "minio" + minioConsole: "minio-console" + nextcloud: "fs" + openproject: "project" + openxchange: "webmail" + synapse: "matrix" + synapseFederation: "matrix-federation" + univentionManagementStack: "portal" + whiteboard: "whiteboard" + xwiki: "wiki" +``` + +#### Updated `global.imagePullSecrets` + +Without using a custom registry, you can pull all the openDesk images without authentication. +Thus defining not existing imagePullSecrets creates unnecessary errors, so we removed them. + +You can keep the current settings by setting the `external-registry` in your custom environment values: + +```yaml +global: + imagePullSecrets: + - "external-registry" +``` + ### Automated migrations #### Local Postfix as Relay diff --git a/helmfile/apps/element/values-matrix-neodatefix-bot-bootstrap.yaml.gotmpl b/helmfile/apps/element/values-matrix-neodatefix-bot-bootstrap.yaml.gotmpl index ffe5214d..d89786d5 100644 --- a/helmfile/apps/element/values-matrix-neodatefix-bot-bootstrap.yaml.gotmpl +++ b/helmfile/apps/element/values-matrix-neodatefix-bot-bootstrap.yaml.gotmpl @@ -19,7 +19,7 @@ global: {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }} image: - registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.synapseCreateUser.registry | quote }} + registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.synapseCreateUser.registry | quote }} url: {{ .Values.images.synapseCreateUser.repository | quote }} tag: {{ .Values.images.synapseCreateUser.tag | quote }} imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }} diff --git a/helmfile/apps/element/values-matrix-user-verification-service-bootstrap.yaml.gotmpl b/helmfile/apps/element/values-matrix-user-verification-service-bootstrap.yaml.gotmpl index 6b662584..08c4a7e5 100644 --- a/helmfile/apps/element/values-matrix-user-verification-service-bootstrap.yaml.gotmpl +++ b/helmfile/apps/element/values-matrix-user-verification-service-bootstrap.yaml.gotmpl @@ -19,7 +19,7 @@ global: {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }} image: - registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.synapseCreateUser.registry | quote }} + registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.synapseCreateUser.registry | quote }} url: {{ .Values.images.synapseCreateUser.repository | quote }} tag: {{ .Values.images.synapseCreateUser.tag | quote }} imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }} diff --git a/helmfile/apps/services/values-certificates.yaml.gotmpl b/helmfile/apps/services/values-certificates.yaml.gotmpl index 41a1f552..09a0bea2 100644 --- a/helmfile/apps/services/values-certificates.yaml.gotmpl +++ b/helmfile/apps/services/values-certificates.yaml.gotmpl @@ -7,7 +7,48 @@ SPDX-License-Identifier: Apache-2.0 global: domain: {{ .Values.global.domain | quote }} hosts: - {{ .Values.global.hosts | toYaml | nindent 4 }} + {{- if .Values.collabora.enabled }} + collabora: {{ .Values.global.hosts.collabora }} + {{- end }} + {{- if .Values.cryptpad.enabled }} + cryptpad: {{ .Values.global.hosts.cryptpad }} + {{- end }} + {{- if .Values.element.enabled }} + element: {{ .Values.global.hosts.element }} + matrixNeoBoardWidget: {{ .Values.global.hosts.matrixNeoBoardWidget }} + matrixNeoChoiceWidget: {{ .Values.global.hosts.matrixNeoChoiceWidget }} + matrixNeoDateFixBot: {{ .Values.global.hosts.matrixNeoDateFixBot }} + matrixNeoDateFixWidget: {{ .Values.global.hosts.matrixNeoDateFixWidget }} + synapse: {{ .Values.global.hosts.synapse }} + synapseFederation: {{ .Values.global.hosts.synapseFederation }} + whiteboard: {{ .Values.global.hosts.whiteboard }} + {{- end }} + {{- if .Values.intercom.enabled }} + intercomService: {{ .Values.global.hosts.intercomService }} + {{- end }} + {{- if .Values.jitsi.enabled }} + jitsi: {{ .Values.global.hosts.jitsi }} + {{- end }} + {{- if .Values.minio.enabled }} + minioApi: {{ .Values.global.hosts.minioApi }} + minioConsole: {{ .Values.global.hosts.minioConsole }} + {{- end }} + {{- if .Values.nextcloud.enabled }} + nextcloud: {{ .Values.global.hosts.nextcloud }} + {{- end }} + {{- if .Values.openproject.enabled }} + openproject: {{ .Values.global.hosts.openproject }} + {{- end }} + {{- if .Values.oxAppsuite.enabled }} + openxchange: {{ .Values.global.hosts.openxchange }} + {{- end }} + {{- if .Values.nubus.enabled }} + keycloak: {{ .Values.global.hosts.keycloak }} + nubus: {{ .Values.global.hosts.nubus }} + {{- end }} + {{- if .Values.xwiki.enabled }} + xwiki: {{ .Values.global.hosts.xwiki }} + {{- end }} issuerRef: name: {{ .Values.certificate.issuerRef.name | quote }} diff --git a/helmfile/environments/default/global.gotmpl b/helmfile/environments/default/global.gotmpl index 3c04ada5..cd6656d6 100644 --- a/helmfile/environments/default/global.gotmpl +++ b/helmfile/environments/default/global.gotmpl @@ -1,4 +1,5 @@ {{/* +SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS" SPDX-License-Identifier: Apache-2.0 */}} @@ -24,11 +25,14 @@ global: helmRegistry: {{ env "PRIVATE_HELM_REGISTRY_URL" | quote }} imageRegistry: {{ env "PRIVATE_IMAGE_REGISTRY_URL" | quote }} - ## Define ingress/virtualservice host. + ## Define ingress host. + # Beware: Changing hostnames on an existing deployment will break links the users may already make use of. + # Also some links are used directly in the portal and do not get updated after the initial + # deployment. # hosts: - collabora: "collabora" - cryptpad: "cryptpad" + collabora: "office" + cryptpad: "pad" element: "chat" intercomService: "ics" jitsi: "meet" @@ -37,11 +41,11 @@ global: matrixNeoChoiceWidget: "matrix-neochoice-widget" matrixNeoDateFixBot: "matrix-neodatefix-bot" matrixNeoDateFixWidget: "matrix-neodatefix-widget" - minioApi: "minio" - minioConsole: "minio-console" - nextcloud: "fs" + minioApi: "objectstore" + minioConsole: "objectstore-ui" + nextcloud: "files" nubus: "portal" - openproject: "project" + openproject: "projects" openxchange: "webmail" synapse: "matrix" synapseFederation: "matrix-federation" @@ -51,8 +55,7 @@ global: ## Credentials to fetch images from private registry ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ # - imagePullSecrets: - - "external-registry" + imagePullSecrets: [] ## Define the policy to pull container images. ## Ref: https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy