mirror of
https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk.git
synced 2025-12-06 15:31:38 +01:00
Compare commits
7 Commits
lluerenbau
...
b1-boekhor
| Author | SHA1 | Date | |
|---|---|---|---|
|
195a9eae55 | ||
|
|
8867d1b204 | ||
|
|
cca755d4af | ||
|
|
2423ac2de6 | ||
|
|
09a233511e | ||
|
|
7d101b18d7 | ||
|
|
10f1ced37d |
@@ -767,17 +767,33 @@ import-default-accounts:
|
||||
- "echo \"Starting default account import for ${DOMAIN}\""
|
||||
- "cd /app"
|
||||
- |
|
||||
./user_import_udm_rest_api.py \
|
||||
--import_domain ${DOMAIN} \
|
||||
--udm_api_password ${DEFAULT_ADMINISTRATOR_PASSWORD} \
|
||||
--set_default_password ${DEFAULT_ACCOUNTS_PASSWORD} \
|
||||
--import_filename ./template.ods \
|
||||
--admin_enable_fileshare True \
|
||||
--admin_enable_knowledgemanagement True \
|
||||
--admin_enable_projectmanagement True \
|
||||
--create_admin_accounts True \
|
||||
--create_maildomains True \
|
||||
--verify_certificate False
|
||||
set +e
|
||||
success=0
|
||||
for i in {1..5}; do
|
||||
echo "Attempt $i/5..."
|
||||
./user_import_udm_rest_api.py \
|
||||
--import_domain ${DOMAIN} \
|
||||
--udm_api_password ${DEFAULT_ADMINISTRATOR_PASSWORD} \
|
||||
--set_default_password ${DEFAULT_ACCOUNTS_PASSWORD} \
|
||||
--import_filename ./template.ods \
|
||||
--admin_enable_fileshare True \
|
||||
--admin_enable_knowledgemanagement True \
|
||||
--admin_enable_projectmanagement True \
|
||||
--create_admin_accounts True \
|
||||
--create_maildomains True \
|
||||
--verify_certificate False
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "Script succeeded on attempt $i."
|
||||
success=1
|
||||
break
|
||||
fi
|
||||
echo "Script failed. Waiting 60 seconds before retry..."
|
||||
sleep 60
|
||||
done
|
||||
if [ "$success" -ne 1 ]; then
|
||||
echo "Script failed after 5 attempts."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
run-tests:
|
||||
stage: "post-execute"
|
||||
|
||||
@@ -14,7 +14,7 @@
|
||||
* **open-xchange:** Template SASL security options ([684c6d4](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/684c6d4f29dd447872ebe582eef43c04034896f7))
|
||||
* **open-xchange:** Update Dovecot configuration based on supplier's best practise review ([850761e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/850761e0475b2f281fb23f6972d5c74fbdaa3a61))
|
||||
* **opendesk-static-files:** [[#260](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/260)] Fix doublette creation of configmap `data` keys when the same file is referenced multiple times for a component ([b5a76be](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b5a76bea57ef7b136c54d1bc95c40f0a0c3f9716))
|
||||
* **openproject:** Update from 16.1.0 to 16.1.1 ([62fae99](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/62fae9976a731c00700d56ce8fab198bb2531d20))
|
||||
* **openproject:** Update from 16.6.0 to 16.6.1 ([62fae99](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/62fae9976a731c00700d56ce8fab198bb2531d20))
|
||||
* **xwiki:** Update XWiki from 17.4.4 to 17.4.7 ([02a3b77](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/02a3b7711490394690df70ca92bab58b253e34f5))
|
||||
|
||||
|
||||
|
||||
@@ -65,7 +65,7 @@ For your convenience, we recommend creating a `*.domain.tld` A-Record for your c
|
||||
| Record name | Type | Value | Additional information |
|
||||
|-------------------------------|------|----------------------------------------------------|-------------------------------------------------------------------|
|
||||
| *.domain.tld | A | IPv4 address of your Ingress Controller | |
|
||||
| *.domain.tld | AAAA | IPv6 address of your Ingress Controller | |
|
||||
| *.domain.tld | AAAA | IPv6 address of your Ingress Controller | Optional |
|
||||
| mail.domain.tld | A | IPv4 address of your postfix NodePort/LoadBalancer | Optional, mail should directly be delivered to openDesk's Postfix |
|
||||
| mail.domain.tld | AAAA | IPv6 address of your postfix NodePort/LoadBalancer | Optional, mail should directly be delivered to openDesk's Postfix |
|
||||
| domain.tld | MX | `10 mail.domain.tld` | |
|
||||
|
||||
@@ -13,8 +13,10 @@ SPDX-License-Identifier: Apache-2.0
|
||||
* [Versions ≥ v1.11.0](#versions--v1110)
|
||||
* [Pre-upgrade to versions ≥ v1.11.0](#pre-upgrade-to-versions--v1110)
|
||||
* [Helmfile new option: Annotations for external services (Dovecot, Jitsi JVB, Postfix)](#helmfile-new-option-annotations-for-external-services-dovecot-jitsi-jvb-postfix)
|
||||
* [Helmfile new secret: `secrets.nextcloud.statusPassword`](#helmfile-new-secret-secretsnextcloudstatuspassword)
|
||||
* [Versions ≥ v1.10.0](#versions--v1100)
|
||||
* [Pre-upgrade to versions ≥ v1.10.0](#pre-upgrade-to-versions--v1100)
|
||||
* [Deployment cleanup: Collabora Controller](#deployment-cleanup-collabora-controller)
|
||||
* [Helmfile new secret: `secrets.nubus.ldapSearch.postfix`](#helmfile-new-secret-secretsnubusldapsearchpostfix)
|
||||
* [Helmfile new secret: `secrets.doveocot.sharedMailboxesMasterPassword`](#helmfile-new-secret-secretsdoveocotsharedmailboxesmasterpassword)
|
||||
* [New Helmfile default: Nubus provisioning debug container no longer deployed](#new-helmfile-default-nubus-provisioning-debug-container-no-longer-deployed)
|
||||
@@ -213,10 +215,43 @@ Setting service annotation by `annotations.openxchangePostfix.service` applied t
|
||||
and external service. This key now only sets annotations for the internal service. If you want to set
|
||||
annotations for the external service use the newly introduced key `annotations.openxchangePostfix.serviceExternal`.
|
||||
|
||||
#### Helmfile new secret: `secrets.nextcloud.statusPassword`
|
||||
|
||||
**Target group:** All existing deployments that use self-defined secrets and have deployed Nextcloud.
|
||||
|
||||
Access to Nextcloud's `/status.php` requires now BasicAuth. The related password is set in
|
||||
[`secrets.yaml.gotmpl`](../helmfile/environments/default/secrets.yaml.gotmpl) by the key
|
||||
`secrets.nextcloud.statusPassword`.
|
||||
|
||||
If you define your own secrets, please ensure that you provide a value for this secret, otherwise it will
|
||||
be derived from the `MASTER_PASSWORD`.
|
||||
|
||||
> [!note]
|
||||
> The username for the BasicAuth is hardcoded to "status-access".
|
||||
|
||||
## Versions ≥ v1.10.0
|
||||
|
||||
### Pre-upgrade to versions ≥ v1.10.0
|
||||
|
||||
#### Deployment cleanup: Collabora Controller
|
||||
|
||||
**Target group:** Existing openDesk Enterprise deployments using Collabora Controller. Actually only long running
|
||||
deployments are affected, but following the instructions won't hurt.
|
||||
|
||||
As per upstream release notes for [Collabora Online Controller 1.1.4](https://www.collaboraonline.com/cool-controller-release-notes/)
|
||||
you have to remove the existing leases of the Controller. You can do so by setting `<your_namespace>` and executing
|
||||
the commands below.
|
||||
|
||||
```shell
|
||||
export NAMESPACE=<your_namespace>
|
||||
export COLLABORA_CONTROLLER_DEPLOYMENT_NAME=collabora-controller-cool-controller
|
||||
kubectl -n ${NAMESPACE} scale deployment/${COLLABORA_CONTROLLER_DEPLOYMENT_NAME} --replicas=0
|
||||
kubectl -n ${NAMESPACE} delete -n collabora leases.coordination.k8s.io collabora-online
|
||||
```
|
||||
|
||||
> [!note]
|
||||
> The Collabora Online Controller is not scaled up again, as this would happen as part of the upgrade deployment.
|
||||
|
||||
#### Helmfile new secret: `secrets.nubus.ldapSearch.postfix`
|
||||
|
||||
**Target group:** All existing deployments that use self-defined secrets.
|
||||
|
||||
@@ -23,8 +23,7 @@ openDesk includes integration with Prometheus-based monitoring.
|
||||
|
||||
Together with [kube-prometheus-stack](https://github.com/prometheus-community/helm-charts/tree/main/charts/kube-prometheus-stack), you can easily leverage the full potential of the open-source cloud-native observability stack.
|
||||
|
||||
Before enabling the following options, you need to install the respective custom resource definitions (CRDs) from the kube-prometheus-stack
|
||||
repository or Prometheus operator.
|
||||
Before enabling the following options, you need to install the respective custom resource definitions (CRDs) from the kube-prometheus-stack repository which should at least include the Prometheus Operator.
|
||||
|
||||
# Defaults
|
||||
|
||||
@@ -33,14 +32,16 @@ All configurable options and their defaults can be found in
|
||||
|
||||
# Metrics
|
||||
|
||||
To deploy `podMonitor` and `serviceMonitor` custom resources, enable it by:
|
||||
To deploy `podMonitor` and `serviceMonitor` custom resources, enable them by:
|
||||
|
||||
```yaml
|
||||
prometheus:
|
||||
serviceMonitors:
|
||||
enabled: true
|
||||
podMonitors:
|
||||
enabled: true
|
||||
monitoring:
|
||||
prometheus:
|
||||
serviceMonitors:
|
||||
enabled: true
|
||||
podMonitors:
|
||||
enabled: true
|
||||
```
|
||||
```
|
||||
|
||||
# Alerts
|
||||
@@ -51,19 +52,23 @@ Some of these are created by our partners while others are defined in [opendesk-
|
||||
All alert rules are deployed as [PrometheusRule](https://prometheus-operator.dev/docs/api-reference/api/#monitoring.coreos.com/v1.PrometheusRule) and can be enabled like this:
|
||||
|
||||
```yaml
|
||||
prometheus:
|
||||
prometheusRules:
|
||||
enabled: true
|
||||
monitoring:
|
||||
prometheus:
|
||||
prometheusRules:
|
||||
enabled: true
|
||||
```
|
||||
|
||||
# Dashboards for Grafana
|
||||
|
||||
To deploy optional Grafana dashboards with ConfigMaps, enable the functionality with:
|
||||
If your Grafana instance is deployed via kube-prometheus-stack, or you have deployed the [Sidecar for datasources](https://github.com/grafana/helm-charts/blob/main/charts/grafana/README.md#sidecar-for-datasources), openDesk can make dashboards available via ConfigMap resources.
|
||||
|
||||
Enable the functionality with the following snippet:
|
||||
|
||||
```yaml
|
||||
grafana:
|
||||
dashboards:
|
||||
enabled: true
|
||||
monitoring:
|
||||
grafana:
|
||||
dashboards:
|
||||
enabled: true
|
||||
```
|
||||
|
||||
Please find further details in the [related Helm chart](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-dashboards).
|
||||
|
||||
@@ -29,14 +29,14 @@ openDesk is a Kubernetes-only solution and requires an existing Kubernetes (K8s)
|
||||
- K8s cluster >= v1.24, [CNCF Certified Kubernetes distribution](https://www.cncf.io/certification/software-conformance/)
|
||||
- Domain and DNS Service
|
||||
- Ingress controller (Ingress NGINX) >= [4.11.5/1.11.5](https://github.com/kubernetes/ingress-nginx/releases)
|
||||
- [Helm](https://helm.sh/) >= v3.17.3, but not v3.18.0[^1]
|
||||
- [Helm](https://helm.sh/) >= v3.17.3 (but not v3.18.0[^1]) and < v4[^2],
|
||||
- [Helmfile](https://helmfile.readthedocs.io/en/latest/) >= v1.0.0
|
||||
- [HelmDiff](https://github.com/databus23/helm-diff) >= v3.11.0
|
||||
- Volume provisioner supporting RWO (read-write-once)[^2]
|
||||
- Volume provisioner supporting RWO (read-write-once)[^3]
|
||||
- Certificate handling with [cert-manager](https://cert-manager.io/)
|
||||
|
||||
**Additional openDesk Enterprise requirements**
|
||||
- [OpenKruise](https://openkruise.io/)[^3] >= v1.6
|
||||
- [OpenKruise](https://openkruise.io/)[^4] >= v1.6
|
||||
|
||||
# Hardware
|
||||
|
||||
@@ -138,8 +138,11 @@ Helmfile requires [HelmDiff](https://github.com/databus23/helm-diff) to compare
|
||||
|
||||
# Footnotes
|
||||
|
||||
[^1]: Due to a [Helm bug](https://github.com/helm/helm/issues/30890) Helm 3.18.0 is not supported.
|
||||
[^1]: Due to a [Helm bug](https://github.com/helm/helm/issues/30890) Helm v3.18.0 is not supported.
|
||||
|
||||
[^2]: Due to [restrictions on Kubernetes `emptyDir`](https://github.com/kubernetes/kubernetes/pull/130277) you need a volume provisioner that has sticky bit support, otherwise the OpenProject seeder job will fail. E.g. the `local-path-provisioner` does not have sticky bit support.
|
||||
[^2]: Helm v4 introduced stricter flag grouping that is not yet supported by the helmdiff plugin.
|
||||
|
||||
[^3]: Due to [restrictions on Kubernetes `emptyDir`](https://github.com/kubernetes/kubernetes/pull/130277) you need a volume provisioner that has sticky bit support, otherwise the OpenProject seeder job will fail. E.g. the `local-path-provisioner` does not have sticky bit support.
|
||||
|
||||
[^4]: Required for Dovecot Pro as part of openDesk Enterprise Edition.
|
||||
|
||||
[^3]: Required for Dovecot Pro as part of openDesk Enterprise Edition.
|
||||
|
||||
@@ -118,6 +118,10 @@ aio:
|
||||
value: {{ .Values.databases.nextcloud.password | quote }}
|
||||
{{- end }}
|
||||
trustedProxy: {{ join " " .Values.cluster.networking.cidr | quote }}
|
||||
status:
|
||||
password:
|
||||
value: {{ .Values.secrets.nextcloud.statusPassword | quote }}
|
||||
|
||||
containerSecurityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
|
||||
@@ -33,6 +33,9 @@ config:
|
||||
value: "nextcloud"
|
||||
password:
|
||||
value: {{ .Values.secrets.nextcloud.adminPassword | quote }}
|
||||
status:
|
||||
password:
|
||||
value: {{ .Values.secrets.nextcloud.statusPassword | quote }}
|
||||
|
||||
containerSecurityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
|
||||
@@ -13,7 +13,7 @@ images:
|
||||
nextcloud:
|
||||
registry: "registry.opencode.de"
|
||||
repository: "zendis/opendesk-enterprise/components/supplier/nextcloud/images/opendesk-nextcloud"
|
||||
tag: "1.6.11@sha256:79bab3b5745eb2c0fdd5a8858d277495deb7f6e43b42c7046d5bfbee039aed0a"
|
||||
tag: "1.7.1@sha256:aa91feaa89989178d859f21bb25633ef07facea19ac3ef696186256492a13b17"
|
||||
openxchangeCoreMW:
|
||||
registry: "registry.opencode.de"
|
||||
repository: "zendis/opendesk-enterprise/components/supplier/open-xchange/images-mirror/middleware-public-sector-pro"
|
||||
|
||||
@@ -249,7 +249,7 @@ charts:
|
||||
registry: "registry.opencode.de"
|
||||
repository: "bmi/opendesk/components/platform-development/charts/opendesk-nextcloud"
|
||||
name: "opendesk-nextcloud"
|
||||
version: "4.4.4"
|
||||
version: "4.5.0"
|
||||
verify: true
|
||||
nextcloudManagement:
|
||||
# providerCategory: "Platform"
|
||||
@@ -259,7 +259,7 @@ charts:
|
||||
registry: "registry.opencode.de"
|
||||
repository: "bmi/opendesk/components/platform-development/charts/opendesk-nextcloud"
|
||||
name: "opendesk-nextcloud-management"
|
||||
version: "4.4.4"
|
||||
version: "4.5.0"
|
||||
verify: true
|
||||
nextcloudNotifyPush:
|
||||
# providerCategory: "Platform"
|
||||
@@ -269,7 +269,7 @@ charts:
|
||||
registry: "registry.opencode.de"
|
||||
repository: "bmi/opendesk/components/platform-development/charts/opendesk-nextcloud"
|
||||
name: "opendesk-nextcloud-notifypush"
|
||||
version: "4.4.4"
|
||||
version: "4.5.0"
|
||||
verify: true
|
||||
nginx:
|
||||
# providerCategory: "Community"
|
||||
@@ -383,7 +383,7 @@ charts:
|
||||
registry: "registry.opencode.de"
|
||||
repository: "bmi/opendesk/components/platform-development/charts/opendesk-openproject-bootstrap"
|
||||
name: "opendesk-openproject-bootstrap"
|
||||
version: "2.2.0"
|
||||
version: "2.3.0"
|
||||
verify: true
|
||||
otterize:
|
||||
# providerCategory: "Platform"
|
||||
|
||||
@@ -330,7 +330,7 @@ images:
|
||||
# upstreamRepository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud"
|
||||
registry: "registry.opencode.de"
|
||||
repository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud"
|
||||
tag: "2.10.12@sha256:8a4cd73fdceb1da2c58a22a85d605eba575a2b1487e3927ab1971c9f1120549a"
|
||||
tag: "2.11.0@sha256:481e83fb913c98d2ede8ae734f406ac5c12f805093af0a34cb9c86eeaa56bc01"
|
||||
nextcloudExporter:
|
||||
# providerCategory: "Platform"
|
||||
# providerResponsible: "openDesk"
|
||||
@@ -770,7 +770,7 @@ images:
|
||||
# upstreamRepository: "bmi/opendesk/components/platform-development/images/opendesk-openproject-bootstrap"
|
||||
registry: "registry.opencode.de"
|
||||
repository: "bmi/opendesk/components/platform-development/images/opendesk-openproject-bootstrap"
|
||||
tag: "1.1.4@sha256:2fd97a316114428849aaeef87fb8755274e675830088a93afcafac91bb048d1d"
|
||||
tag: "1.2.0@sha256:7d2ab97a8cd17aa2c12a6d613044c848edf0371974662390eb08c197aa12b84a"
|
||||
openprojectDbInit:
|
||||
# providerCategory: "Community"
|
||||
# providerResponsible: "OpenProject"
|
||||
|
||||
@@ -101,6 +101,7 @@ secrets:
|
||||
nextcloud:
|
||||
adminPassword: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "nextcloud" "nextcloud_admin_user" | sha1sum | quote }}
|
||||
metricsToken: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "nextcloud" "metricsToken" | sha1sum | quote }}
|
||||
statusPassword: {{ derivePassword 1 "medium" (env "MASTER_PASSWORD" | default "sovereign-workplace") "nextcloud" "nextcloud_status_user" | sha1sum | quote }}
|
||||
openproject:
|
||||
adminPassword: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "openproject" "openproject_admin_user" | sha1sum | quote }}
|
||||
apiAdminUsername: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "openproject" "openproject_api_admin_username" | sha1sum | quote }}
|
||||
|
||||
Reference in New Issue
Block a user