Compare commits

...

15 Commits

Author SHA1 Message Date
Thorsten Roßner
4d0011d957 chore(release): 0.5.8 [skip ci]
## [0.5.8](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.5.7...v0.5.8) (2023-10-10)

### Bug Fixes

* **helmfile:** Add default port for SMTP in environment ([74f9ec2](74f9ec28e4))
2023-10-10 07:01:29 +00:00
Dominik Kaminski
74f9ec28e4 fix(helmfile): Add default port for SMTP in environment 2023-10-09 18:30:50 +02:00
Thorsten Roßner
b1d4b2d8ea chore(release): 0.5.7 [skip ci]
## [0.5.7](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.5.6...v0.5.7) (2023-10-09)

### Bug Fixes

* **openproject:** Mail sender address ([711d29e](711d29e374))
2023-10-09 09:41:26 +00:00
Thorsten Roßner
711d29e374 fix(openproject): Mail sender address 2023-10-09 09:31:39 +00:00
Thorsten Roßner
0ba7be2a5f chore(release): 0.5.6 [skip ci]
## [0.5.6](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.5.5...v0.5.6) (2023-10-09)

### Bug Fixes

* **helmfile:** Use signed bitnami charts from openDesk Mirror Builds ([70744d0](70744d04c6))
* **services:** Bump redis chart to 18.1.2 ([d4c751d](d4c751d29f))
2023-10-09 09:30:56 +00:00
Dominik Kaminski
d4c751d29f fix(services): Bump redis chart to 18.1.2 2023-10-09 11:19:50 +02:00
Dominik Kaminski
70744d04c6 fix(helmfile): Use signed bitnami charts from openDesk Mirror Builds 2023-10-09 11:19:50 +02:00
Thorsten Roßner
e4e6d2d60a chore(release): 0.5.5 [skip ci]
## [0.5.5](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.5.4...v0.5.5) (2023-10-09)

### Bug Fixes

* **openproject:** Switch image to fix central navigation; set email sender address ([e42feb4](e42feb4c26))
2023-10-09 07:24:26 +00:00
Thorsten Rossner
e42feb4c26 fix(openproject): Switch image to fix central navigation; set email sender address 2023-10-09 07:22:35 +00:00
Thorsten Roßner
f12c2ed0c2 chore(release): 0.5.4 [skip ci]
## [0.5.4](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.5.3...v0.5.4) (2023-10-02)

### Bug Fixes

* **helmfile:** Add third environment (test) ([7dbcbfe](7dbcbfe723))
2023-10-02 11:21:03 +00:00
Thorsten Rossner
7dbcbfe723 fix(helmfile): Add third environment (test) 2023-10-02 11:19:29 +00:00
Thorsten Roßner
1d8a0ccf1a chore(release): 0.5.3 [skip ci]
## [0.5.3](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.5.2...v0.5.3) (2023-09-28)

### Bug Fixes

* **open-xchange:** Rollback MariaDB version to fix OX Guard initialization ([e33acd3](e33acd33e7))
2023-09-28 16:38:21 +00:00
Thorsten Rossner
e33acd33e7 fix(open-xchange): Rollback MariaDB version to fix OX Guard initialization 2023-09-28 16:36:28 +00:00
Thorsten Roßner
74e206694e chore(release): 0.5.2 [skip ci]
## [0.5.2](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.5.1...v0.5.2) (2023-09-28)

### Bug Fixes

* **ci:** Add Gitlab-CI sledgehammer deployment removal ([6fd655a](6fd655a0b1))
2023-09-28 09:06:20 +00:00
Dominik Kaminski
6fd655a0b1 fix(ci): Add Gitlab-CI sledgehammer deployment removal 2023-09-28 10:01:01 +02:00
15 changed files with 149 additions and 31 deletions

4
.gitignore vendored
View File

@@ -5,4 +5,8 @@
# Ignore changes to sample environments
helmfile/environments/dev/values.yaml
helmfile/environments/dev/values.gotmpl
helmfile/environments/test/values.yaml
helmfile/environments/test/values.gotmpl
helmfile/environments/prod/values.yaml
helmfile/environments/prod/values.gotmpl

View File

@@ -183,8 +183,16 @@ env-cleanup:
$ENV_STOP_BEFORE != "no"
when: "always"
script:
- "helmfile destroy --namespace ${NAMESPACE}"
- "kubectl delete pvc --all --namespace ${NAMESPACE}"
- |
if [ "${OPENDESK_SLEDGEHAMMER_DESTROY_ENABLED}" = "yes" ]; then
for OPENDESK_RELEASE in $(helm ls -n ${NAMESPACE} -aq); do
helm uninstall -n ${NAMESPACE} ${OPENDESK_RELEASE};
done
kubectl delete pvc --all --namespace ${NAMESPACE};
kubectl delete jobs --all --namespace ${NAMESPACE};
else
helmfile destroy --namespace ${NAMESPACE};
fi
stage: "env-cleanup"
env-start:

View File

@@ -1,3 +1,53 @@
## [0.5.8](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.5.7...v0.5.8) (2023-10-10)
### Bug Fixes
* **helmfile:** Add default port for SMTP in environment ([74f9ec2](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/74f9ec28e401f7caeefc4e50ac0a7e95fea41a53))
## [0.5.7](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.5.6...v0.5.7) (2023-10-09)
### Bug Fixes
* **openproject:** Mail sender address ([711d29e](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/711d29e374d13a3c8b7bcdf3e8440d03e0ef2b7d))
## [0.5.6](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.5.5...v0.5.6) (2023-10-09)
### Bug Fixes
* **helmfile:** Use signed bitnami charts from openDesk Mirror Builds ([70744d0](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/70744d04c66f32d65dc968c8570ed7a397f4efcc))
* **services:** Bump redis chart to 18.1.2 ([d4c751d](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/d4c751d29f15c718957f6bc388a99347e2923c87))
## [0.5.5](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.5.4...v0.5.5) (2023-10-09)
### Bug Fixes
* **openproject:** Switch image to fix central navigation; set email sender address ([e42feb4](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/e42feb4c260fc24692bc2742c97754230f8e2857))
## [0.5.4](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.5.3...v0.5.4) (2023-10-02)
### Bug Fixes
* **helmfile:** Add third environment (test) ([7dbcbfe](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/7dbcbfe7237b365cf53f4c850b149e8b95149901))
## [0.5.3](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.5.2...v0.5.3) (2023-09-28)
### Bug Fixes
* **open-xchange:** Rollback MariaDB version to fix OX Guard initialization ([e33acd3](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/e33acd33e79740144e8fe318fe34dc705834ddf3))
## [0.5.2](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.5.1...v0.5.2) (2023-09-28)
### Bug Fixes
* **ci:** Add Gitlab-CI sledgehammer deployment removal ([6fd655a](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/6fd655a0b1afd40303ac11130692202146bab215))
## [0.5.1](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.5.0...v0.5.1) (2023-09-28)

View File

@@ -156,6 +156,12 @@ and wait a little. After the deployment is finished some bootstrapping is
executed which might take some more minutes before you can log in your new
instance.
Deployments can be removed with:
```shell
helmfile destroy -n <NAMESPACE>
```
## Offline deployment
Before executing a [local deployment](#local-deployment), you can set following
@@ -377,7 +383,7 @@ Helm Charts which are released via openDesk CI/CD process are always signed. The
| Repository | OCI | Verifiable |
|--------------------------------------|:---:|:------------------:|
| bitnami-repo | yes | :x: |
| bitnami-repo (openDesk build) | yes | :white_check_mark: |
| clamav-repo | yes | :white_check_mark: |
| collabora-online-repo | no | :x: |
| intercom-service-repo | yes | :white_check_mark: |

View File

@@ -29,6 +29,7 @@ missingFileHandler: "Error"
# - Installing a single release from root via helmfile apply -f helmfile/apps/<app>/helmfile.yaml
# - Installing a single release from app directory via helmfile apply
# Issue: https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/-/issues/2
environments:
default:
values:
@@ -39,9 +40,17 @@ environments:
- "helmfile/environments/default/*.gotmpl"
- "helmfile/environments/default/*.yaml"
- "helmfile/environments/dev/values.yaml"
- "helmfile/environments/dev/values.gotmpl"
test:
values:
- "helmfile/environments/default/*.gotmpl"
- "helmfile/environments/default/*.yaml"
- "helmfile/environments/test/values.yaml"
- "helmfile/environments/test/values.gotmpl"
prod:
values:
- "helmfile/environments/default/*.gotmpl"
- "helmfile/environments/default/*.yaml"
- "helmfile/environments/prod/values.yaml"
- "helmfile/environments/prod/values.gotmpl"
...

View File

@@ -7,10 +7,10 @@ repositories:
- name: "bitnami-repo"
oci: true
url: >-
{{ env "PRIVATE_CHART_REPOSITORY_URL" |
default "registry-1.docker.io/bitnamicharts" }}
# Bitnami charts are not signed, see https://github.com/bitnami/charts/issues/14491
verify: false
{{ env "PRIVATE_IMAGE_REGISTRY_URL" |
default "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/bitnami-charts" }}
verify: true
keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
# openDesk Keycloak Theme
# Source: https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/components/charts/opendesk-keycloak-theme
- name: "keycloak-theme-repo"
@@ -35,7 +35,7 @@ releases:
condition: "keycloak.enabled"
- name: "keycloak"
chart: "bitnami-repo/keycloak"
version: "12.2.0"
version: "12.1.5"
values:
- "values-keycloak.gotmpl"
- "values-keycloak.yaml"

View File

@@ -51,14 +51,15 @@ environment:
OPENPROJECT_OPENID__CONNECT_KEYCLOAK_POST__LOGOUT__REDIRECT__URI: "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/"
OPENPROJECT_OPENID__CONNECT_KEYCLOAK_HOST: "{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}"
OPENPROJECT_OPENID__CONNECT_KEYCLOAK_END__SESSION__ENDPOINT: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/souvap/protocol/openid-connect/logout"
OPENPROJECT_SOUVAP__NAVIGATION__SECRET: {{ .Values.secrets.centralnavigation.apiKey }}
OPENPROJECT_SOUVAP__NAVIGATION__SECRET: {{ .Values.secrets.centralnavigation.apiKey | quote }}
OPENPROJECT_SOUVAP__NAVIGATION__URL: "https://{{ .Values.global.hosts.univentionCorporateServer }}.{{ .Values.global.domain }}/univention/portal/navigation.json?base=https%3A//{{ .Values.global.hosts.univentionCorporateServer }}.{{ .Values.global.domain }}"
OPENPROJECT_SMTP__DOMAIN: "{{ .Values.global.domain }}"
OPENPROJECT_SMTP__USER__NAME: "{{ .Values.smtp.username }}"
OPENPROJECT_SMTP__PASSWORD: "{{ .Values.smtp.password }}"
OPENPROJECT_SMTP__PORT: "587" # (default=587)
OPENPROJECT_SMTP__PORT: "{{ .Values.smtp.port }}"
OPENPROJECT_SMTP__SSL: "false" # (default=false)
OPENPROJECT_SMTP__ADDRESS: "{{ .Values.smtp.host }}"
OPENPROJECT_MAIL__FROM: "do-not-reply@{{ .Values.global.domain }}"
# Details: https://www.openproject-edge.com/docs/installation-and-operations/configuration/#seeding-ldap-connections
OPENPROJECT_SEED_LDAP_OPENDESK_BINDPASSWORD: "{{ .Values.secrets.univentionCorporateServer.ldapSearch.openproject }}"

View File

@@ -64,9 +64,9 @@ repositories:
oci: true
url: >-
{{ env "PRIVATE_IMAGE_REGISTRY_URL" |
default "registry-1.docker.io/bitnamicharts" }}
# Bitnami charts are not signed, see https://github.com/bitnami/charts/issues/14491
verify: false
default "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/bitnami-charts" }}
verify: true
keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
releases:
- name: "opendesk-certificates"
@@ -77,7 +77,7 @@ releases:
condition: "certificates.enabled"
- name: "redis"
chart: "bitnami-repo/redis"
version: "18.0.4"
version: "18.1.2"
values:
- "values-redis.gotmpl"
- "values-redis.yaml"
@@ -92,7 +92,7 @@ releases:
timeout: 900
- name: "mariadb"
chart: "mariadb-repo/mariadb"
version: "2.1.0"
version: "2.0.2"
values:
- "values-mariadb.yaml"
- "values-mariadb.gotmpl"

View File

@@ -11,9 +11,17 @@ environments:
- "../../environments/default/*.gotmpl"
- "../../environments/default/*.yaml"
- "../../environments/dev/values.yaml"
- "../../environments/dev/values.gotmpl"
test:
values:
- "../../environments/default/*.gotmpl"
- "../../environments/default/*.yaml"
- "../../environments/test/values.yaml"
- "../../environments/test/values.gotmpl"
prod:
values:
- "../../environments/default/*.gotmpl"
- "../../environments/default/*.yaml"
- "../../environments/prod/values.yaml"
- "../../environments/prod/values.gotmpl"
...

View File

@@ -72,7 +72,8 @@ images:
# @supplier: "Univention"
mariadb:
repository: "mariadb"
tag: "11.1.2-jammy@sha256:b6440c4f4e1471bdcee202e4c4e21c1f93af87421f6d33028363dd224e54f481"
# For upgrades at least confirm compatibility of target version with OX (regarding AS Guard)
tag: "10.5@sha256:aa1ccc18000c32d1f39ac0b055117b27bffd93e622ec961d682de40fe2a1a95f"
# @supplier: "openDesk DevSecOps"
memcached:
repository: "bitnami/memcached"
@@ -87,8 +88,8 @@ images:
tag: "27.1.1-apache@sha256:47325758ffcd54563021e697905aaba6aac8c21bceefb245c67d40194813ce39"
# @supplier: "Nextcloud Community"
openproject:
repository: "souvap/tooling/images/openproject/souvap"
tag: "dev@sha256:03eb1eacc0c0c4e9e7d0f0c3d265fd0c15fd01cda33bc4f89cbc487ad53474a8"
repository: "souvap/tooling/images/openproject/opendesk"
tag: "fat-dev@sha256:e5d0fb5125df968ba98cb3005b7051ddff25b05da54922c94bb2ee61e6ec842c"
# @supplier: "OpenProject"
openxchangeBootstrap:
repository: "alpine/k8s"
@@ -170,55 +171,55 @@ images:
# @supplier: "Univention"
umsConfigHtpasswd:
repository: "souvap/tooling/images/univention/config-htpasswd"
tag: "latest@sha256:24c5e218baa62b169e7222d8ee4d3951ddc8622cd359def6b660bb23a1052f9e"
tag: "latest"
# @supplier: "Univention"
umsDataLoader:
repository: "souvap/tooling/images/univention/data-loader"
tag: "latest@sha256:857837c1810f82362d441544dc32bd2c1d6fe358bbb5ae0e2c60b7f8f4092190"
tag: "latest"
# @supplier: "Univention"
umsLdapNotifier:
repository: "souvap/tooling/images/univention/ldap-notifier"
tag: "latest@sha256:6eccf86fe78926247ec9b59d7ba83c53271bc3ca7d0195863c0489e22c836002"
tag: "latest"
# @supplier: "Univention"
umsLdapServer:
repository: "souvap/tooling/images/univention/ldap-server"
tag: "latest@sha256:4a7c44b37c727cdc03e4043c88e3dbf6b1f119772c5c1904eaed3298bdd49a3d"
tag: "latest"
# @supplier: "Univention"
umsNotificationsApi:
repository: "souvap/tooling/images/univention/notifications-api"
tag: "latest@sha256:87a047c2d0669fcbb3501ef94192812e17e09aecabc1edd2e4b92afbb7ea4b20"
tag: "latest"
# @supplier: "Univention"
umsPortalListener:
repository: "souvap/tooling/images/univention/portal-listener"
tag: "latest@sha256:bcf48d108bc2f1afd745659a1d4f11f1dd0d8ada034899aa401dfea32a29c87a"
tag: "latest"
# @supplier: "Univention"
umsPortalFrontend:
repository: "souvap/tooling/images/univention/portal-frontend"
tag: "latest@sha256:a1b11db009e992d91cfef2bc60a5022cd4498c38908194020c881ef6dd325bae"
tag: "latest"
# @supplier: "Univention"
umsPortalServer:
repository: "souvap/tooling/images/univention/portal-server"
tag: "latest@sha256:eb0b032c4cf4b207f78b80c69f3e593e01e577779d877e16908902f19b4fc2ee"
tag: "latest"
# @supplier: "Univention"
umsWaitForDependency:
repository: "souvap/tooling/images/univention/wait-for-dependency"
tag: "latest@sha256:5d8d5e9ed55af2d12fef25856e5e61c7d13081458e4b14e6a01b10488b8067d3"
tag: "latest"
# @supplier: "Univention"
umsStoreDav:
repository: "souvap/tooling/images/univention/store-dav"
tag: "latest@sha256:d65f705e46a497ba58e7373f19973835f731796baeace16a32d6331469bf0068"
tag: "latest"
# @supplier: "Univention"
umsUdmRestApi:
repository: "souvap/tooling/images/univention/udm-rest-api"
tag: "latest@sha256:dce4322646749692c5d4692ccd7ff55df080a4af3485585a50c82871715e0cae"
tag: "latest"
# @supplier: "Univention"
umsUmcGateway:
repository: "souvap/tooling/images/univention/umc-gateway"
tag: "latest@sha256:18172ee4317a9259291f251c0cc1d2be05e003558cbd18d6dc062098a127cc8d"
tag: "latest"
# @supplier: "Univention"
umsUmcServer:
repository: "souvap/tooling/images/univention/umc-server"
tag: "latest@sha256:6cbb1708109c5a0c13f3ee433989094d04cecfb8b32975e723d0f5a2e526f8db"
tag: "latest"
# @supplier: "Univention"
wellKnown:
repository: "library/nginx"

View File

@@ -5,6 +5,7 @@ SPDX-License-Identifier: Apache-2.0
---
smtp:
host: ""
port: 587
username: ""
password: "{{ env "SMTP_PASSWORD" }}"
...

View File

@@ -0,0 +1,8 @@
{{/*
SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
SPDX-License-Identifier: Apache-2.0
*/}}
---
sampleWithTemplating: {{ env "YOUR_ENV_VARIABLE_FOR_TEMPLATING" | quote }}
...

View File

@@ -0,0 +1,8 @@
{{/*
SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
SPDX-License-Identifier: Apache-2.0
*/}}
---
sampleWithTemplating: {{ env "YOUR_ENV_VARIABLE_FOR_TEMPLATING" | quote }}
...

View File

@@ -0,0 +1,8 @@
{{/*
SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
SPDX-License-Identifier: Apache-2.0
*/}}
---
sampleWithTemplating: {{ env "YOUR_ENV_VARIABLE_FOR_TEMPLATING" | quote }}
...

View File

@@ -0,0 +1,6 @@
# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
# SPDX-License-Identifier: Apache-2.0
---
# This a sample file and could be filled with proper variable overload.
sample: true
...