Merge pull request #3027 from wireapp/release_2023-01-26_14_27

Release 2023-01-26 - (expected chart version 4.31.0)

.github/workflows/ci.yml

@@ -6,7 +6,6 @@ on:
 jobs:
   treefmt:
    name: Run treefmt
-   environment: cachix # for secrets
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
@@ -25,7 +24,6 @@ jobs:
 
   build-docs:
     name: Build docs
-    environment: cachix
     runs-on: ubuntu-latest
     permissions:
       id-token: write

CHANGELOG.md

@@ -1,3 +1,80 @@
+# [2023-01-26] (Chart Release 4.31.0)
+
+## Release notes
+
+
+* wire-server helm charts using Ingress resources are now compatible with kubernetes versions 1.22, 1.23 and 1.24 (but remain compatible with older versions of kubernetes).
+
+  If you upgrade to this version of helm charts and/or you upgrade your version of kubernetes while wire-server is deployed, you may find that `helm update` or `helmfile apply/sync` gives an error like this:
+
+  > Error: UPGRADE FAILED: current release manifest contains removed kubernetes api(s) for this kubernetes version and it is therefore unable to build the kubernetes objects for performing the diff. error from kubernetes: unable to recognize "": no matches for kind "Ingress" in version "extensions/v1beta1"
+
+  In which case you can use the [helm mapkubeapis plugin](https://github.com/helm/helm-mapkubeapis) to upgrade an existing release with the following command:
+
+  ```sh
+  # install plugin version 0.1.0 (more recent may not work)
+  helm plugin install --version v0.1.0 https://github.com/helm/helm-mapkubeapis
+  # adjust helm release name and namespace as required
+  helm mapkubeapis --namespace wire nginx-ingress-services
+  ```
+
+  Alternatively, if a few minutes of downtime are not a problem; you can `helm delete` a release and re-install it again, which will work without the above plugin. (#3002)
+
+* Upgrade team-settings version to 4.14.0-v0.31.9-0-bf82b46 (#2180)
+
+* Upgrade webapp version to 2023-01-24-production.0-v0.31.9-0-17b742f (#2302)
+
+
+## API changes
+
+
+* The unqualified `GET /conversations/:id` endpoint has been removed from API v3, and is restored to the previous behaviour of returning a Conversation using the v2 schema. Similarly, its qualified counterpart `GET /conversations/:domain/:id` now returns a v2 Conversation when accessed through API v2. (#2992)
+
+
+## Bug fixes and other updates
+
+
+* Fix pagination in team user search (make search key unique) (#2968)
+
+* Update `inbucket` (fake smtp server) chart dependency: The prior version relied on an image that has been removed from docker hub. Thus, our own `inbucket` chart could not be deployed anymore. (#2998)
+
+
+## Documentation
+
+
+* Add sphinx-copybutton plugin to make copying snippets of code from docs.wire.com easier. (#2900)
+
+* Hook federated API call documentation into docs.wire.com (manually). (#2988)
+
+* Tool for dumping fed call graphs (dot/graphviz and csv); see README for details (#2973)
+
+
+## Internal changes
+
+
+* Add Helm chart to configure clusters managed by k8ssandra-operator for test environments. (#2981)
+
+* Fix kind setup for running end-to-end federation tests locally. (#3008)
+
+* Fix Makefile target kind-restart-all. (#3015)
+
+* Add combinators for creating mocked federator responses in integration tests (#3014)
+
+* Add two integration tests arounds last prekeys (#2694)
+
+* Fix `make clean` (#2965, #2978)
+
+* Make ID tags more readable by expanding abbreviations to full names. (#2991)
+
+* Unused old swagger code removed from stern and team features (#3017)
+
+* Refactor Writetime from Int64 to wrapper of UTCTime (#2994)
+
+* Restructure docs.wire.com (#2986)
+
+* Fixed flaky team user search integration test (#2996)
+
+
 # [2023-01-12] (Chart Release 4.30.0)
 
 ## Release notes

Makefile

@@ -13,7 +13,12 @@ CHARTS_INTEGRATION    := wire-server databases-ephemeral redis-cluster fake-aws
 # (e.g. move charts/brig to charts/wire-server/brig)
 # this list could be generated from the folder names under ./charts/ like so:
 # CHARTS_RELEASE := $(shell find charts/ -maxdepth 1 -type d | xargs -n 1 basename | grep -v charts)
-CHARTS_RELEASE        := wire-server redis-ephemeral redis-cluster databases-ephemeral fake-aws fake-aws-s3 fake-aws-sqs aws-ingress  fluent-bit kibana backoffice calling-test demo-smtp elasticsearch-curator elasticsearch-external elasticsearch-ephemeral minio-external cassandra-external nginx-ingress-controller nginx-ingress-services reaper sftd restund coturn inbucket
+CHARTS_RELEASE := wire-server redis-ephemeral redis-cluster databases-ephemeral	\
+fake-aws fake-aws-s3 fake-aws-sqs aws-ingress fluent-bit kibana backoffice		\
+calling-test demo-smtp elasticsearch-curator elasticsearch-external				\
+elasticsearch-ephemeral minio-external cassandra-external						\
+nginx-ingress-controller nginx-ingress-services reaper sftd restund coturn		\
+inbucket k8ssandra-test-cluster
 KIND_CLUSTER_NAME     := wire-server
 
 package ?= all
@@ -47,13 +52,9 @@ install: init
 .PHONY: full-clean
 full-clean: clean
 	rm -rf ~/.cache/hie-bios
-ifdef CABAL_DIR
-	rm -rf $(CABAL_DIR)/store
-else
-	rm -rf ~/.cabal/store
-endif
 	rm -rf ./dist-newstyle ./.env
 	direnv reload
+	@echo -e "\n\n*** NOTE: you may want to also 'rm -rf ~/.cabal/store \$$CABAL_DIR/store', not sure.\n"
 
 .PHONY: clean
 clean:
@@ -437,6 +438,14 @@ kind-delete:
 .PHONY: kind-reset
 kind-reset: kind-delete kind-cluster
 
+.PHONY: kind-upload-images
+kind-upload-images:
+	DOCKER_TAG=$(DOCKER_TAG) KIND_CLUSTER_NAME=$(KIND_CLUSTER_NAME) ./hack/bin/kind-upload-images.sh
+
+.PHONY: kind-upload-image
+kind-upload-image-%:
+	DOCKER_TAG=$(DOCKER_TAG) KIND_CLUSTER_NAME=$(KIND_CLUSTER_NAME) ./hack/bin/kind-upload-image.sh wireServer.imagesUnoptimizedNoDocs.$(*)
+
 .local/kind-kubeconfig:
 	mkdir -p $(CURDIR)/.local
 	kind get kubeconfig --name $(KIND_CLUSTER_NAME) > $(CURDIR)/.local/kind-kubeconfig
@@ -479,7 +488,7 @@ kind-integration-e2e: .local/kind-kubeconfig
 kind-restart-all: .local/kind-kubeconfig
 	export KUBECONFIG=$(CURDIR)/.local/kind-kubeconfig && \
 	kubectl delete pod -n $(NAMESPACE) -l release=$(NAMESPACE)-wire-server && \
-	kubectl delete pod -n $(NAMESPACE)-fed2 -l release=$(NAMESPACE)-fed2-wire-server
+	kubectl delete pod -n $(NAMESPACE)-fed2 -l release=$(NAMESPACE)-wire-server-2
 
 kind-restart-nginx-ingress: .local/kind-kubeconfig
 	export KUBECONFIG=$(CURDIR)/.local/kind-kubeconfig && \

cabal.project

@@ -42,13 +42,14 @@ packages:
   , tools/api-simulations/
   , tools/db/assets/
   , tools/db/auto-whitelist/
-  , tools/db/migrate-sso-feature-flag/
-  , tools/db/service-backfill/
   , tools/db/billing-team-member-backfill/
   , tools/db/find-undead/
+  , tools/db/inconsistencies/
+  , tools/db/migrate-sso-feature-flag/
   , tools/db/move-team/
   , tools/db/repair-handles/
-  , tools/db/inconsistencies/
+  , tools/db/service-backfill/
+  , tools/fedcalls/
   , tools/rex/
   , tools/stern/
 

charts/elasticsearch-ephemeral/templates/_helpers.tpl

@@ -15,13 +15,3 @@ We truncate at 53 chars (63 - len("-discovery")) because some Kubernetes name fi
 {{- printf "%s" $name | trunc 53 | trimSuffix "-" -}}
 {{- end -}}
 
-{{/*
-Return the appropriate apiVersion for Curactor cron job.
-*/}}
-{{- define "curator.cronJob.apiVersion" -}}
-{{- if ge .Capabilities.KubeVersion.Minor "8" -}}
-"batch/v1beta1"
-{{- else -}}
-"batch/v2alpha1"
-{{- end -}}
-{{- end -}}

charts/galley/templates/configmap.yaml

@@ -111,10 +111,6 @@ data:
         conversationGuestLinks:
           {{- toYaml .settings.featureFlags.conversationGuestLinks | nindent 10 }}
         {{- end }}
-        {{- if .settings.featureFlags.searchVisibilityInbound }}
-        searchVisibilityInbound:
-          {{- toYaml .settings.featureFlags.searchVisibilityInbound | nindent 10 }}
-        {{- end }}
         {{- if .settings.featureFlags.mls }}
         mls:
           {{- toYaml .settings.featureFlags.mls | nindent 10 }}

charts/inbucket/requirements.yaml

@@ -1,4 +1,4 @@
 dependencies:
 - name: inbucket
-  version: 2.0.1
+  version: 2.1.0
   repository: https://inbucket.github.io/inbucket-community

charts/inbucket/templates/_helpers.tpl

@@ -0,0 +1,26 @@
+{{/* Allow KubeVersion to be overridden. */}}
+{{- define "kubeVersion" -}}
+  {{- default .Capabilities.KubeVersion.Version .Values.kubeVersionOverride -}}
+{{- end -}}
+
+{{/* Get Ingress API Version */}}
+{{- define "ingress.apiVersion" -}}
+  {{- if and (.Capabilities.APIVersions.Has "networking.k8s.io/v1") (semverCompare ">= 1.19-0" (include "kubeVersion" .)) -}}
+      {{- print "networking.k8s.io/v1" -}}
+  {{- else if .Capabilities.APIVersions.Has "networking.k8s.io/v1beta1" -}}
+    {{- print "networking.k8s.io/v1beta1" -}}
+  {{- else -}}
+    {{- print "extensions/v1beta1" -}}
+  {{- end -}}
+{{- end -}}
+
+{{/* Check Ingress stability */}}
+{{- define "ingress.isStable" -}}
+  {{- eq (include "ingress.apiVersion" .) "networking.k8s.io/v1" -}}
+{{- end -}}
+
+{{/* Check Ingress supports pathType */}}
+{{/* pathType was added to networking.k8s.io/v1beta1 in Kubernetes 1.18 */}}
+{{- define "ingress.supportsPathType" -}}
+  {{- or (eq (include "ingress.isStable" .) "true") (and (eq (include "ingress.apiVersion" .) "networking.k8s.io/v1beta1") (semverCompare ">= 1.18-0" (include "kubeVersion" .))) -}}
+{{- end -}}

charts/inbucket/templates/ingress.yaml

@@ -1,4 +1,6 @@
-apiVersion: extensions/v1beta1
+{{- $apiIsStable := eq (include "ingress.isStable" .) "true" -}}
+{{- $ingressSupportsPathType := eq (include "ingress.supportsPathType" .) "true" -}}
+apiVersion: {{ include "ingress.apiVersion" . }}
 kind: Ingress
 metadata:
   name: "inbucket"
@@ -14,6 +16,16 @@ spec:
       http:
         paths:
           - path: /
+            {{- if $ingressSupportsPathType }}
+            pathType: Prefix
+            {{- end }}
             backend:
+                {{- if $apiIsStable }}
+                service:
+                  name: {{ include "inbucket.fullname" . }}
+                  port:
+                    name: http
+                {{- else }}
                 serviceName: {{ include "inbucket.fullname" . }}
                 servicePort: http
+                {{- end }}

charts/k8ssandra-test-cluster/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

charts/k8ssandra-test-cluster/Chart.yaml

@@ -0,0 +1,9 @@
+apiVersion: v2
+name: k8ssandra-test-cluster
+description: K8ssandra (Cassandra cluster) K8ssandraCluster object for wire test servers. (This does not install K8ssandra itself!)
+
+type: application
+
+version: 0.1.0
+
+appVersion: "0.39.2"

charts/k8ssandra-test-cluster/README.md

@@ -0,0 +1,89 @@
+# k8ssandra-test-cluster Helm chart
+
+`k8ssandra-test-cluster` provides a `K8ssandraCluster` object to create a
+*Cassandra* database with
+[`k8ssandra-operator`](https://artifacthub.io/packages/helm/k8ssandra/k8ssandra-operator).
+**It does not install `k8ssandra-operator` itself!** This configuration is meant
+to be used in test environments: **It lacks crucial parts like backups
+(`medusa`)!**
+
+## Usage in Helmfile
+
+### Prerequisites
+
+You need a *storage class* that can automatically request storage volumes. For
+Hetzner's cloud see: [Container Storage Interface driver for Hetzner
+Cloud](https://github.com/hetznercloud/csi-driver)
+
+### Usage
+
+These entries are used in the `helfile` file:
+
+``` yaml
+...
+
+repositories:
+  - name: wire
+    url: 'https://s3-eu-west-1.amazonaws.com/public.wire.com/charts'
+  - name: k8ssandra-stable
+    url: https://helm.k8ssandra.io/stable
+
+...
+
+releases:
+  - name: k8ssandra-operator
+    chart: 'k8ssandra-stable/k8ssandra-operator'
+    namespace: databases
+    version: 0.39.2
+    values:
+      # Use a cass-operator image that is compatible to the K8s cluster version
+      - cass-operator:
+            image:
+              tag: v1.10.5
+
+  # Installs CDRs automatically
+  - name: k8ssandra-test-cluster
+    chart: "wire/k8ssandra-test-cluster"
+    namespace: "databases"
+    version: {{ .Values.wireChartVersion | quote }}
+    needs:
+      - 'databases/k8ssandra-operator'
+    wait: true
+    waitForJobs: true
+
+  - name: 'wire-server'
+    namespace: 'wire'
+    chart: 'wire/wire-server'
+    version: {{ .Values.wireChartVersion | quote }}
+    values:
+      - './helm_vars/wire-server/values.yaml.gotmpl'
+    secrets:
+      - './helm_vars/wire-server/secrets.yaml'
+    needs:
+      - 'databases/k8ssandra-test-cluster'
+
+...
+```
+
+Please note the `needs` relations of the releases: `wire-server` *needs*
+`k8ssandra-test-cluster` which *needs* `k8ssandra-operator`.
+
+`wait` and `waitForJobs` are mandatory for `k8ssandra-test-cluster` in this
+setup: These settings ensure that the database really exists before resuming
+with the deployment.
+
+## Implementation details
+
+### k8ssandra-cluster.yaml
+
+Contains the `K8ssandraCluster` object. Its schema is described in the [CRD
+reference](https://docs-v2.k8ssandra.io/reference/crd/k8ssandra-operator-crds-latest/#k8ssandracluster)
+
+The specified *Cassandra* cluster runs on a single Node with reasonable
+resources for test environments.
+
+### check-cluster-job.yaml
+
+Defines a job that tries to connect to the final *Cassandra* database. Other
+deployments can wait on this. This is useful because `wire-server` needs a
+working database right from the beginning of it's deployment.

charts/k8ssandra-test-cluster/templates/check-cluster-job.yaml

@@ -0,0 +1,19 @@
+# This job fails until the Cassandra created database is reachable. The Helmfile
+# deployment can wait for it. This is used to start wire-server deployments only
+# with a reachable database.
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: check-cluster-job
+  namespace: databases
+spec:
+  template:
+    spec:
+      containers:
+      - name: cassandra
+        image: cassandra:3.11
+        command: ["cqlsh", "k8ssandra-cluster-datacenter-1-service"]
+      restartPolicy: OnFailure
+  # Default is 6 retries. 8 is a bit arbitrary, but should be sufficient for
+  # low resource environments (e.g. Wire-in-a-box.)
+  backoffLimit: 8