diff --git a/CHANGELOG.md b/CHANGELOG.md index 972567033..80d31660a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -12,6 +12,12 @@ --> +# Relase 5.25 R2 + +## Release notes + +* Changed: disabled the MLS by default in 5.25-R1 and release it as 5.25R2 + # Relase 5.25 R1 ## Release notes diff --git a/ansible/inventory/demo/host.yml b/ansible/inventory/demo/host.yml index 9ea8f4241..6ba560c15 100644 --- a/ansible/inventory/demo/host.yml +++ b/ansible/inventory/demo/host.yml @@ -18,7 +18,7 @@ wiab: wire_ip: "" # artifact_hash - artifact_hash: "432712ada7e95e224f8e0e6c90b2873613ba7e45" + artifact_hash: "f1ae0bda603c10e789468b7da0d3316f709d3d5f" # docker vars docker_ce_version: "5:28.1.1-1~ubuntu.24.04~noble" diff --git a/ansible/inventory/demo/wiab-staging.yml b/ansible/inventory/demo/wiab-staging.yml index 5692e6644..c7ad760e8 100644 --- a/ansible/inventory/demo/wiab-staging.yml +++ b/ansible/inventory/demo/wiab-staging.yml @@ -6,6 +6,6 @@ wiab-staging: ansible_user: 'demo' ansible_ssh_private_key_file: "~/.ssh/id_ed25519" vars: - artifact_hash: 432712ada7e95e224f8e0e6c90b2873613ba7e45 + artifact_hash: f1ae0bda603c10e789468b7da0d3316f709d3d5f # when enabled, disable WAN SNAT/masquerading for VMs on the private network private_deployment: true diff --git a/ansible/inventory/offline/99-static.yml b/ansible/inventory/offline/99-static.yml new file mode 100644 index 000000000..72a1dea29 --- /dev/null +++ b/ansible/inventory/offline/99-static.yml @@ -0,0 +1,137 @@ +# yaml equivalent of 99-static ini file +# for a full list of vars check 99-static file +all: + vars: + ansible_user: "some_user" + ansible_ssh_common_args: >- + -o StrictHostKeyChecking=no + -o UserKnownHostsFile=/dev/null + -o ControlMaster=auto + -o ControlPersist=60s + # ssh private_key is stored in wire-server-deploy/ssh in case vms are created using bin/offline-vm-setup.sh + # in case of terraform automated-tests, it will be vailable via forwarded ssh agents + # ansible_ssh_private_key_file: "ssh/id_ed25519" + +assethost: + hosts: + assethost: + ansible_host: "assethost_ip" + +kube-node: + hosts: + kubenode1: + ansible_host: "kubenode1_ip" + etcd_member_name: kubenode1 + ip: "kubenode1_ip" + kubenode2: + ansible_host: "kubenode2_ip" + etcd_member_name: kubenode2 + ip: "kubenode2_ip" + kubenode3: + ansible_host: "kubenode3_ip" + etcd_member_name: kubenode3 + ip: "kubenode3_ip" + +kube-master: + children: + kube-node: {} + +etcd: + children: + kube-node: {} + +k8s-cluster: + children: + kube-node: {} + kube-master: {} + +cassandra: + hosts: + cassandra1: + ansible_host: "cassandra1_ip" + cassandra2: + ansible_host: "cassandra2_ip" + cassandra3: + ansible_host: "cassandra3_ip" + vars: + cassandra_network_interface: enp1s0 + +cassandra_seed: + hosts: + cassandra1: {} + +elasticsearch: + hosts: + elasticsearch1: + ansible_host: "elasticsearch1_ip" + elasticsearch2: + ansible_host: "elasticsearch2_ip" + elasticsearch3: + ansible_host: "elasticsearch3_ip" + vars: + elasticsearch_network_interface: enp1s0 + +elasticsearch_master: + children: + elasticsearch: {} + +minio: + hosts: + minio1: + ansible_host: "minio1_ip" + minio2: + ansible_host: "minio2_ip" + minio3: + ansible_host: "minio3_ip" + vars: + minio_network_interface: enp1s0 + +rmq-cluster: + # host names here must match each node's actual hostname + # its a requirement for rabbitmq + hosts: + rabbitmq1: + ansible_host: "rabbitmq1_ip" + rabbitmq2: + ansible_host: "rabbitmq2_ip" + rabbitmq3: + ansible_host: "rabbitmq3_ip" + vars: + rabbitmq_network_interface: enp1s0 + # host name here must match each node's actual hostname + rabbitmq_cluster_master: rabbitmq1 + +postgresql: + hosts: + postgresql1: + ansible_host: "postgresql1_ip" + postgresql2: + ansible_host: "postgresql2_ip" + postgresql3: + ansible_host: "postgresql3_ip" + vars: + wire_dbname: wire-server + postgresql_network_interface: enp1s0 + repmgr_node_config: + # host names here must match each node's actual hostname + postgresql1: # Maps to postgresql_rw group + node_id: 1 + priority: 150 + role: primary + postgresql2: # Maps to first postgresql_ro + node_id: 2 + priority: 100 + role: standby + postgresql3: # Maps to second postgresql_ro + node_id: 3 + priority: 50 + role: standby + +postgresql_rw: + hosts: + postgresql1: {} + +postgresql_ro: + hosts: + postgresql2: {} + postgresql3: {} \ No newline at end of file diff --git a/bin/helm-operations.sh b/bin/helm-operations.sh index 164aac3ac..6ae67e747 100755 --- a/bin/helm-operations.sh +++ b/bin/helm-operations.sh @@ -280,4 +280,4 @@ fi deploy_calling_services } -main +#main diff --git a/changelog.d/2-wire-builds/5.25-mls-disabled b/changelog.d/2-wire-builds/5.25-mls-disabled new file mode 100644 index 000000000..a2e6ea948 --- /dev/null +++ b/changelog.d/2-wire-builds/5.25-mls-disabled @@ -0,0 +1 @@ +Fixed: disabled the MLS by default for 5.25-R1 diff --git a/offline/cd_staging.sh b/offline/cd_staging.sh index cd4d2ccbc..206d0883f 100755 --- a/offline/cd_staging.sh +++ b/offline/cd_staging.sh @@ -231,6 +231,10 @@ scp $SSH_OPTS "$TARGET" "demo@$adminhost":./ansible/inventory/offline/inventory. ssh $SSH_OPTS "demo@$adminhost" cat ./ansible/inventory/offline/inventory.yml || true +ssh $SSH_OPTS "demo@$adminhost" 'printf "\nmain\n\n" >> ./bin/helm-operations.sh' || true + +ssh $SSH_OPTS "demo@$adminhost" cat ./bin/helm-operations.sh || true + # NOTE: Agent is forwarded; so that the adminhost can provision the other boxes ssh $SSH_OPTS -A "demo@$adminhost" ./bin/offline-deploy.sh diff --git a/offline/default-build/build.sh b/offline/default-build/build.sh index a94855536..92aaf042e 100755 --- a/offline/default-build/build.sh +++ b/offline/default-build/build.sh @@ -59,6 +59,9 @@ cp -r "${ROOT_DIR}"/dashboards "${OUTPUT_DIR}"/ # post_chart_process_1.sh # post_chart_process_2.sh +# pulling one extra webapp image +echo "quay.io/wire/webapp:2026-06-08-production.0" | create-container-dump "${OUTPUT_DIR}"/extra-images + # -------------------------- # Following tasks are independent from each other @@ -91,6 +94,7 @@ ITEMS_TO_ARCHIVE=( "containers-adminhost" "containers-helm.tar" "containers-system.tar" + "extra-images" "charts" "values" "../../../ansible" diff --git a/values/webapp/demo-values.example.yaml b/values/webapp/demo-values.example.yaml index 97a45fb7a..144e571e0 100644 --- a/values/webapp/demo-values.example.yaml +++ b/values/webapp/demo-values.example.yaml @@ -1,6 +1,6 @@ replicaCount: 1 -# image: -# tag: some-tag (only override if you want a newer/different version than what is in the chart) +image: + tag: 2026-06-08-production.0 config: externalUrls: backendRest: nginz-https.example.com diff --git a/values/webapp/prod-values.example.yaml b/values/webapp/prod-values.example.yaml index 0d6286cd1..76e6ec0ff 100644 --- a/values/webapp/prod-values.example.yaml +++ b/values/webapp/prod-values.example.yaml @@ -1,6 +1,6 @@ replicaCount: 3 -# image: -# tag: some-tag (only override if you want a newer/different version than what is in the chart) +image: + tag: 2025-09-24-production.0 config: externalUrls: backendRest: nginz-https.example.com @@ -11,6 +11,8 @@ config: # See full list of available environment variables: https://github.com/wireapp/wire-web-config-default/blob/master/wire-webapp/.env.defaults envVars: APP_NAME: "Webapp" + FEATURE_USE_CORE_CRYPTO: "true" + MAX_API_VERSION: "12" ENFORCE_HTTPS: "true" FEATURE_CHECK_CONSENT: "false" # Note: disabling showing the user creation is not the same thing as user creation being disabled. diff --git a/values/wire-server/demo-values.example.yaml b/values/wire-server/demo-values.example.yaml index f12567827..83311ae5f 100644 --- a/values/wire-server/demo-values.example.yaml +++ b/values/wire-server/demo-values.example.yaml @@ -55,7 +55,7 @@ brig: teamMemberWelcome: https://wire.example.com/download # change this enableFederation: false # Keep false unless federation is explicitly configured optSettings: - setEnableMLS: true # Enable for MLS protocol use + setEnableMLS: false # Enable for MLS protocol use setFederationDomain: example.com # change this per host deployment # Sync the domain with the 'host' variable in the sftd chart # Comment the next line (by adding '#' before it) if conference calling is not used @@ -199,7 +199,7 @@ galley: status: disabled config: protocolToggleUsers: [] - defaultProtocol: mls + defaultProtocol: proteus allowedCipherSuites: [2] defaultCipherSuite: 2 supportedProtocols: [proteus, mls] diff --git a/values/wire-server/prod-values.example.yaml b/values/wire-server/prod-values.example.yaml index 31932fbe5..3c097f0ae 100644 --- a/values/wire-server/prod-values.example.yaml +++ b/values/wire-server/prod-values.example.yaml @@ -55,7 +55,7 @@ brig: teamMemberWelcome: https://wire.example.com/download # change this enableFederation: false # Keep false unless federation is explicitly configured optSettings: - setEnableMLS: true # Enable for MLS protocol use + setEnableMLS: false # Enable for MLS protocol use setFederationDomain: example.com # change this per host deployment # Sync the domain with the 'host' variable in the sftd chart # Comment the next line (by adding '#' before it) if conference calling is not used @@ -199,7 +199,7 @@ galley: status: disabled config: protocolToggleUsers: [] - defaultProtocol: mls + defaultProtocol: proteus allowedCipherSuites: [2] defaultCipherSuite: 2 supportedProtocols: [proteus, mls]