diff --git a/ansible/setup-offline-sources.yml b/ansible/setup-offline-sources.yml index b1fb61d5a..762e8a125 100644 --- a/ansible/setup-offline-sources.yml +++ b/ansible/setup-offline-sources.yml @@ -74,10 +74,14 @@ file: path: /etc/apt/sources.list state: absent + tags: + - aptconfig - name: Remove /etc/apt/sources.list.d/ to remove all online debian package repos file: path: /etc/apt/sources.list.d/ state: absent + tags: + - aptconfig ####################################################################### # If your offline repo's debian key has expired, uncomment this block. @@ -103,11 +107,15 @@ apt_key: url: "{{ ubuntu_repo_gpgkey }}" state: present + tags: + - aptconfig - name: Register offline repo apt_repository: repo: "deb {{ ubuntu_repo_base_url }} {{ ansible_distribution_release }} main" state: present + tags: + - aptconfig - name: Apt update apt: update_cache: yes diff --git a/bin/helm-operations.sh b/bin/helm-operations.sh index 164aac3ac..b25bd216b 100755 --- a/bin/helm-operations.sh +++ b/bin/helm-operations.sh @@ -35,7 +35,6 @@ function dump_debug_logs { trap dump_debug_logs ERR configure_calling_environment() { - if [[ "$DEPLOY_CALLING_SERVICES" != "TRUE" ]]; then return 0 fi @@ -54,6 +53,14 @@ configure_calling_environment() { if [[ -z "$CALLING_NODE" ]]; then echo "Error: could not determine the last kube worker node via kubectl" exit 1 + else + echo "Selecting calling node: $CALLING_NODE" + # export this, in the case that we are being sourced. + if [[ ! "${BASH_SOURCE[0]}" == "$0" ]] ; then + export CALLING_NODE + else + echo "export CALLING_NODE=\"$CALLING_NODE\"" + fi fi } @@ -75,7 +82,6 @@ sync_pg_secrets() { # Creates values.yaml from prod-values.example.yaml and secrets.yaml from prod-secrets.example.yaml # Works on all chart directories in $BASE_DIR/values/ process_values() { - ENV=$1 TYPE=$2 charts=(fake-aws smtp rabbitmq databases-ephemeral reaper wire-server webapp account-pages team-settings ingress-nginx-controller) @@ -94,6 +100,8 @@ process_values() { fi timestp=$(date +"%Y%m%d_%H%M%S") + echo "templating $ENV $TYPE with domain: $TARGET_SYSTEM, and cert manager email: $CERT_MANAGER_EMAIL" + for chart in "${charts[@]}"; do chart_dir="$BASE_DIR/values/$chart" if [[ -d "$chart_dir" ]]; then @@ -114,7 +122,6 @@ process_values() { # selectively setting values of following charts which requires additional values # wire-server, webapp, team-settings, account-pages, nginx-ingress-services, sftd and coturn configure_values() { - TEMP_DIR=$(mktemp -d) trap 'rm -rf $TEMP_DIR' EXIT @@ -140,6 +147,10 @@ configure_values() { fi if [[ "$DEPLOY_CALLING_SERVICES" == "TRUE" ]]; then + if [ ! -v "$CALLING_NODE" ] ; then + echo "Refusing to deploy calling services; CALLING_NODE is not set." + return 1 + fi # to find IP address of calling NODE CALLING_NODE_IP=$(kubectl get node "$CALLING_NODE" -o jsonpath='{.status.addresses[?(@.type=="InternalIP")].address}') @@ -169,14 +180,14 @@ configure_values() { for file in "${files[@]}"; do if ! cmp -s "$TEMP_DIR/$file" "$BASE_DIR/values/${file%-values.yaml}/values.yaml"; then cp "$TEMP_DIR/$file" "$BASE_DIR/values/${file%-values.yaml}/values.yaml" - echo "Updating $BASE_DIR/values/${file%-values.yaml}/values.yaml" + echo "Updating $BASE_DIR/values/${file%-values.yaml}/values.yaml" + else + echo "no differences found; not updating $BASE_DIR/values/${file%-values.yaml}/values.yaml" fi done - } deploy_charts() { - local charts=("$@") echo "Following charts will be deployed: ${charts[*]}" @@ -218,7 +229,6 @@ deploy_charts() { } deploy_cert_manager() { - kubectl get namespace cert-manager-ns || kubectl create namespace cert-manager-ns helm upgrade --install --wait --timeout=5m0s -n cert-manager-ns cert-manager "$BASE_DIR/charts/cert-manager" --values "$BASE_DIR/values/cert-manager/values.yaml" @@ -227,7 +237,6 @@ deploy_cert_manager() { } deploy_calling_services() { - if [[ "$DEPLOY_CALLING_SERVICES" != "TRUE" ]]; then echo "Skipping sftd and coturn deployment because DEPLOY_CALLING_SERVICES=$DEPLOY_CALLING_SERVICES" return 0 @@ -250,15 +259,16 @@ main() { # initialize calling-service specific values only when enabled configure_calling_environment -# Create prod-values.example.yaml to values.yaml and take backup +# Create prod-values.example.yaml to values.yaml and take backup. Note: does not template anything. process_values "prod" "values" -# Create prod-secrets.example.yaml to secrets.yaml and take backup + +# Create prod-secrets.example.yaml to secrets.yaml and take backup. process_values "prod" "secrets" -# Sync postgresql secret +# Sync postgresql secret. sync_pg_secrets -# configure chart specific variables for each chart in values.yaml file +# configure the chart specific variables for each chart in values.yaml file. This is where templating happens. configure_values # deploying with external datastores, useful for prod setup @@ -280,4 +290,5 @@ fi deploy_calling_services } -main +# only execute main when this script is executed, not when it is sourced. +[[ "${BASH_SOURCE[0]}" == "$0" ]] && main "$@" diff --git a/bin/migrate_secrets.sh b/bin/migrate_secrets.sh new file mode 100644 index 000000000..aff9fd98f --- /dev/null +++ b/bin/migrate_secrets.sh @@ -0,0 +1,98 @@ +#!/usr/bin/env bash +# migrate secrets from an old wire-server-deploy directory. + +# Usage: +# +# If your secrets are in ../wire-server-deploy/values/wire-server/prod-secrets.example.yaml, +# and you are CD'd into a directory containing a wire-server-deploy package, you can just run this. +# +# Otherwise, set OLD to point to your old values file, NEW to point to your file you want to import into, and run. + +set -euo pipefail + +OLD="${OLD:-../wire-server-deploy/values/wire-server/secrets.yaml}" +NEW="${NEW:-values/wire-server/prod-secrets.example.yaml}" +NEWCOTURN="${NEWCOTURN:-values/coturn/prod-secrets.example.yaml}" + +if [ ! -f "$OLD" ]; then + { + echo "could not find OLD YAML file: $OLD" + echo "please set OLD to point to your in-use wire-server secrets file manually (see usage at top of script)." + exit 1 + } +fi + +if [ ! -f "$NEW" ]; then + { + echo "could not find NEW YAML file: $NEW" + echo "please set NEW to point to your new wire-server secrets files manually (see usage at top of script)." + exit 1 + } +fi +OUT="${NEW}.migrated" + +if [ ! -f "$NEWCOTURN" ]; then + { + echo "could not find NEWCOTURN YAML file: $NEW" + echo "please set NEWCOTURN to point to your new coturn secrets files manually (see usage at top of script)." + exit 1 + } +fi +OUTCOTURN="${NEWCOTURN}.migrated" + +cp "$NEW" "$OUT" +cp "$NEWCOTURN" "$OUTCOTURN" + +# Use YQ for reading. +PUB=$(yq -r '.brig.secrets.zAuth.publicKeys' "$OLD") +PRIV=$(yq -r '.brig.secrets.zAuth.privateKeys' "$OLD") +TURN=$(yq -r '.brig.secrets.turn.secret' "$OLD") + +# Cargohold AWS access. +CH_AWS_ID=$(yq -r '.cargohold.secrets.awsKeyId' "$OLD") +CH_AWS_SECRET=$(yq -r '.cargohold.secrets.awsSecretKey' "$OLD") + +# The Postgres secret. +PG_PASSWORD=$(yq -r '.brig.secrets.pgPassword' "$OLD") + +# Whole keys. +ED25519=$(yq -r '.galley.secrets.mlsPrivateKeys.removal.ed25519' "$OLD") +P256=$(yq -r '.galley.secrets.mlsPrivateKeys.removal.ecdsa_secp256r1_sha256' "$OLD") +P384=$(yq -r '.galley.secrets.mlsPrivateKeys.removal.ecdsa_secp384r1_sha384' "$OLD") +P521=$(yq -r '.galley.secrets.mlsPrivateKeys.removal.ecdsa_secp521r1_sha512' "$OLD") + +# Use perl for writing into the new file. This is to prevent YQ from eating our empty lines, in the yaml. +PUB="$PUB" perl -0pi -e 's{(brig:\n(?:.*\n)*?[ \t]+zAuth:\n(?:.*\n)*?^[ \t]+publicKeys:[ \t]+)[^\n]+}{$1.qq{"$ENV{PUB}"}}me' "$OUT" +PRIV="$PRIV" perl -0pi -e 's{(brig:\n(?:.*\n)*?[ \t]+zAuth:\n(?:.*\n)*?^[ \t]+privateKeys:[ \t]+)[^\n]+}{$1.qq{"$ENV{PRIV}"}}me' "$OUT" +TURN="$TURN" perl -0pi -e 's{(brig:\n(?:.*\n)*?[ \t]+turn:\n(?:.*\n)*?^[ \t]+secret:[ \t]+)[^\n]+}{$1.qq{"$ENV{TURN}"}}me' "$OUT" + +CH_AWS_ID="$CH_AWS_ID" perl -0pi -e 's{(cargohold:\n(?:.*\n)*?^[ \t]+awsKeyId:[ \t]+)[^ \n]+}{$1.qq{"$ENV{CH_AWS_ID}"}}me' "$OUT" +CH_AWS_SECRET="$CH_AWS_SECRET" perl -0pi -e 's{(cargohold:\n(?:.*\n)*?^[ \t]+awsSecretKey:[ \t]+)[^ \n]+}{$1.qq{"$ENV{CH_AWS_SECRET}"}}me' "$OUT" + +PG_PASSWORD="$PG_PASSWORD" perl -0pi -e 's{(brig:\n(?:.*\n)*?^[ \t]+secrets:\n(?:.*\n)*?^[ \t]+pgPassword:[ \t]+)[^\n]+}{$1.$ENV{PG_PASSWORD}}me' "$OUT" +PG_PASSWORD="$PG_PASSWORD" perl -0pi -e 's{(galley:\n(?:.*\n)*?^[ \t]+secrets:\n(?:.*\n)*?^[ \t]+pgPassword:[ \t]+)[^\n]+}{$1.$ENV{PG_PASSWORD}}me' "$OUT" +PG_PASSWORD="$PG_PASSWORD" perl -0pi -e 's{(background-worker:\n(?:.*\n)*?^[ \t]+secrets:\n(?:.*\n)*?^[ \t]+pgPassword:[ \t]+)[^\n]+}{$1.$ENV{PG_PASSWORD}}me' "$OUT" + +ED25519="$ED25519" perl -0pi -e 's{(^[ \t]+ed25519:[ \t]+\|\n)([ \t]+)-----BEGIN PRIVATE KEY-----.*?^\2-----END PRIVATE KEY-----}{$k=$1; $i=$2; $k.join("",map{"$i$_\n"}split(/\n/,$ENV{ED25519}))=~s/\n$//r}mse' "$OUT" +P256="$P256" perl -0pi -e 's{(^[ \t]+ecdsa_secp256r1_sha256:[ \t]+\|\n)([ \t]+)-----BEGIN PRIVATE KEY-----.*?^\2-----END PRIVATE KEY-----}{$k=$1; $i=$2; $k.join("",map{"$i$_\n"}split(/\n/,$ENV{P256}))=~s/\n$//r}mse' "$OUT" +P384="$P384" perl -0pi -e 's{(^[ \t]+ecdsa_secp384r1_sha384:[ \t]+\|\n)([ \t]+)-----BEGIN PRIVATE KEY-----.*?^\2-----END PRIVATE KEY-----}{$k=$1; $i=$2; $k.join("",map{"$i$_\n"}split(/\n/,$ENV{P384}))=~s/\n$//r}mse' "$OUT" +P521="$P521" perl -0pi -e 's{(^[ \t]+ecdsa_secp521r1_sha512:[ \t]+\|\n)([ \t]+)-----BEGIN PRIVATE KEY-----.*?^\2-----END PRIVATE KEY-----}{$k=$1; $i=$2; $k.join("",map{"$i$_\n"}split(/\n/,$ENV{P521}))=~s/\n$//r}mse' "$OUT" +PUB="$PUB" perl -0pi -e 's{(^nginz:\n*?[ \t]+secrets:\n*?[ \t]+zAuth:\n(?:[ \t]+\#[^\n]*\n)[ \t]+publicKeys:[ \t]+)[^\n]+}{$1 . qq{"$ENV{PUB}"}}mex' "$OUT" + +if diff -u "$NEW" "$OUT" ; then + echo "no difference found in wire-server configuration." + rm -f "$OUT" +else + read -rp "Replace $NEW? [y/N] " answer + [[ "$answer" =~ ^[Yy]$ ]] && mv "$OUT" "$NEW" || echo "Kept: $OUT" +fi + +TURN="$TURN" perl -0pi -e 's{(^[ \t]+zrestSecrets:\n[ \t]+-[ \t]+)"[^"]*"}{$1.qq{"$ENV{TURN}"}}me' "$OUTCOTURN" + +if diff -u "$NEWCOTURN" "$OUTCOTURN"; then + echo "no difference found in coturn configuration." + rm -f "$OUTCOTURN" +else + read -rp "Replace $NEWCOTURN? [y/N] " answer + [[ "$answer" =~ ^[Yy]$ ]] && mv "$OUTCOTURN" "$NEWCOTURN" || echo "Kept: $OUTCOTURN" +fi diff --git a/changelog.d/3-deploy-builds/upgrade_wiab_staging b/changelog.d/3-deploy-builds/upgrade_wiab_staging new file mode 100644 index 000000000..d52885bde --- /dev/null +++ b/changelog.d/3-deploy-builds/upgrade_wiab_staging @@ -0,0 +1,3 @@ +Added: bin/migrate_secrets.sh to migrate secrets from an old deploy directory to a new one. +Changed: bin/helm-operations.sh to allow it's use during an upgrade. +Changed: ansible/setup-offline-sources.yml to allow running it without touching APT configurations during an upgrade.