Wpb 26240 - Add tools for upgrade of WIAB-staging.

ansible/setup-offline-sources.yml

@@ -74,10 +74,14 @@
         file:
           path: /etc/apt/sources.list
           state: absent
+        tags:
+          - aptconfig
       - name: Remove /etc/apt/sources.list.d/ to remove all online debian package repos
         file:
           path: /etc/apt/sources.list.d/
           state: absent
+        tags:
+          - aptconfig
 
 #######################################################################
 # If your offline repo's debian key has expired, uncomment this block.
@@ -103,11 +107,15 @@
         apt_key:
           url: "{{ ubuntu_repo_gpgkey }}"
           state: present
+        tags:
+          - aptconfig
 
       - name: Register offline repo
         apt_repository:
           repo: "deb {{ ubuntu_repo_base_url }} {{ ansible_distribution_release }} main"
           state: present
+        tags:
+          - aptconfig
       - name: Apt update
         apt:
           update_cache: yes

bin/helm-operations.sh

@@ -35,7 +35,6 @@ function dump_debug_logs {
 trap dump_debug_logs ERR
 
 configure_calling_environment() {
-
   if [[ "$DEPLOY_CALLING_SERVICES" != "TRUE" ]]; then
     return 0
   fi
@@ -54,6 +53,14 @@ configure_calling_environment() {
   if [[ -z "$CALLING_NODE" ]]; then
     echo "Error: could not determine the last kube worker node via kubectl"
     exit 1
+  else
+    echo "Selecting calling node: $CALLING_NODE"
+    # export this, in the case that we are being sourced.  
+    if [[ ! "${BASH_SOURCE[0]}" == "$0" ]] ; then  
+        export CALLING_NODE
+    else
+        echo "export CALLING_NODE=\"$CALLING_NODE\""
+    fi
   fi
 }
 
@@ -75,7 +82,6 @@ sync_pg_secrets() {
 # Creates values.yaml from prod-values.example.yaml and secrets.yaml from prod-secrets.example.yaml
 # Works on all chart directories in $BASE_DIR/values/
 process_values() {
-
   ENV=$1
   TYPE=$2
   charts=(fake-aws smtp rabbitmq databases-ephemeral reaper wire-server webapp account-pages team-settings ingress-nginx-controller)
@@ -94,6 +100,8 @@ process_values() {
   fi
   timestp=$(date +"%Y%m%d_%H%M%S")
 
+  echo "templating $ENV $TYPE with domain: $TARGET_SYSTEM, and cert manager email: $CERT_MANAGER_EMAIL"
+
   for chart in "${charts[@]}"; do
     chart_dir="$BASE_DIR/values/$chart"
     if [[ -d "$chart_dir" ]]; then
@@ -114,7 +122,6 @@ process_values() {
 # selectively setting values of following charts which requires additional values
 # wire-server, webapp, team-settings, account-pages, nginx-ingress-services, sftd and coturn
 configure_values() {
-
   TEMP_DIR=$(mktemp -d)
   trap 'rm -rf $TEMP_DIR' EXIT
 
@@ -140,6 +147,10 @@ configure_values() {
   fi
 
   if [[ "$DEPLOY_CALLING_SERVICES" == "TRUE" ]]; then
+    if [ ! -v "$CALLING_NODE" ] ; then
+        echo "Refusing to deploy calling services; CALLING_NODE is not set."
+        return 1
+    fi
     # to find IP address of calling NODE
     CALLING_NODE_IP=$(kubectl get node "$CALLING_NODE" -o jsonpath='{.status.addresses[?(@.type=="InternalIP")].address}')
 
@@ -169,14 +180,14 @@ configure_values() {
   for file in "${files[@]}"; do
     if ! cmp -s "$TEMP_DIR/$file" "$BASE_DIR/values/${file%-values.yaml}/values.yaml"; then
       cp "$TEMP_DIR/$file" "$BASE_DIR/values/${file%-values.yaml}/values.yaml"
-      echo "Updating  $BASE_DIR/values/${file%-values.yaml}/values.yaml"
+      echo "Updating $BASE_DIR/values/${file%-values.yaml}/values.yaml"
+    else
+      echo "no differences found; not updating $BASE_DIR/values/${file%-values.yaml}/values.yaml"
     fi
   done
-
 }
 
 deploy_charts() {
-
   local charts=("$@")
   echo "Following charts will be deployed: ${charts[*]}"
 
@@ -218,7 +229,6 @@ deploy_charts() {
 }
 
 deploy_cert_manager() {
-
   kubectl get namespace cert-manager-ns || kubectl create namespace cert-manager-ns
   helm upgrade --install --wait --timeout=5m0s -n cert-manager-ns cert-manager  "$BASE_DIR/charts/cert-manager" --values "$BASE_DIR/values/cert-manager/values.yaml"
 
@@ -227,7 +237,6 @@ deploy_cert_manager() {
 }
 
 deploy_calling_services() {
-
   if [[ "$DEPLOY_CALLING_SERVICES" != "TRUE" ]]; then
     echo "Skipping sftd and coturn deployment because DEPLOY_CALLING_SERVICES=$DEPLOY_CALLING_SERVICES"
     return 0
@@ -250,15 +259,16 @@ main() {
 # initialize calling-service specific values only when enabled
 configure_calling_environment
 
-# Create prod-values.example.yaml to values.yaml and take backup
+# Create prod-values.example.yaml to values.yaml and take backup. Note: does not template anything.
 process_values "prod" "values"
-# Create prod-secrets.example.yaml to secrets.yaml and take backup
+
+# Create prod-secrets.example.yaml to secrets.yaml and take backup.
 process_values "prod" "secrets"
 
-# Sync postgresql secret
+# Sync postgresql secret.
 sync_pg_secrets
 
-# configure chart specific variables for each chart in values.yaml file
+# configure the chart specific variables for each chart in values.yaml file. This is where templating happens.
 configure_values
 
 # deploying with external datastores, useful for prod setup
@@ -280,4 +290,5 @@ fi
 deploy_calling_services
 }
 
-main
+# only execute main when this script is executed, not when it is sourced.
+[[ "${BASH_SOURCE[0]}" == "$0" ]] && main "$@"

bin/migrate_secrets.sh

@@ -0,0 +1,98 @@
+#!/usr/bin/env bash
+# migrate secrets from an old wire-server-deploy directory.
+
+# Usage:
+#
+# If your secrets are in ../wire-server-deploy/values/wire-server/prod-secrets.example.yaml,
+# and you are CD'd into a directory containing a wire-server-deploy package, you can just run this.
+#
+# Otherwise, set OLD to point to your old values file, NEW to point to your file you want to import into, and run.
+
+set -euo pipefail
+
+OLD="${OLD:-../wire-server-deploy/values/wire-server/secrets.yaml}"
+NEW="${NEW:-values/wire-server/prod-secrets.example.yaml}"
+NEWCOTURN="${NEWCOTURN:-values/coturn/prod-secrets.example.yaml}"
+
+if [ ! -f "$OLD" ]; then
+    {
+	echo "could not find OLD YAML file: $OLD"
+	echo "please set OLD to point to your in-use wire-server secrets file manually (see usage at top of script)."
+	exit 1
+    }
+fi
+
+if [ ! -f "$NEW" ]; then
+    {
+	echo "could not find NEW YAML file: $NEW"
+	echo "please set NEW to point to your new wire-server secrets files manually (see usage at top of script)."
+	exit 1
+    }
+fi
+OUT="${NEW}.migrated"
+
+if [ ! -f "$NEWCOTURN" ]; then
+    {
+	echo "could not find NEWCOTURN YAML file: $NEW"
+	echo "please set NEWCOTURN to point to your new coturn secrets files manually (see usage at top of script)."
+	exit 1
+    }
+fi
+OUTCOTURN="${NEWCOTURN}.migrated"
+
+cp "$NEW" "$OUT"
+cp "$NEWCOTURN" "$OUTCOTURN"
+
+# Use YQ for reading.
+PUB=$(yq -r '.brig.secrets.zAuth.publicKeys' "$OLD")
+PRIV=$(yq -r '.brig.secrets.zAuth.privateKeys' "$OLD")
+TURN=$(yq -r '.brig.secrets.turn.secret' "$OLD")
+
+# Cargohold AWS access.
+CH_AWS_ID=$(yq -r '.cargohold.secrets.awsKeyId' "$OLD")
+CH_AWS_SECRET=$(yq -r '.cargohold.secrets.awsSecretKey' "$OLD")
+
+# The Postgres secret.
+PG_PASSWORD=$(yq -r '.brig.secrets.pgPassword' "$OLD")
+
+# Whole keys.
+ED25519=$(yq -r '.galley.secrets.mlsPrivateKeys.removal.ed25519' "$OLD")
+P256=$(yq -r '.galley.secrets.mlsPrivateKeys.removal.ecdsa_secp256r1_sha256' "$OLD")
+P384=$(yq -r '.galley.secrets.mlsPrivateKeys.removal.ecdsa_secp384r1_sha384' "$OLD")
+P521=$(yq -r '.galley.secrets.mlsPrivateKeys.removal.ecdsa_secp521r1_sha512' "$OLD")
+
+# Use perl for writing into the new file. This is to prevent YQ from eating our empty lines, in the yaml.
+PUB="$PUB" perl -0pi -e 's{(brig:\n(?:.*\n)*?[ \t]+zAuth:\n(?:.*\n)*?^[ \t]+publicKeys:[ \t]+)[^\n]+}{$1.qq{"$ENV{PUB}"}}me' "$OUT"
+PRIV="$PRIV" perl -0pi -e 's{(brig:\n(?:.*\n)*?[ \t]+zAuth:\n(?:.*\n)*?^[ \t]+privateKeys:[ \t]+)[^\n]+}{$1.qq{"$ENV{PRIV}"}}me' "$OUT"
+TURN="$TURN" perl -0pi -e 's{(brig:\n(?:.*\n)*?[ \t]+turn:\n(?:.*\n)*?^[ \t]+secret:[ \t]+)[^\n]+}{$1.qq{"$ENV{TURN}"}}me' "$OUT"
+
+CH_AWS_ID="$CH_AWS_ID" perl -0pi -e 's{(cargohold:\n(?:.*\n)*?^[ \t]+awsKeyId:[ \t]+)[^ \n]+}{$1.qq{"$ENV{CH_AWS_ID}"}}me' "$OUT"
+CH_AWS_SECRET="$CH_AWS_SECRET" perl -0pi -e 's{(cargohold:\n(?:.*\n)*?^[ \t]+awsSecretKey:[ \t]+)[^ \n]+}{$1.qq{"$ENV{CH_AWS_SECRET}"}}me' "$OUT"
+
+PG_PASSWORD="$PG_PASSWORD" perl -0pi -e 's{(brig:\n(?:.*\n)*?^[ \t]+secrets:\n(?:.*\n)*?^[ \t]+pgPassword:[ \t]+)[^\n]+}{$1.$ENV{PG_PASSWORD}}me' "$OUT"
+PG_PASSWORD="$PG_PASSWORD" perl -0pi -e 's{(galley:\n(?:.*\n)*?^[ \t]+secrets:\n(?:.*\n)*?^[ \t]+pgPassword:[ \t]+)[^\n]+}{$1.$ENV{PG_PASSWORD}}me' "$OUT"
+PG_PASSWORD="$PG_PASSWORD" perl -0pi -e 's{(background-worker:\n(?:.*\n)*?^[ \t]+secrets:\n(?:.*\n)*?^[ \t]+pgPassword:[ \t]+)[^\n]+}{$1.$ENV{PG_PASSWORD}}me' "$OUT"
+
+ED25519="$ED25519" perl -0pi -e 's{(^[ \t]+ed25519:[ \t]+\|\n)([ \t]+)-----BEGIN PRIVATE KEY-----.*?^\2-----END PRIVATE KEY-----}{$k=$1; $i=$2; $k.join("",map{"$i$_\n"}split(/\n/,$ENV{ED25519}))=~s/\n$//r}mse' "$OUT"
+P256="$P256" perl -0pi -e 's{(^[ \t]+ecdsa_secp256r1_sha256:[ \t]+\|\n)([ \t]+)-----BEGIN PRIVATE KEY-----.*?^\2-----END PRIVATE KEY-----}{$k=$1; $i=$2; $k.join("",map{"$i$_\n"}split(/\n/,$ENV{P256}))=~s/\n$//r}mse' "$OUT"
+P384="$P384" perl -0pi -e 's{(^[ \t]+ecdsa_secp384r1_sha384:[ \t]+\|\n)([ \t]+)-----BEGIN PRIVATE KEY-----.*?^\2-----END PRIVATE KEY-----}{$k=$1; $i=$2; $k.join("",map{"$i$_\n"}split(/\n/,$ENV{P384}))=~s/\n$//r}mse' "$OUT"
+P521="$P521" perl -0pi -e 's{(^[ \t]+ecdsa_secp521r1_sha512:[ \t]+\|\n)([ \t]+)-----BEGIN PRIVATE KEY-----.*?^\2-----END PRIVATE KEY-----}{$k=$1; $i=$2; $k.join("",map{"$i$_\n"}split(/\n/,$ENV{P521}))=~s/\n$//r}mse' "$OUT"
+PUB="$PUB" perl -0pi -e 's{(^nginz:\n*?[ \t]+secrets:\n*?[ \t]+zAuth:\n(?:[ \t]+\#[^\n]*\n)[ \t]+publicKeys:[ \t]+)[^\n]+}{$1 . qq{"$ENV{PUB}"}}mex' "$OUT"
+
+if diff -u "$NEW" "$OUT" ; then
+    echo "no difference found in wire-server configuration."
+    rm -f "$OUT"
+else
+    read -rp "Replace $NEW? [y/N] " answer
+    [[ "$answer" =~ ^[Yy]$ ]] && mv "$OUT" "$NEW" || echo "Kept: $OUT"
+fi
+
+TURN="$TURN" perl -0pi -e 's{(^[ \t]+zrestSecrets:\n[ \t]+-[ \t]+)"[^"]*"}{$1.qq{"$ENV{TURN}"}}me' "$OUTCOTURN"
+
+if diff -u "$NEWCOTURN" "$OUTCOTURN"; then
+    echo "no difference found in coturn configuration."
+    rm -f "$OUTCOTURN"
+else
+    read -rp "Replace $NEWCOTURN? [y/N] " answer
+    [[ "$answer" =~ ^[Yy]$ ]] && mv "$OUTCOTURN" "$NEWCOTURN" || echo "Kept: $OUTCOTURN"
+fi

changelog.d/3-deploy-builds/upgrade_wiab_staging

@@ -0,0 +1,3 @@
+Added: bin/migrate_secrets.sh to migrate secrets from an old deploy directory to a new one.
+Changed: bin/helm-operations.sh to allow it's use during an upgrade.
+Changed: ansible/setup-offline-sources.yml to allow running it without touching APT configurations during an upgrade.