Release 2022-06-14 - (expected chart version 4.14.0)

CHANGELOG.md

@@ -1,3 +1,97 @@
+# [2022-06-14] (Chart Release 4.14.0)
+
+## Release notes
+
+
+* The `nginz{-tcp,-http}` services have been unified into a `nginz` service, and
+  moved into the nginz chart.
+
+  The nginz-ingress-services chart simply targets the `nginz` service, so there's
+  no need to set matching `service.nginz.external{Http,Tcp}Port` inside the
+  `nginx-ingress-services` chart anymore.
+
+  The `config.http.httpPort` and `config.ws.wsPort` values in the `nginz` chart
+  still configure the ports the `nginz` service is listening on.
+
+  The `nginz` chart also gained support for `metrics.serviceMonitor.enabled`,
+  creating a `ServiceMonitor` resource to scrape metrics, like for other wire
+  services.
+
+  (#2476)
+
+* Upgrade team-settings version to 4.10.0-v0.29.7-0-3be8ca3 (#2180)
+
+* Upgrade webapp version to 2022-06-13-production.0-v0.29.7-0-2819b90 (#2302)
+
+* In the helm charts, the `wireService` label has been removed.
+
+  In some cases, we were already setting the `app` label too.
+
+  Now we consistently use the `app` label to label different wire services.
+
+  The `wireService` label was also used in the `spec.selector.matchLabels` field
+  on existing `Deployment` / `StatefulSet` resources.
+  As these fields being immutable, changing them isn't possible without recreation.
+
+  If you encounter an issue like
+
+  > field is immutable && cannot patch "*" with kind *
+
+  you need to manually delete these StatefulSet and Deployment resources, and apply helm again, which will recreate them.
+
+  This means downtime, so plan a maintenance window for it.
+
+  The `wire-server-metrics` chart was previously running some custom
+  configuration to automatically add all payloads with a `wireService` label into
+  metrics scraping.
+
+  With the removal of the `wireService` label, this custom configuration has been
+  removed.
+
+  Instead, all services that expose metrics will now create `ServiceMonitor`
+  resources, if their helm chart is applied with `metrics.serviceMonitor.enable`
+  set to true.
+
+  This prevents scraping agents from querying services that don't expose metrics
+  at /i/metrics unnecessarily.
+
+  Additionally, makes it easier to run other metric scraping operators, like
+  `grafana-agent-operator`, without the need to also create some custom
+  `wireService` label config there.
+
+  Generally, if you have any monitoring solution installed in your cluster that
+  uses the Prometheus CRDs, set `metrics.serviceMonitor.enable` for the following charts:
+
+   - brig
+   - cannon
+   - cargohold
+   - galley
+   - gundeck
+   - proxy
+   - spar (#2413)
+
+
+## Features
+
+
+* MLS implementation progress:
+   - Remote users can be added to MLS conversations
+   - MLS messages (both handshake and application) are now propagates to remote
+     conversation participants. (#2415)
+
+* `GET teams/:tid` response now contains an optional field `splash_screen` which contains the asset key of the team's splash screen. `PUT teams/:tid` now supports updating the splash screen asset key. (#2474)
+
+
+## Internal changes
+
+
+* Forward /i/users/:uid/features/:feature to brig (#2468)
+
+* charts/nginz: Forward `/i/legalhold/whitelisted-teams` to galley instead of brig (#2460)
+
+* Add AWS security token metrics to brig (#2473)
+
+
 # [2022-06-08] (Chart Release 4.13.0)
 
 ## Release notes

Makefile

@@ -360,8 +360,8 @@ kube-integration-teardown-sans-federation:
 
 .PHONY: kube-restart-%
 kube-restart-%:
-	kubectl delete pod -n $(NAMESPACE) -l wireService=$(*)
-	kubectl delete pod -n $(NAMESPACE)-fed2 -l wireService=$(*)
+	kubectl delete pod -n $(NAMESPACE) -l app=$(*)
+	kubectl delete pod -n $(NAMESPACE)-fed2 -l app=$(*)
 
 .PHONY: latest-tag
 latest-tag:
@@ -522,8 +522,8 @@ kind-restart-nginx-ingress: .local/kind-kubeconfig
 
 kind-restart-%: .local/kind-kubeconfig
 	export KUBECONFIG=$(CURDIR)/.local/kind-kubeconfig && \
-	kubectl delete pod -n $(NAMESPACE) -l wireService=$(*) && \
-	kubectl delete pod -n $(NAMESPACE)-fed2 -l wireService=$(*)
+	kubectl delete pod -n $(NAMESPACE) -l app=$(*) && \
+	kubectl delete pod -n $(NAMESPACE)-fed2 -l app=$(*)
 
 # This target can be used to template a helm chart with values filled in from
 # hack/helm_vars (what CI uses) as overrrides, if available. This allows debugging helm

cassandra-schema.cql

@@ -267,6 +267,7 @@ CREATE TABLE galley_test.member_remote_user (
     user_remote_domain text,
     user_remote_id uuid,
     conversation_role text,
+    mls_clients set<text>,
     PRIMARY KEY (conv, user_remote_domain, user_remote_id)
 ) WITH CLUSTERING ORDER BY (user_remote_domain ASC, user_remote_id ASC)
     AND bloom_filter_fp_chance = 0.1
@@ -480,6 +481,7 @@ CREATE TABLE galley_test.team (
     icon_key text,
     name text,
     search_visibility int,
+    splash_screen text,
     status int
 ) WITH bloom_filter_fp_chance = 0.1
     AND caching = {'keys': 'ALL', 'rows_per_partition': 'NONE'}

charts/account-pages/templates/deployment.yaml

@@ -3,7 +3,7 @@ kind: Deployment
 metadata:
   name: account-pages
   labels:
-    wireService: account-pages
+    app: account-pages
     chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
@@ -16,12 +16,10 @@ spec:
       maxSurge: {{ .Values.replicaCount | mul 2 }}
   selector:
     matchLabels:
-      wireService: account-pages
       app: account-pages
   template:
     metadata:
       labels:
-        wireService: account-pages
         app: account-pages
         release: {{ .Release.Name }}
     spec:

charts/aws-ingress/templates/ELB_account_pages_https.yaml

@@ -14,7 +14,7 @@ metadata:
 spec:
   type: LoadBalancer
   selector:
-    wireService: account-pages
+    app: account-pages
   ports:
   - name: https
     protocol: TCP

charts/aws-ingress/templates/ELB_nginz_https.yaml

@@ -13,7 +13,7 @@ metadata:
 spec:
   type: LoadBalancer
   selector:
-    wireService: nginz
+    app: nginz
   ports:
   - name: https
     protocol: TCP

charts/aws-ingress/templates/ELB_nginz_wss.yaml

@@ -14,7 +14,7 @@ metadata:
 spec:
   type: LoadBalancer
   selector:
-    wireService: nginz
+    app: nginz
   ports:
   - name: wss
     protocol: TCP

charts/aws-ingress/templates/ELB_team_settings_https.yaml

@@ -14,7 +14,7 @@ metadata:
 spec:
   type: LoadBalancer
   selector:
-    wireService: team-settings
+    app: team-settings
   ports:
   - name: https
     protocol: TCP

charts/aws-ingress/templates/ELB_webapp_https.yaml

@@ -13,7 +13,7 @@ metadata:
 spec:
   type: LoadBalancer
   selector:
-    wireService: webapp
+    app: webapp
   ports:
   - name: https
     protocol: TCP

charts/backoffice/templates/deployment.yaml

@@ -3,7 +3,7 @@ kind: Deployment
 metadata:
   name: backoffice
   labels:
-    wireService: backoffice
+    app: backoffice
     chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
@@ -16,11 +16,11 @@ spec:
       maxSurge: {{ .Values.replicaCount }}
   selector:
     matchLabels:
-      wireService: backoffice
+      app: backoffice
   template:
     metadata:
       labels:
-        wireService: backoffice
+        app: backoffice
         release: {{ .Release.Name }}
       annotations:
         # An annotation of the configmap checksum ensures changes to the configmap cause a redeployment upon `helm upgrade`

charts/backoffice/templates/service.yaml

@@ -3,7 +3,7 @@ kind: Service
 metadata:
   name: backoffice
   labels:
-    wireService: backoffice
+    app: backoffice
     chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
@@ -14,5 +14,5 @@ spec:
       port: {{ .Values.service.externalPort }}
       targetPort: {{ .Values.service.internalPort }}
   selector:
-    wireService: backoffice
+    app: backoffice
     release: {{ .Release.Name }}

charts/brig/templates/configmap.yaml

@@ -3,7 +3,7 @@ kind: ConfigMap
 metadata:
   name: "brig"
   labels:
-    wireService: brig
+    app: brig
     chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}

charts/brig/templates/deployment.yaml

@@ -3,7 +3,7 @@ kind: Deployment
 metadata:
   name: brig
   labels:
-    wireService: brig
+    app: brig
     chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
@@ -16,11 +16,11 @@ spec:
       maxSurge: {{ .Values.replicaCount }}
   selector:
     matchLabels:
-      wireService: brig
+      app: brig
   template:
     metadata:
       labels:
-        wireService: brig
+        app: brig
         release: {{ .Release.Name }}
       annotations:
         # An annotation of the configmap checksum ensures changes to the configmap cause a redeployment upon `helm upgrade`

charts/brig/templates/geoip-secret.yaml

@@ -4,7 +4,7 @@ kind: Secret
 metadata:
   name: brig-geoip
   labels:
-    wireService: brig
+    app: brig
     chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     release: "{{ .Release.Name }}"
     heritage: "{{ .Release.Service }}"

charts/brig/templates/secret.yaml

@@ -3,7 +3,7 @@ kind: Secret
 metadata:
   name: brig
   labels:
-    wireService: brig
+    app: brig
     chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     release: "{{ .Release.Name }}"
     heritage: "{{ .Release.Service }}"

charts/brig/templates/service.yaml

@@ -3,7 +3,7 @@ kind: Service
 metadata:
   name: brig
   labels:
-    wireService: brig
+    app: brig
     chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
@@ -14,5 +14,5 @@ spec:
       port: {{ .Values.service.externalPort }}
       targetPort: {{ .Values.service.internalPort }}
   selector:
-    wireService: brig
+    app: brig
     release: {{ .Release.Name }}

charts/brig/templates/serviceaccount.yaml

@@ -4,7 +4,7 @@ kind: ServiceAccount
 metadata:
   name: {{ .Values.serviceAccount.name }}
   labels:
-    wireService: brig
+    app: brig
     chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}

charts/brig/templates/servicemonitor.yaml

@@ -0,0 +1,19 @@
+{{- if .Values.metrics.serviceMonitor.enabled }}
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: brig
+  labels:
+    app: brig
+    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  endpoints:
+    - port: http
+      path: /i/metrics
+  selector:
+    matchLabels:
+      app: brig
+      release: {{ .Release.Name }}
+{{- end }}

charts/brig/templates/tests/brig-integration.yaml

@@ -3,7 +3,7 @@ kind: Service
 metadata:
   name: "brig-integration"
   labels:
-    wireService: brig-integration
+    app: brig-integration
     chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
@@ -13,7 +13,7 @@ spec:
     - port: 9000
       targetPort: 9000
   selector:
-    wireService: brig-integration
+    app: brig-integration
     release: {{ .Release.Name }}
 ---
 apiVersion: v1
@@ -23,7 +23,7 @@ metadata:
   annotations:
     "helm.sh/hook": test-success
   labels:
-    wireService: brig-integration
+    app: brig-integration
     release: {{ .Release.Name }}
 spec:
   volumes:

charts/brig/templates/tests/nginz-service.yaml

@@ -11,4 +11,4 @@ spec:
     - port: 8080
       targetPort: 8080
   selector:
-    wireService: nginz
+    app: nginz

charts/brig/templates/turnconfigmap.yaml

@@ -4,7 +4,7 @@ kind: ConfigMap
 metadata:
   name: "turn"
   labels:
-    wireService: brig
+    app: brig
     chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}

charts/brig/values.yaml

@@ -12,6 +12,9 @@ resources:
   limits:
     memory: "512Mi"
     cpu: "500m"
+metrics:
+  serviceMonitor:
+    enable: false
 config:
   logLevel: Info
   logFormat: JSON