[FS-1845] Deploy RabbitMQ on k8s for CI

.envrc

@@ -37,3 +37,6 @@ path_add "PYTHONPATH" "./hack/python"
 # Locale
 export LC_ALL=en_US.UTF-8
 export LANG=en_US.UTF-8
+
+export RABBITMQ_USERNAME=guest
+export RABBITMQ_PASSWORD=alpaca-grapefruit

cabal.project

@@ -31,6 +31,7 @@ packages:
   , libs/wire-message-proto-lens/
   , libs/zauth/
   , services/brig/
+  , services/backend-notification-pusher/
   , services/cannon/
   , services/cargohold/
   , services/federator/
@@ -65,6 +66,8 @@ package assets
     ghc-options: -Werror
 package auto-whitelist
     ghc-options: -Werror
+package backend-notification-pusher
+    ghc-options: -Werror
 package bilge
     ghc-options: -Werror
 package billing-team-member-backfill
@@ -154,4 +157,4 @@ package wire-api-federation
 package wire-message-proto-lens
     ghc-options: -Werror
 package zauth
-    ghc-options: -Werror
+    ghc-options: -Werror

changelog.d/0-release-notes/helm-tag-rename

@@ -0,0 +1,33 @@
+A few helm values related to federation have been renamed, no action is required if federation was disabled. 
+If federation was enabled these values must be renamed in the wire-server chart:
+- tags.federator -> tags.federation
+- brig.enableFederator -> brig.enableFederation
+- galley.enableFederator -> galley.enableFederation
+- cargohold.enableFederator -> galley.enableFederation
+
+So, an old config which looked like this:
+
+```yaml
+tags:
+  federator: true
+brig:
+  enableFederator: true
+galley:
+  enableFederator: true
+cargohold:
+  enableFederator: true
+```
+
+would now look like this:
+
+```yaml
+tags:
+  federation: true
+brig:
+  enableFederation: true
+galley:
+  enableFederation: true
+cargohold:
+  enableFederation: true
+```
+

charts/backend-notification-pusher/Chart.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+description: Backend notification pusheer
+name: backend-notification-pusher
+version: 0.0.42

charts/backend-notification-pusher/README.md

@@ -0,0 +1,5 @@
+Note that backend-notification-pusher depends on some provisioned storage, namely:
+
+- rabbitmq
+
+These are dealt with independently from this chart.

charts/backend-notification-pusher/templates/configmap.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: "backend-notification-pusher"
+  labels:
+    app: backend-notification-pusher
+    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+data:
+  {{- with .Values.config }}
+  backend-notification-pusher.yaml: |
+    logFormat: {{ .logFormat }}
+    logLevel: {{ .logLevel }}
+
+    federatorInternal:
+      host: federator
+      port: 8080
+    rabbitmq:
+{{toYaml .rabbitmq | indent 6 }}
+    remoteDomains:
+{{toYaml .remoteDomains | indent 6 }}
+  {{- end }}

charts/backend-notification-pusher/templates/deployment.yaml

@@ -0,0 +1,59 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backend-notification-pusher
+  labels:
+    app: backend-notification-pusher
+    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  # TODO: Review this
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: {{ .Values.replicaCount }}
+  selector:
+    matchLabels:
+      app: backend-notification-pusher
+  template:
+    metadata:
+      labels:
+        app: backend-notification-pusher
+        release: {{ .Release.Name }}
+      annotations:
+        # An annotation of the configmap checksum ensures changes to the configmap cause a redeployment upon `helm upgrade`
+        checksum/configmap: {{ include (print .Template.BasePath "/configmap.yaml") . | sha256sum }}
+        checksum/secret: {{ include (print .Template.BasePath "/secret.yaml") . | sha256sum }}
+        fluentbit.io/parser: json
+    spec:
+      serviceAccountName: {{ .Values.serviceAccount.name }}
+      volumes:
+        - name: "backend-notification-pusher-config"
+          configMap:
+            name: "backend-notification-pusher"
+        - name: "backend-notification-pusher-secrets"
+          secret:
+            secretName: "backend-notification-pusher"
+      containers:
+        - name: backend-notification-pusher
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ default "" .Values.imagePullPolicy | quote }}
+          volumeMounts:
+          - name: "backend-notification-pusher-config"
+            mountPath: "/etc/wire/backend-notification-pusher/conf"
+          env:
+          - name: RABBITMQ_USERNAME
+            valueFrom:
+              secretKeyRef:
+                name: backend-notification-pusher
+                key: rabbitmqUsername
+          - name: RABBITMQ_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: backend-notification-pusher
+                key: rabbitmqPassword
+          resources:
+{{ toYaml .Values.resources | indent 12 }}

charts/backend-notification-pusher/templates/secret.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: backend-notification-pusher
+  labels:
+    app: backend-notification-pusher
+    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+type: Opaque
+data:
+  {{/* for_helm_linting is necessary only since the 'with' block below does not throw an error upon an empty .Values.secrets */}}
+  for_helm_linting: {{ required "No .secrets found in configuration. Did you forget to helm <command> -f path/to/secrets.yaml ?" .Values.secrets | quote | b64enc | quote }}
+
+  {{- with .Values.secrets }}
+  rabbitmqUsername: {{ .rabbitmq.username | b64enc | quote }}
+  rabbitmqPassword: {{ .rabbitmq.password | b64enc | quote }}
+  {{- end }}

charts/backend-notification-pusher/templates/serviceaccount.yaml

@@ -0,0 +1,16 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Values.serviceAccount.name }}
+  labels:
+    app: brig
+    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
+{{- end }}

charts/backend-notification-pusher/values.yaml

@@ -0,0 +1,35 @@
+replicaCount: 1
+image:
+  repository: quay.io/wire/backend-notification-pusher
+  tag: do-not-use
+# FUTUREWORK: Review these values when we have some experience
+resources:
+  requests:
+    memory: "200Mi"
+    cpu: "100m"
+  limits:
+    memory: "512Mi"
+# TODO: Create issue for a metrics endpoint
+# metrics:
+#   serviceMonitor:
+#     enabled: false
+config:
+  # TODO: Proper logging
+  logLevel: Info
+  logFormat: StructuredJSON
+  rabbitmq:
+    host: rabbitmq
+    port: 5672
+    vHost: /
+  remoteDomains: []
+
+serviceAccount:
+  # When setting this to 'false', either make sure that a service account named
+  # 'backend-notification-pusher' exists or change the 'name' field to 'default'
+  create: true
+  name: backend-notification-pusher
+  annotations: {}
+  automountServiceAccountToken: true
+
+
+secrets: {}

charts/brig/templates/configmap.yaml

@@ -48,7 +48,7 @@ data:
       host: gundeck
       port: 8080
 
-    {{- if .enableFederator }}
+    {{- if .enableFederation }}
     # TODO remove this
     federator:
       host: federator
@@ -57,6 +57,8 @@ data:
     federatorInternal:
       host: federator
       port: 8080
+    rabbitmq:
+{{ toYaml .rabbitmq | indent 6}}
     {{- end }}
 
     {{- with .aws }}

charts/brig/templates/deployment.yaml

@@ -130,7 +130,19 @@ spec:
           - name: NO_PROXY
             value: {{ join "," .noProxyList | quote }}
           {{- end }}
-          {{- end }} 
+          {{- end }}
+          {{- if .Values.config.enableFederation }}
+          - name: RABBITMQ_USERNAME
+            valueFrom:
+              secretKeyRef:
+                name: brig
+                key: rabbitmqUsername
+          - name: RABBITMQ_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: brig
+                key: rabbitmqPassword
+          {{- end }}
           ports:
             - containerPort: {{ .Values.service.internalPort }}
           startupProbe:

charts/brig/templates/secret.yaml

@@ -31,5 +31,8 @@ data:
   {{- if .oauthJwkKeyPair }}
   oauth_ed25519.jwk: {{ .oauthJwkKeyPair | b64enc | quote }}
   {{- end }}  
+  {{- if .Values.enableFederation }}
+  rabbitmqUsername: {{ .rabbitmq.username | b64enc | quote }}
+  rabbitmqPassword: {{ .rabbitmq.password | b64enc | quote }}
+  {{- end }}
   {{- end }}
-

charts/brig/values.yaml

@@ -32,7 +32,12 @@ config:
   # -- If set to false,  'dynamoDBEndpoint' _must_ be set.
   randomPrekeys: true
   useSES: true
-  enableFederator: false # keep enableFederator default in sync with galley and cargohold chart's config.enableFederator as well as wire-server chart's tag.federator
+  enableFederation: false # keep enableFederation default in sync with galley and cargohold chart's config.enableFederation as well as wire-server chart's tags.federation
+  # Not used if enableFederation is false
+  rabbitmq:
+    host: rabbitmq
+    port: 5672
+    vHost: /
   emailSMS:
     general:
       templateBranding:

charts/cargohold/templates/configmap.yaml

@@ -12,7 +12,7 @@ data:
       host: 0.0.0.0
       port: {{ .Values.service.internalPort }}
 
-    {{- if .Values.config.enableFederator }}
+    {{- if .Values.config.enableFederation }}
     federator:
       host: federator
       port: 8080

charts/cargohold/values.yaml

@@ -18,7 +18,7 @@ config:
   logLevel: Info
   logFormat: StructuredJSON
   logNetStrings: false
-  enableFederator: false # keep enableFederator default in sync with brig and galley chart's config.enableFederator as well as wire-server chart's tag.federator
+  enableFederation: false # keep enableFederation default in sync with brig and galley chart's config.enableFederation as well as wire-server chart's tags.federation
   aws:
     region: "eu-west-1"
     s3Bucket: assets

charts/galley/templates/configmap.yaml

@@ -34,7 +34,7 @@ data:
       host: spar
       port: 8080
 
-    {{- if .enableFederator }}
+    {{- if .enableFederation }}
     federator:
       host: federator
       port: 8080

charts/galley/values.yaml

@@ -22,7 +22,7 @@ config:
   cassandra:
     host: aws-cassandra
     replicaCount: 3
-  enableFederator: false # keep enableFederator default in sync with brig and cargohold chart's config.enableFederator as well as wire-server chart's tag.federator
+  enableFederation: false # keep enableFederation default in sync with brig and cargohold chart's config.enableFederation as well as wire-server chart's tags.federation
   settings:
     httpPoolSize: 128
     maxTeamSize: 10000

charts/rabbitmq/Chart.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+description: Wrapper chart for bitnami/rabbitmq
+name: rabbitmq
+version: 0.0.42

charts/rabbitmq/requirements.yaml

@@ -0,0 +1,4 @@
+dependencies:
+- name: rabbitmq
+  version: 11.13.0
+  repository: https://charts.bitnami.com/bitnami

charts/wire-server/requirements.yaml

@@ -108,6 +108,15 @@ dependencies:
   repository: "file://../federator"
   tags:
     - federator
+    - federation
+    - haskellServices
+    - services
+- name: backend-notification-pusher
+  version: "0.0.42"
+  repository: "file://../backend-notification-pusher"
+  tags:
+    - backend-notification-pusher
+    - federation
     - haskellServices
     - services
 - name: sftd

charts/wire-server/values.yaml

@@ -9,6 +9,6 @@ tags:
   team-settings: false
   account-pages: false
   legalhold: false
-  federator: false # see also galley.config.enableFederator and brig.config.enableFederator
+  federation: false # see also galley.config.enableFederation and brig.config.enableFederation
   sftd: false
   backoffice: false

deploy/dockerephemeral/docker-compose.yaml

@@ -202,8 +202,8 @@ services:
     container_name: rabbitmq
     image: rabbitmq:3-management-alpine
     environment:
-      - RABBITMQ_DEFAULT_USER=guest
-      - RABBITMQ_DEFAULT_PASS=alpaca-grapefruit
+      - RABBITMQ_DEFAULT_USER=${RABBITMQ_USERNAME}
+      - RABBITMQ_DEFAULT_PASS=${RABBITMQ_PASSWORD}
     ports:
       - '127.0.0.1:5672:5672'
       - '127.0.0.1:15672:15672'