Skip to content

Wiab staging improvements #896

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mohitrajain wants to merge 5 commits into
base: master
Choose a base branch
from
+200 −50
Open

Wiab staging improvements #896

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
dd412e0
fix: WPB-24369 added a flag DEPLOY_CALLING_SERVICES to control the ca…
mohitrajain Apr 8, 2026
1bc4121
fix: WPB-24369 added documentation around managing staging.yml invent…
mohitrajain Apr 8, 2026
b1ea143
docs: WPB-24369 changelog for the PR
mohitrajain Apr 8, 2026
da68617
fix: WPB-24369 instructions around verifying MTU management and calic…
mohitrajain Apr 13, 2026
264feb9
fix: WPB-24369 fix command to display the kube-system pods in offline…
mohitrajain Apr 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
112 changes: 79 additions & 33 deletions bin/helm-operations.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,10 @@
# default is set to TRUE to deploy it unless changed
DEPLOY_CERT_MANAGER="${DEPLOY_CERT_MANAGER:-TRUE}"

# DEPLOY_CALLING_SERVICES env variable is used to decide if sftd and coturn should get deployed
# default is set to TRUE to deploy them unless changed
DEPLOY_CALLING_SERVICES="${DEPLOY_CALLING_SERVICES:-TRUE}"

# DUMP_LOGS_ON_FAIL to dump logs on failure
# it is false by default
DUMP_LOGS_ON_FAIL="${DUMP_LOGS_ON_FAIL:-FALSE}"
Expand All @@ -19,9 +23,7 @@
# assuming it to be the public address used by clients to reach public Address
HOST_IP="${HOST_IP:-}"

if [ -z "$HOST_IP" ]; then
HOST_IP=$(wget -qO- https://api.ipify.org)
fi
CALLING_NODE=""

function dump_debug_logs {
local exit_code=$?
Expand All @@ -32,12 +34,28 @@
}
trap dump_debug_logs ERR

# picking a node for calling traffic (3rd kube worker node)
CALLING_NODE=$(kubectl get nodes --no-headers | tail -n 1 | awk '{print $1}')
if [[ -z "$CALLING_NODE" ]]; then
echo "Error: could not determine the last kube worker node via kubectl"
exit 1
fi
configure_calling_environment() {

if [[ "$DEPLOY_CALLING_SERVICES" != "TRUE" ]]; then
return 0
fi

if [[ -z "$HOST_IP" ]]; then
HOST_IP=$(wget -qO- https://api.ipify.org)
fi

if [[ -z "$HOST_IP" ]]; then
echo "Error: could not determine HOST_IP automatically"

Check warning on line 48 in bin/helm-operations.sh

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Redirect this error message to stderr (>&2). 


See more on https://sonarcloud.io/project/issues?id=wireapp_wire-server-deploy&issues=AZ1ttaaV9lMtGFoggRdX&open=AZ1ttaaV9lMtGFoggRdX&pullRequest=896
exit 1
fi

# picking a node for calling traffic (3rd kube worker node)
CALLING_NODE=$(kubectl get nodes --no-headers | tail -n 1 | awk '{print $1}')
if [[ -z "$CALLING_NODE" ]]; then
echo "Error: could not determine the last kube worker node via kubectl"
exit 1
fi
}

sync_pg_secrets() {
echo "Retrieving PostgreSQL password from databases-ephemeral for wire-server deployment..."
Expand All @@ -60,7 +78,15 @@

ENV=$1
TYPE=$2
charts=(fake-aws smtp rabbitmq databases-ephemeral reaper wire-server webapp account-pages team-settings ingress-nginx-controller nginx-ingress-services coturn sftd cert-manager)
charts=(fake-aws demo-smtp rabbitmq databases-ephemeral reaper wire-server webapp account-pages team-settings ingress-nginx-controller)
Copy link
Copy Markdown
Contributor

@arthurwolf arthurwolf Apr 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I do not know if this is bad or not, but I want to remark that here in process_values() we change from smtp to demo-smtp, but the deploy_charts() in main() still references smtp and not demo-smtp.

Not sure what the impact is, or even if this is an actual problem, but I thought I'd point out the potential inconsistency.


if [[ "$DEPLOY_CERT_MANAGER" == "TRUE" ]]; then
charts+=(nginx-ingress-services cert-manager)
fi

if [[ "$DEPLOY_CALLING_SERVICES" == "TRUE" ]]; then
charts+=(coturn sftd)
fi

if [[ "$ENV" != "prod" ]] || [[ -z "$TYPE" ]] ; then
echo "Error: This function only supports prod deployments with TYPE as values or secrets. ENV must be 'prod', got: '$ENV' and '$TYPE'"
Expand Down Expand Up @@ -92,41 +118,53 @@
TEMP_DIR=$(mktemp -d)
trap 'rm -rf $TEMP_DIR' EXIT

# to find IP address of calling NODE
CALLING_NODE_IP=$(kubectl get node "$CALLING_NODE" -o jsonpath='{.status.addresses[?(@.type=="InternalIP")].address}')

# Fixing the hosts with TARGET_SYSTEM and setting the turn server
sed -e "s/example.com/$TARGET_SYSTEM/g" \
"$BASE_DIR/values/wire-server/values.yaml" > "$TEMP_DIR/wire-server-values.yaml"

# fixing the turnStatic values
yq eval -i ".brig.turnStatic.v2 = [\"turn:$HOST_IP:3478\", \"turn:$HOST_IP:3478?transport=tcp\"]" "$TEMP_DIR/wire-server-values.yaml"

# Fixing the hosts in webapp team-settings and account-pages charts
for chart in webapp team-settings account-pages; do
sed "s/example.com/$TARGET_SYSTEM/g" "$BASE_DIR/values/$chart/values.yaml" > "$TEMP_DIR/$chart-values.yaml"
done

# Setting certManager and DNS records
sed -e 's/useCertManager: false/useCertManager: true/g' \
-e "/certmasterEmail:$/s/certmasterEmail:/certmasterEmail: $CERT_MASTER_EMAIL/" \
-e "s/example.com/$TARGET_SYSTEM/" \
"$BASE_DIR/values/nginx-ingress-services/values.yaml" > "$TEMP_DIR/nginx-ingress-services-values.yaml"
files=(wire-server-values.yaml webapp-values.yaml team-settings-values.yaml account-pages-values.yaml)

if [[ "$DEPLOY_CERT_MANAGER" == "TRUE" ]]; then
# Setting certManager and DNS records for Let's Encrypt based certificate management
sed -e 's/useCertManager: false/useCertManager: true/g' \
-e "/certmasterEmail:$/s/certmasterEmail:/certmasterEmail: $CERT_MASTER_EMAIL/" \
-e "s/example.com/$TARGET_SYSTEM/" \
"$BASE_DIR/values/nginx-ingress-services/values.yaml" > "$TEMP_DIR/nginx-ingress-services-values.yaml"

files+=(nginx-ingress-services-values.yaml)
fi

if [[ "$DEPLOY_CALLING_SERVICES" == "TRUE" ]]; then
# to find IP address of calling NODE
CALLING_NODE_IP=$(kubectl get node "$CALLING_NODE" -o jsonpath='{.status.addresses[?(@.type=="InternalIP")].address}')

# Fixing SFTD hosts and setting the cert-manager to http01
sed -e "s/webapp.example.com/webapp.$TARGET_SYSTEM/" \
-e "s/sftd.example.com/sftd.$TARGET_SYSTEM/" \
-e 's/name: letsencrypt-prod/name: letsencrypt-http01/' \
"$BASE_DIR/values/sftd/values.yaml" > "$TEMP_DIR/sftd-values.yaml"
# fixing the turnStatic values
yq eval -i ".brig.turnStatic.v2 = [\"turn:$HOST_IP:3478\", \"turn:$HOST_IP:3478?transport=tcp\"]" "$TEMP_DIR/wire-server-values.yaml"

# Setting coturn node IP values
yq eval -i ".coturnTurnListenIP = \"$CALLING_NODE_IP\"" "$BASE_DIR/values/coturn/values.yaml"
yq eval -i ".coturnTurnRelayIP = \"$CALLING_NODE_IP\"" "$BASE_DIR/values/coturn/values.yaml"
yq eval -i ".coturnTurnExternalIP = \"$HOST_IP\"" "$BASE_DIR/values/coturn/values.yaml"
# Fix SFTD hostnames, and only enable Let's Encrypt specific issuer changes when cert-manager is enabled.
sed -e "s/webapp.example.com/webapp.$TARGET_SYSTEM/" \
-e "s/sftd.example.com/sftd.$TARGET_SYSTEM/" \
"$BASE_DIR/values/sftd/values.yaml" > "$TEMP_DIR/sftd-values.yaml"

if [[ "$DEPLOY_CERT_MANAGER" == "TRUE" ]]; then
yq eval -i '.tls.issuerRef.name = "letsencrypt-http01"' "$TEMP_DIR/sftd-values.yaml"
fi

# Setting coturn node IP values
yq eval -i ".coturnTurnListenIP = \"$CALLING_NODE_IP\"" "$BASE_DIR/values/coturn/values.yaml"
Copy link
Copy Markdown
Contributor

@arthurwolf arthurwolf Apr 13, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a problem that predates the PR, but I thought I'd still mention: almost all value modifications use a temporary file pattern, like:

yq eval -i '.tls.issuerRef.name = "letsencrypt-http01"' "$TEMP_DIR/sftd-values.yaml"

just above...

But these edit the files "directly" without going through a temp file, which means no "Updating..." log messages like other edits have, no idempotency check, more risk etc.

Minor but thought I'd point it out.

yq eval -i ".coturnTurnRelayIP = \"$CALLING_NODE_IP\"" "$BASE_DIR/values/coturn/values.yaml"
yq eval -i ".coturnTurnExternalIP = \"$HOST_IP\"" "$BASE_DIR/values/coturn/values.yaml"

files+=(sftd-values.yaml)
fi

# Compare and copy files if different
for file in wire-server-values.yaml webapp-values.yaml team-settings-values.yaml account-pages-values.yaml \
nginx-ingress-services-values.yaml sftd-values.yaml; do
for file in "${files[@]}"; do
if ! cmp -s "$TEMP_DIR/$file" "$BASE_DIR/values/${file%-values.yaml}/values.yaml"; then
cp "$TEMP_DIR/$file" "$BASE_DIR/values/${file%-values.yaml}/values.yaml"
echo "Updating $BASE_DIR/values/${file%-values.yaml}/values.yaml"
Expand Down Expand Up @@ -188,6 +226,11 @@

deploy_calling_services() {

if [[ "$DEPLOY_CALLING_SERVICES" != "TRUE" ]]; then
echo "Skipping sftd and coturn deployment because DEPLOY_CALLING_SERVICES=$DEPLOY_CALLING_SERVICES"
return 0
fi

echo "Deploying sftd and coturn"
# select the node to deploy sftd
kubectl annotate node "$CALLING_NODE" wire.com/external-ip="$HOST_IP" --overwrite
Expand All @@ -202,6 +245,9 @@

main() {

# initialize calling-service specific values only when enabled
configure_calling_environment

# Create prod-values.example.yaml to values.yaml and take backup
process_values "prod" "values"
# Create prod-secrets.example.yaml to secrets.yaml and take backup
Expand All @@ -228,7 +274,7 @@
kubectl get certificate
fi

# deploying sft and coturn services
# deploying sft and coturn services when enabled
deploy_calling_services
}

Expand Down
3 changes: 3 additions & 0 deletions bin/offline-deploy.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,4 +41,7 @@ fi

$DOCKER_RUN_BASE $SSH_MOUNT $WSD_CONTAINER ./bin/offline-cluster.sh

# verify if all kube-system pods are running well
sudo docker run --network=host -v $PWD:/wire-server-deploy $WSD_CONTAINER sh -c 'kubectl -n kube-system get pods'

sudo docker run --network=host -v $PWD:/wire-server-deploy $WSD_CONTAINER sh -c 'TARGET_SYSTEM="example.dev" CERT_MASTER_EMAIL="certmaster@example.dev" DEPLOY_CERT_MANAGER=TRUE DUMP_LOGS_ON_FAIL=TRUE ./bin/helm-operations.sh'
Copy link
Copy Markdown
Contributor

@arthurwolf arthurwolf Apr 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
sudo docker run --network=host -v $PWD:/wire-server-deploy $WSD_CONTAINER sh -c 'TARGET_SYSTEM="example.dev" CERT_MASTER_EMAIL="certmaster@example.dev" DEPLOY_CERT_MANAGER=TRUE DUMP_LOGS_ON_FAIL=TRUE ./bin/helm-operations.sh'
sudo docker run --network=host -v $PWD:/wire-server-deploy $WSD_CONTAINER sh -c 'TARGET_SYSTEM="example.dev" CERT_MASTER_EMAIL="certmaster@example.dev" DEPLOY_CERT_MANAGER=TRUE DUMP_LOGS_ON_FAIL=TRUE DEPLOY_CALLING_SERVICES=TRUE ./bin/helm-operations.sh'

So, DEPLOY_CALLING_SERVICES defaults to TRUE if not specified (I think), so behavior is preserved no matter what here, but shouldn't we make it explicit with DEPLOY_CALLING_SERVICES=TRUE here?

Otherwise somebody looking at this line / copy-pasting it has no idea that DEPLOY_CALLING_SERVICES is a thing?

3 changes: 3 additions & 0 deletions changelog.d/3-deploy-builds/wiab-staging-fixes
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
Added: documentation around managing staging.yml inventory, how to verify, download artifact, and documentation around cert-manager and calling components
Added: a flag DEPLOY_CALLING_SERVICES to control the calling services and improved the flow based on cert-manager and calling services requirement
Added: instructions around verifying MTU management and calico kernel requirements
Loading
Loading