Skip to content

Commit ffca59c

Browse files
jhbeskowvgrassia
jhbeskow
and
vgrassia
authored
Fixing upgrade paths when on severely limited hosts using deployment strategies and modifying database migrator jobs (#58)
- Fixing upgrade paths when on severely limited hosts using deployment strategies. - Splitting out testing from linter. - Reworking the DB migrator based on pre- and post-install/upgrade requirements. - Making MSSQL a stateful set to improve upgrade path. --------- Co-authored-by: Vince Grassia <[email protected]>
1 parent 43e8544 commit ffca59c

20 files changed

+339
-143
lines changed

‎.github/workflows/linter.yml

Lines changed: 0 additions & 138 deletions
Original file line numberDiff line numberDiff line change
@@ -27,9 +27,6 @@ jobs:
2727
with:
2828
version: 'v3.13.1'
2929

30-
- name: Set up lynx
31-
run: sudo apt install lynx
32-
3330
- name: Set up Python
3431
uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4.7.1
3532
with:
@@ -52,138 +49,3 @@ jobs:
5249
env:
5350
CT_CHECK_VERSION_INCREMENT: false
5451
run: ct lint --target-branch ${{ github.event.repository.default_branch }}
55-
56-
- name: Create kind cluster
57-
if: steps.list-changed.outputs.changed == 'true'
58-
uses: helm/kind-action@dda0770415bac9fc20092cacbc54aa298604d140 # v1.8.0
59-
with:
60-
config: .github/workflows/config/cluster.yaml
61-
62-
- name: Set up cluster
63-
if: steps.list-changed.outputs.changed == 'true'
64-
run: |
65-
installation_id=$(uuidgen)
66-
echo $installation_id
67-
installation_key=$(openssl rand -base64 12)
68-
sa_password=$(openssl rand -base64 12)
69-
cert_pass=$(openssl rand -base64 12)
70-
71-
#TLS setup
72-
echo "Creating root CA cert"
73-
openssl req -x509 -sha256 -days 1 -newkey rsa:2048 -keyout rootCA.key -out rootCA.crt -subj "/CN=Bitwarden Ingress" --passout pass:$cert_pass
74-
echo "Generating TLS key"
75-
openssl genrsa -out bitwarden.localhost.key 2048
76-
echo "Generating TLS cert"
77-
openssl req -key bitwarden.localhost.key -new -out bitwarden.localhost.csr --passin pass:$cert_pass -subj "/CN=bitwarden.localhost"
78-
79-
echo "Signing TLS cert"
80-
cat > bitwarden.localhost.ext << EOF
81-
authorityKeyIdentifier=keyid,issuer
82-
basicConstraints=CA:FALSE
83-
subjectAltName = @alt_names
84-
[alt_names]
85-
DNS.1 = bitwarden.localhost
86-
EOF
87-
88-
openssl x509 -req -CA rootCA.crt -CAkey rootCA.key -in bitwarden.localhost.csr -out bitwarden.localhost.crt -days 1 -CAcreateserial -extfile bitwarden.localhost.ext --passin pass:$cert_pass
89-
90-
echo "Exporting TLS certs to PEM"
91-
openssl x509 -in bitwarden.localhost.crt -out bitwarden.localhost.pem --passin pass:$cert_pass
92-
openssl x509 -in rootCA.crt -out rootCA.pem --passin pass:$cert_pass
93-
94-
#Ingress
95-
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/kind/deploy.yaml
96-
kubectl delete -A ValidatingWebhookConfiguration ingress-nginx-admission
97-
sudo echo "127.0.0.1 bitwarden.localhost" | sudo tee -a /etc/hosts
98-
99-
#Namespace
100-
kubectl create ns bitwarden
101-
102-
kubectl config set-context --current --namespace=bitwarden
103-
104-
#Secrets
105-
kubectl create secret generic custom-secret \
106-
--from-literal=globalSettings__installation__id=$installation_id \
107-
--from-literal=globalSettings__installation__key=$installation_key \
108-
--from-literal=globalSettings__mail__smtp__username="REPLACE" \
109-
--from-literal=globalSettings__mail__smtp__password="REPLACE" \
110-
--from-literal=globalSettings__yubico__clientId="REPLACE" \
111-
--from-literal=globalSettings__yubico__key="REPLACE" \
112-
--from-literal=SA_PASSWORD=$sa_password
113-
114-
kubectl create secret tls tls-secret --cert=bitwarden.localhost.pem --key=bitwarden.localhost.key
115-
116-
- name: Run chart-testing (install)
117-
if: steps.list-changed.outputs.changed == 'true'
118-
run: ct install --target-branch ${{ github.event.repository.default_branch }} --skip-clean-up --namespace bitwarden
119-
120-
- name: Test install
121-
if: steps.list-changed.outputs.changed == 'true'
122-
run: |
123-
#For review purposes
124-
echo "*****DEPLOYMENTS*****"
125-
kubectl get deployments
126-
echo "*****PODS*****"
127-
kubectl get pods
128-
echo "*****SERVICES*****"
129-
kubectl get svc
130-
echo "*****JOBS*****"
131-
kubectl get jobs
132-
echo "*****INGRESS*****"
133-
kubectl describe ingress
134-
135-
echo "*****HOME*****"
136-
home=$(curl -Ls https://bitwarden.localhost -w httpcode=%{http_code} --cacert rootCA.pem)
137-
echo $home | lynx -stdin -dump -width=100
138-
httpCode=$(echo "${home}" | grep -Po 'httpcode=\K(\d\d\d)')
139-
bodyCheck=$(echo "${home}" | grep -Po 'Bitwarden Web Vault')
140-
if [[ ${httpCode} -ne 200 ]]; then
141-
echo "::error::ERROR: Home page failed to load. HTTP code was $httpCode"
142-
exit 1
143-
fi
144-
if [[ "$bodyCheck" != "Bitwarden Web Vault" ]]; then
145-
echo "::error::ERROR: Home page failed to load. Please check body output above."
146-
exit 1
147-
fi
148-
149-
echo "Home OK."
150-
151-
echo "*****API/CONFIG*****"
152-
config=$(curl -Ls https://bitwarden.localhost/api/config -w httpcode=%{http_code} --cacert rootCA.pem)
153-
echo $config | lynx -stdin -dump -width=100
154-
httpCode=$(echo "${config}" | grep -Po 'httpcode=\K(\d\d\d)')
155-
bodyCheck=$(echo "${config}" | grep -Po '\"vault\":\"https://bitwarden\.localhost\"')
156-
if [[ ${httpCode} -ne 200 ]]; then
157-
echo "::error::ERROR: Home page failed to load. HTTP code was $httpCode"
158-
exit 1
159-
fi
160-
if [[ "$bodyCheck" != '"vault":"https://bitwarden.localhost"' ]]; then
161-
echo "::error::ERROR: API/Config page failed to load. Please check body output above."
162-
exit 1
163-
fi
164-
165-
echo "API/Config OK."
166-
167-
echo "*****ADMIN*****"
168-
admin=$(curl -Ls https://bitwarden.localhost/admin -w httpcode=%{http_code} --cacert rootCA.pem)
169-
echo $admin | lynx -stdin -dump -width=100
170-
171-
httpCode=$(echo "${admin}" | grep -Po 'httpcode=\K(\d\d\d)')
172-
bodyCheck=$(echo "${admin}" | grep -Po "We'll email you a secure login link")
173-
if [[ ${httpCode} -ne 200 ]]; then
174-
echo "::error::ERROR: Home page failed to load. HTTP code was $httpCode"
175-
exit 1
176-
fi
177-
if [[ "$bodyCheck" != "We'll email you a secure login link" ]]; then
178-
echo "::error::ERROR: Admin page failed to load. Please check body output above."
179-
exit 1
180-
fi
181-
182-
echo "Admin OK."
183-
184-
- name: Clean-up
185-
if: steps.list-changed.outputs.changed == 'true'
186-
run: |
187-
helm ls --all --short | xargs -L1 helm delete
188-
kubectl delete ns bitwarden
189-
kind delete cluster

‎.github/workflows/tests.yml

Lines changed: 183 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,183 @@
1+
---
2+
name: Tests
3+
4+
on:
5+
pull_request:
6+
paths:
7+
- 'charts/**'
8+
push:
9+
branches:
10+
- main
11+
paths:
12+
- 'charts/**'
13+
workflow_dispatch:
14+
15+
jobs:
16+
test:
17+
name: Test Helm charts
18+
runs-on: ubuntu-22.04
19+
steps:
20+
- name: Checkout repo
21+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
22+
with:
23+
fetch-depth: 0
24+
25+
- name: Set up Helm
26+
uses: Azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3.5
27+
with:
28+
version: 'v3.13.1'
29+
30+
- name: Set up lynx
31+
run: sudo apt install lynx
32+
33+
- name: Set up Python
34+
uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4.7.1
35+
with:
36+
python-version: '3.12'
37+
check-latest: true
38+
39+
- name: Set up chart-testing
40+
uses: helm/chart-testing-action@b43128a8b25298e1e7b043b78ea6613844e079b1 # v2.6.0
41+
42+
- name: Run chart-testing (list-changed)
43+
id: list-changed
44+
run: |
45+
CHANGED=$(ct list-changed --target-branch ${{ github.event.repository.default_branch }})
46+
if [[ -n "$CHANGED" ]]; then
47+
echo "changed=true" >> $GITHUB_OUTPUT
48+
fi
49+
50+
- name: Create kind cluster
51+
if: steps.list-changed.outputs.changed == 'true'
52+
uses: helm/kind-action@dda0770415bac9fc20092cacbc54aa298604d140 # v1.8.0
53+
with:
54+
config: .github/workflows/config/cluster.yaml
55+
56+
- name: Set up cluster
57+
if: steps.list-changed.outputs.changed == 'true'
58+
run: |
59+
installation_id=$(uuidgen)
60+
echo $installation_id
61+
installation_key=$(openssl rand -base64 12)
62+
sa_password=$(openssl rand -base64 12)
63+
cert_pass=$(openssl rand -base64 12)
64+
65+
#TLS setup
66+
echo "Creating root CA cert"
67+
openssl req -x509 -sha256 -days 1 -newkey rsa:2048 -keyout rootCA.key -out rootCA.crt -subj "/CN=Bitwarden Ingress" --passout pass:$cert_pass
68+
echo "Generating TLS key"
69+
openssl genrsa -out bitwarden.localhost.key 2048
70+
echo "Generating TLS cert"
71+
openssl req -key bitwarden.localhost.key -new -out bitwarden.localhost.csr --passin pass:$cert_pass -subj "/CN=bitwarden.localhost"
72+
73+
echo "Signing TLS cert"
74+
cat > bitwarden.localhost.ext << EOF
75+
authorityKeyIdentifier=keyid,issuer
76+
basicConstraints=CA:FALSE
77+
subjectAltName = @alt_names
78+
[alt_names]
79+
DNS.1 = bitwarden.localhost
80+
EOF
81+
82+
openssl x509 -req -CA rootCA.crt -CAkey rootCA.key -in bitwarden.localhost.csr -out bitwarden.localhost.crt -days 1 -CAcreateserial -extfile bitwarden.localhost.ext --passin pass:$cert_pass
83+
84+
echo "Exporting TLS certs to PEM"
85+
openssl x509 -in bitwarden.localhost.crt -out bitwarden.localhost.pem --passin pass:$cert_pass
86+
openssl x509 -in rootCA.crt -out rootCA.pem --passin pass:$cert_pass
87+
88+
#Ingress
89+
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/kind/deploy.yaml
90+
kubectl delete -A ValidatingWebhookConfiguration ingress-nginx-admission
91+
sudo echo "127.0.0.1 bitwarden.localhost" | sudo tee -a /etc/hosts
92+
93+
#Namespace
94+
kubectl create ns bitwarden
95+
96+
kubectl config set-context --current --namespace=bitwarden
97+
98+
#Secrets
99+
kubectl create secret generic custom-secret \
100+
--from-literal=globalSettings__installation__id=$installation_id \
101+
--from-literal=globalSettings__installation__key=$installation_key \
102+
--from-literal=globalSettings__mail__smtp__username="REPLACE" \
103+
--from-literal=globalSettings__mail__smtp__password="REPLACE" \
104+
--from-literal=globalSettings__yubico__clientId="REPLACE" \
105+
--from-literal=globalSettings__yubico__key="REPLACE" \
106+
--from-literal=SA_PASSWORD=$sa_password
107+
108+
kubectl create secret tls tls-secret --cert=bitwarden.localhost.pem --key=bitwarden.localhost.key
109+
110+
- name: Run chart-testing (install)
111+
if: steps.list-changed.outputs.changed == 'true'
112+
run: ct install --target-branch ${{ github.event.repository.default_branch }} --skip-clean-up --namespace bitwarden
113+
114+
- name: Test install
115+
if: steps.list-changed.outputs.changed == 'true'
116+
run: |
117+
#For review purposes
118+
echo "*****DEPLOYMENTS*****"
119+
kubectl get deployments
120+
echo "*****PODS*****"
121+
kubectl get pods
122+
echo "*****SERVICES*****"
123+
kubectl get svc
124+
echo "*****JOBS*****"
125+
kubectl get jobs
126+
echo "*****INGRESS*****"
127+
kubectl describe ingress
128+
129+
echo "*****HOME*****"
130+
home=$(curl -Ls https://bitwarden.localhost -w httpcode=%{http_code} --cacert rootCA.pem)
131+
echo $home | lynx -stdin -dump -width=100
132+
httpCode=$(echo "${home}" | grep -Po 'httpcode=\K(\d\d\d)')
133+
bodyCheck=$(echo "${home}" | grep -Po 'Bitwarden Web Vault')
134+
if [[ ${httpCode} -ne 200 ]]; then
135+
echo "::error::ERROR: Home page failed to load. HTTP code was $httpCode"
136+
exit 1
137+
fi
138+
if [[ "$bodyCheck" != "Bitwarden Web Vault" ]]; then
139+
echo "::error::ERROR: Home page failed to load. Please check body output above."
140+
exit 1
141+
fi
142+
143+
echo "Home OK."
144+
145+
echo "*****API/CONFIG*****"
146+
config=$(curl -Ls https://bitwarden.localhost/api/config -w httpcode=%{http_code} --cacert rootCA.pem)
147+
echo $config | lynx -stdin -dump -width=100
148+
httpCode=$(echo "${config}" | grep -Po 'httpcode=\K(\d\d\d)')
149+
bodyCheck=$(echo "${config}" | grep -Po '\"vault\":\"https://bitwarden\.localhost\"')
150+
if [[ ${httpCode} -ne 200 ]]; then
151+
echo "::error::ERROR: Home page failed to load. HTTP code was $httpCode"
152+
exit 1
153+
fi
154+
if [[ "$bodyCheck" != '"vault":"https://bitwarden.localhost"' ]]; then
155+
echo "::error::ERROR: API/Config page failed to load. Please check body output above."
156+
exit 1
157+
fi
158+
159+
echo "API/Config OK."
160+
161+
echo "*****ADMIN*****"
162+
admin=$(curl -Ls https://bitwarden.localhost/admin -w httpcode=%{http_code} --cacert rootCA.pem)
163+
echo $admin | lynx -stdin -dump -width=100
164+
165+
httpCode=$(echo "${admin}" | grep -Po 'httpcode=\K(\d\d\d)')
166+
bodyCheck=$(echo "${admin}" | grep -Po "We'll email you a secure login link")
167+
if [[ ${httpCode} -ne 200 ]]; then
168+
echo "::error::ERROR: Home page failed to load. HTTP code was $httpCode"
169+
exit 1
170+
fi
171+
if [[ "$bodyCheck" != "We'll email you a secure login link" ]]; then
172+
echo "::error::ERROR: Admin page failed to load. Please check body output above."
173+
exit 1
174+
fi
175+
176+
echo "Admin OK."
177+
178+
- name: Clean-up
179+
if: steps.list-changed.outputs.changed == 'true'
180+
run: |
181+
helm ls --all --short | xargs -L1 helm delete
182+
kubectl delete ns bitwarden
183+
kind delete cluster

‎charts/self-host/templates/admin.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@ metadata:
1313
{{- end }}
1414
spec:
1515
replicas: 1
16+
strategy:
17+
type: "{{ .Values.component.admin.deploymentStrategy }}"
1618
selector:
1719
matchLabels:
1820
app: {{ template "bitwarden.admin" . }}

‎charts/self-host/templates/api.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@ metadata:
1313
{{- end }}
1414
spec:
1515
replicas: 1
16+
strategy:
17+
type: "{{ .Values.component.api.deploymentStrategy }}"
1618
selector:
1719
matchLabels:
1820
app: {{ template "bitwarden.api" . }}

‎charts/self-host/templates/attachments.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@ metadata:
1313
{{- end }}
1414
spec:
1515
replicas: 1
16+
strategy:
17+
type: "{{ .Values.component.attachments.deploymentStrategy }}"
1618
selector:
1719
matchLabels:
1820
app: {{ template "bitwarden.attachments" . }}

‎charts/self-host/templates/events.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@ metadata:
1313
{{- end }}
1414
spec:
1515
replicas: 1
16+
strategy:
17+
type: "{{ .Values.component.events.deploymentStrategy }}"
1618
selector:
1719
matchLabels:
1820
app: {{ template "bitwarden.events" . }}

‎charts/self-host/templates/icons.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@ metadata:
1313
{{- end }}
1414
spec:
1515
replicas: 1
16+
strategy:
17+
type: "{{ .Values.component.icons.deploymentStrategy }}"
1618
selector:
1719
matchLabels:
1820
app: {{ template "bitwarden.icons" . }}

‎charts/self-host/templates/identity.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@ metadata:
1313
{{- end }}
1414
spec:
1515
replicas: 1
16+
strategy:
17+
type: "{{ .Values.component.identity.deploymentStrategy }}"
1618
selector:
1719
matchLabels:
1820
app: {{ template "bitwarden.identity" . }}

0 commit comments

Comments
 (0)