2.19.0

element-hq · Jul 5, 2024 · 6f4b41f · 6f4b41f
1 parent c888115
commit 6f4b41f
Show file tree

Hide file tree

Showing 36 changed files with 7,196 additions and 9,905 deletions.
diff --git a/Dockerfile.base b/Dockerfile.base
@@ -14,7 +14,7 @@ RUN apt update && apt install -y git make && \
     cd /workspace && \
     git clone https://github.com/element-hq/ansible-operator-plugins.git && \
     cd ansible-operator-plugins && \
-    git checkout gaelg/mark-unsafe-non-spec-object && \
+    git checkout gaelg/mark-unsafe-non-spec-object-main && \
     make build/ansible-operator && \
     mv ./ansible-operator /usr/local/bin/ansible-operator && \
     chmod +x /usr/local/bin/ansible-operator && /usr/local/bin/ansible-operator version

diff --git a/config/crd/element-deployment/base/starter-core/matrix_content_scanner.yaml b/config/crd/element-deployment/base/starter-core/matrix_content_scanner.yaml
@@ -1,4 +1,4 @@
-# Copyright 2023 New Vector Ltd
+# Copyright 2023-2024 New Vector Ltd
 #
 # SPDX-License-Identifier: AGPL-3.0-or-later
 
@@ -8,6 +8,8 @@
   value:
     type: object
     description: A web service for scanning media hosted on a Matrix media repository.
+    required:
+      - config
     properties:
       secretName:
         default: matrix-content-scanner

diff --git a/config/crd/element-deployment/base/starter-core/sliding_sync.yaml b/config/crd/element-deployment/base/starter-core/sliding_sync.yaml
@@ -1,4 +1,4 @@
-# Copyright 2023 New Vector Ltd
+# Copyright 2023-2024 New Vector Ltd
 #
 # SPDX-License-Identifier: AGPL-3.0-or-later
 
@@ -9,6 +9,8 @@
   value:
     type: object
     description: Sliding Sync is a backend component required by the Element X client beta. It provides a mechanism for the fast synchronisation of Matrix rooms. It is not recommended for production use and is only provide to enable the usage of the Element X client. The current version does not support SSO (OIDC/SAML/CAS). If you wish to try out the Element X client, then you need to be using password-based auth to allow Sliding Sync to work. SSO support (OIDC/SAML/CAS) will be added with a later version of the Sliding Sync tooling.
+    required:
+      - config
     properties:
       secretName:
         default: sliding-sync

diff --git a/config/crd/element-deployment/base/starter-core/synapse.yaml b/config/crd/element-deployment/base/starter-core/synapse.yaml
@@ -1,4 +1,4 @@
-# Copyright 2023 New Vector Ltd
+# Copyright 2023-2024 New Vector Ltd
 #
 # SPDX-License-Identifier: AGPL-3.0-or-later
 
@@ -8,6 +8,8 @@
   value:
     type: object
     description: This is a matrix homeserver.
+    required:
+      - config
     properties:
       secretName:
         default: synapse

diff --git a/helm/operator/Chart.yaml b/helm/operator/Chart.yaml
@@ -20,9 +20,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 2.18.6
+version: 2.19.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
-appVersion: 2.18.6
+appVersion: 2.19.0
diff --git a/helm/operator/source-values.yaml b/helm/operator/source-values.yaml
@@ -34,7 +34,7 @@ crds:
     imagePullPolicy: Always
     image:
       repository: docker.io/vectorim/ess-core-operator-conversion-webhook
-      tag: 2.18.6
+      tag: 2.19.0
 operator:
   extraPodSpec:
     securityContext:
@@ -57,7 +57,7 @@ operator:
       - name: DEBUG_MANIFESTS
         value: "0"
       - name: ANSIBLE_VERBOSITY
-        value: "1"
+        value: "0"
     extraContainerSpec:
       securityContext:
         allowPrivilegeEscalation: false
@@ -68,7 +68,7 @@ operator:
     imagePullPolicy: Always
     image:
       repository: docker.io/vectorim/ess-core-operator
-      tag: 2.18.6
+      tag: 2.19.0
   rbacProxy:
     resources:
       limits:
@@ -90,5 +90,5 @@ operator:
             - ALL
     imagePullPolicy: Always
     image:
-      repository: gcr.io/kubebuilder/kube-rbac-proxy
-      tag: v0.14.1
+      repository: quay.io/brancz/kube-rbac-proxy
+      tag: v0.18.0
diff --git a/helm/operator/values.yaml b/helm/operator/values.yaml
@@ -34,7 +34,7 @@ crds:
     imagePullPolicy: Always
     image:
       repository: docker.io/vectorim/ess-core-operator-conversion-webhook
-      tag: 2.18.6
+      tag: 2.19.0
 operator:
   extraPodSpec:
     securityContext:
@@ -57,7 +57,7 @@ operator:
       - name: DEBUG_MANIFESTS
         value: "0"
       - name: ANSIBLE_VERBOSITY
-        value: "1"
+        value: "0"
     extraContainerSpec:
       securityContext:
         allowPrivilegeEscalation: false
@@ -68,7 +68,7 @@ operator:
     imagePullPolicy: Always
     image:
       repository: docker.io/vectorim/ess-core-operator
-      tag: 2.18.6
+      tag: 2.19.0
   rbacProxy:
     resources:
       limits:
@@ -90,8 +90,8 @@ operator:
             - ALL
     imagePullPolicy: Always
     image:
-      repository: gcr.io/kubebuilder/kube-rbac-proxy
-      tag: v0.14.1
+      repository: quay.io/brancz/kube-rbac-proxy
+      tag: v0.18.0
   conversion-webhook:
     image:
       repository: ""
diff --git a/helm/updater/Chart.yaml b/helm/updater/Chart.yaml
@@ -20,9 +20,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 2.18.6
+version: 2.19.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
-appVersion: 2.18.6
+appVersion: 2.19.0
diff --git a/helm/updater/source-values.yaml b/helm/updater/source-values.yaml
@@ -34,7 +34,7 @@ crds:
     imagePullPolicy: Always
     image:
       repository: docker.io/vectorim/ess-core-updater-conversion-webhook
-      tag: 2.18.6
+      tag: 2.19.0
 updater:
   extraPodSpec:
     securityContext:
@@ -58,7 +58,7 @@ updater:
       - name: DEBUG_MANIFESTS
         value: "0"
       - name: ANSIBLE_VERBOSITY
-        value: "1"
+        value: "0"
     extraContainerSpec:
       securityContext:
         allowPrivilegeEscalation: false
@@ -68,7 +68,7 @@ updater:
             - ALL
     image:
       repository: docker.io/vectorim/ess-core-updater
-      tag: 2.18.6
+      tag: 2.19.0
   rbacProxy:
     resources:
       limits:
@@ -85,5 +85,5 @@ updater:
             - ALL
     imagePullPolicy: Always
     image:
-      repository: gcr.io/kubebuilder/kube-rbac-proxy
-      tag: v0.14.1
+      repository: quay.io/brancz/kube-rbac-proxy
+      tag: v0.18.0
diff --git a/helm/updater/templates/customresourcedefinition-elementdeployment.yaml b/helm/updater/templates/customresourcedefinition-elementdeployment.yaml
@@ -957,6 +957,8 @@ spec:
                           maxLength: 253
                           pattern: ^[a-z0-9]([\-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([\-a-z0-9]*[a-z0-9])?)*$
                           type: string
+                      required:
+                        - config
                       type: object
                     slidingSync:
                       description: Sliding Sync is a backend component required by the Element X client beta. It provides a mechanism for the fast synchronisation of Matrix rooms. It is not recommended for production use and is only provide to enable the usage of the Element X client. The current version does not support SSO (OIDC/SAML/CAS). If you wish to try out the Element X client, then you need to be using password-based auth to allow Sliding Sync to work. SSO support (OIDC/SAML/CAS) will be added with a later version of the Sliding Sync tooling.
@@ -1314,6 +1316,8 @@ spec:
                           maxLength: 253
                           pattern: ^[a-z0-9]([\-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([\-a-z0-9]*[a-z0-9])?)*$
                           type: string
+                      required:
+                        - config
                       type: object
                     synapse:
                       description: This is a matrix homeserver.
@@ -2122,6 +2126,8 @@ spec:
                           maxLength: 253
                           pattern: ^[a-z0-9]([\-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([\-a-z0-9]*[a-z0-9])?)*$
                           type: string
+                      required:
+                        - config
                       type: object
                     wellKnownDelegation:
                       description: This is a well known delegation file hosted as a static site.
@@ -3615,6 +3621,8 @@ spec:
                           maxLength: 253
                           pattern: ^[a-z0-9]([\-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([\-a-z0-9]*[a-z0-9])?)*$
                           type: string
+                      required:
+                        - config
                       type: object
                     slidingSync:
                       description: Sliding Sync is a backend component required by the Element X client beta. It provides a mechanism for the fast synchronisation of Matrix rooms. It is not recommended for production use and is only provide to enable the usage of the Element X client. The current version does not support SSO (OIDC/SAML/CAS). If you wish to try out the Element X client, then you need to be using password-based auth to allow Sliding Sync to work. SSO support (OIDC/SAML/CAS) will be added with a later version of the Sliding Sync tooling.
@@ -3972,6 +3980,8 @@ spec:
                           maxLength: 253
                           pattern: ^[a-z0-9]([\-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([\-a-z0-9]*[a-z0-9])?)*$
                           type: string
+                      required:
+                        - config
                       type: object
                     synapse:
                       description: This is a matrix homeserver.
@@ -4780,6 +4790,8 @@ spec:
                           maxLength: 253
                           pattern: ^[a-z0-9]([\-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([\-a-z0-9]*[a-z0-9])?)*$
                           type: string
+                      required:
+                        - config
                       type: object
                     wellKnownDelegation:
                       description: This is a well known delegation file hosted as a static site.

diff --git a/helm/updater/values.yaml b/helm/updater/values.yaml
@@ -34,7 +34,7 @@ crds:
     imagePullPolicy: Always
     image:
       repository: docker.io/vectorim/ess-core-updater-conversion-webhook
-      tag: 2.18.6
+      tag: 2.19.0
 updater:
   extraPodSpec:
     securityContext:
@@ -58,7 +58,7 @@ updater:
       - name: DEBUG_MANIFESTS
         value: "0"
       - name: ANSIBLE_VERBOSITY
-        value: "1"
+        value: "0"
     extraContainerSpec:
       securityContext:
         allowPrivilegeEscalation: false
@@ -68,7 +68,7 @@ updater:
             - ALL
     image:
       repository: docker.io/vectorim/ess-core-updater
-      tag: 2.18.6
+      tag: 2.19.0
   rbacProxy:
     resources:
       limits:
@@ -85,8 +85,8 @@ updater:
             - ALL
     imagePullPolicy: Always
     image:
-      repository: gcr.io/kubebuilder/kube-rbac-proxy
-      tag: v0.14.1
+      repository: quay.io/brancz/kube-rbac-proxy
+      tag: v0.18.0
   conversion-webhook:
     image:
       repository: ""
diff --git a/roles/elementdeployment/defaults/main/images.yml b/roles/elementdeployment/defaults/main/images.yml
@@ -7,12 +7,12 @@ default_images_digests:
     element_web:
       image_repository_server: docker.io
       image_repository_path: vectorim/element-web
-      image_tag: v1.11.68
+      image_tag: v1.11.69
   kube_rbac_proxy:
     kube_rbac_proxy:
-      image_repository_server: gcr.io
-      image_repository_path: kubebuilder/kube-rbac-proxy
-      image_tag: v0.14.1
+      image_repository_server: quay.io
+      image_repository_path: brancz/kube-rbac-proxy
+      image_tag: v0.18.0
   matrix_content_scanner:
     icap:
       image_repository_server: ghcr.io
@@ -30,7 +30,7 @@ default_images_digests:
     api:
       image_repository_server: ghcr.io
       image_repository_path: matrix-org/sliding-sync
-      image_tag: v0.99.17
+      image_tag: v0.99.19
   synapse:
     haproxy:
       image_repository_server: docker.io
@@ -43,7 +43,7 @@ default_images_digests:
     synapse:
       image_repository_server: docker.io
       image_repository_path: matrixdotorg/synapse
-      image_tag: v1.107.0
+      image_tag: v1.110.0
   well_known_delegation:
     well_known_delegation:
       image_repository_server: docker.io

diff --git a/roles/elementdeployment/files/elementdeployment-schema.yaml b/roles/elementdeployment/files/elementdeployment-schema.yaml
@@ -952,6 +952,8 @@ spec:
                           maxLength: 253
                           pattern: ^[a-z0-9]([\-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([\-a-z0-9]*[a-z0-9])?)*$
                           type: string
+                      required:
+                        - config
                       type: object
                     slidingSync:
                       description: Sliding Sync is a backend component required by the Element X client beta. It provides a mechanism for the fast synchronisation of Matrix rooms. It is not recommended for production use and is only provide to enable the usage of the Element X client. The current version does not support SSO (OIDC/SAML/CAS). If you wish to try out the Element X client, then you need to be using password-based auth to allow Sliding Sync to work. SSO support (OIDC/SAML/CAS) will be added with a later version of the Sliding Sync tooling.
@@ -1309,6 +1311,8 @@ spec:
                           maxLength: 253
                           pattern: ^[a-z0-9]([\-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([\-a-z0-9]*[a-z0-9])?)*$
                           type: string
+                      required:
+                        - config
                       type: object
                     synapse:
                       description: This is a matrix homeserver.
@@ -2117,6 +2121,8 @@ spec:
                           maxLength: 253
                           pattern: ^[a-z0-9]([\-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([\-a-z0-9]*[a-z0-9])?)*$
                           type: string
+                      required:
+                        - config
                       type: object
                     wellKnownDelegation:
                       description: This is a well known delegation file hosted as a static site.
@@ -3610,6 +3616,8 @@ spec:
                           maxLength: 253
                           pattern: ^[a-z0-9]([\-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([\-a-z0-9]*[a-z0-9])?)*$
                           type: string
+                      required:
+                        - config
                       type: object
                     slidingSync:
                       description: Sliding Sync is a backend component required by the Element X client beta. It provides a mechanism for the fast synchronisation of Matrix rooms. It is not recommended for production use and is only provide to enable the usage of the Element X client. The current version does not support SSO (OIDC/SAML/CAS). If you wish to try out the Element X client, then you need to be using password-based auth to allow Sliding Sync to work. SSO support (OIDC/SAML/CAS) will be added with a later version of the Sliding Sync tooling.
@@ -3967,6 +3975,8 @@ spec:
                           maxLength: 253
                           pattern: ^[a-z0-9]([\-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([\-a-z0-9]*[a-z0-9])?)*$
                           type: string
+                      required:
+                        - config
                       type: object
                     synapse:
                       description: This is a matrix homeserver.
@@ -4775,6 +4785,8 @@ spec:
                           maxLength: 253
                           pattern: ^[a-z0-9]([\-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([\-a-z0-9]*[a-z0-9])?)*$
                           type: string
+                      required:
+                        - config
                       type: object
                     wellKnownDelegation:
                       description: This is a well known delegation file hosted as a static site.

diff --git a/roles/elementdeployment/tasks/prepare.yml b/roles/elementdeployment/tasks/prepare.yml
@@ -38,3 +38,4 @@
       {% endfor %}
       {% endif %}
       {% endfor %}
+  no_log: "{{ lookup('env', 'DEBUG_MANIFESTS') | int != 1 }}"
diff --git a/roles/elementdeployment/tasks/prerequisites/all_secrets.yml b/roles/elementdeployment/tasks/prerequisites/all_secrets.yml
@@ -16,6 +16,7 @@
       }}
   block:
   - name: "Fetch all components secrets"
+    no_log: "{{ lookup('env', 'DEBUG_MANIFESTS') | int != 1 }}"
     ansible.builtin.set_fact:
       _all_secrets_yaml: |
         {% for item in _secret_names %}
@@ -30,6 +31,7 @@
         {% endfor %}
 
   - name: Build all secrets variable
+    no_log: "{{ lookup('env', 'DEBUG_MANIFESTS') | int != 1 }}"
     ansible.builtin.set_fact:
       _all_secrets: >-
         {{

diff --git a/roles/elementdeployment/tasks/prerequisites/global_secret.yml b/roles/elementdeployment/tasks/prerequisites/global_secret.yml
@@ -5,6 +5,7 @@
 
 ---
 - name: Fetch global secret
+  no_log: "{{ lookup('env', 'DEBUG_MANIFESTS') | int != 1 }}"
   ansible.builtin.set_fact:
     _global_secret: >
       {{