From c9bb4f11aac4ce883b7a6eb2a4884dcd60e3478f Mon Sep 17 00:00:00 2001 From: Cuong Tran Date: Mon, 12 Oct 2026 09:44:17 +0200 Subject: [PATCH 01/11] fix: WPB-28608 sftd nginx image --- values/sftd/demo-values.example.yaml | 4 ++-- values/sftd/prod-values.example.yaml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/values/sftd/demo-values.example.yaml b/values/sftd/demo-values.example.yaml index 91dc2c885..d7841479d 100644 --- a/values/sftd/demo-values.example.yaml +++ b/values/sftd/demo-values.example.yaml @@ -4,9 +4,9 @@ replicaCount: 1 joinCall: replicaCount: 1 image: - repository: docker.io/bitnamilegacy/nginx + repository: nginxinc/nginx-unprivileged pullPolicy: IfNotPresent - tag: "1.27.3-debian-12-r5" + tag: "1.29.5-alpine3.23-perl" tls: issuerRef: name: letsencrypt-http01 diff --git a/values/sftd/prod-values.example.yaml b/values/sftd/prod-values.example.yaml index 1c2374f9e..9a2445459 100644 --- a/values/sftd/prod-values.example.yaml +++ b/values/sftd/prod-values.example.yaml @@ -15,9 +15,9 @@ joinCall: # replicaCount = 1 is to support the simple wiab-staging solution replicaCount: 1 image: - repository: docker.io/bitnamilegacy/nginx + repository: nginxinc/nginx-unprivileged pullPolicy: IfNotPresent - tag: "1.27.3-debian-12-r5" + tag: "1.29.5-alpine3.23-perl" # Uncomment to enable SFT to SFT communication for federated calls # multiSFT: From 64a0bfb85451d96af3ee3483a65da6f5230c377e Mon Sep 17 00:00:00 2001 From: Cuong Tran Date: Mon, 12 Oct 2026 09:45:14 +0200 Subject: [PATCH 02/11] fix: WPB-28608 update 5.37 build file --- offline/tasks/proc_pull_charts.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/offline/tasks/proc_pull_charts.sh b/offline/tasks/proc_pull_charts.sh index fa3c60da9..c6cc51a9b 100755 --- a/offline/tasks/proc_pull_charts.sh +++ b/offline/tasks/proc_pull_charts.sh @@ -85,5 +85,5 @@ pull_charts() { } -wire_build="https://raw.githubusercontent.com/wireapp/wire-builds/refs/heads/pinned-offline-5.34.0/build.json" +wire_build="https://raw.githubusercontent.com/wireapp/wire-builds/70531ae076b1e4e33bd5c9b44a21628eb2a127b2/build.json" wire_build_chart_release "$wire_build" | pull_charts From c99750070e5ef6f4ca9a2f856f3246fea15ab5e5 Mon Sep 17 00:00:00 2001 From: Cuong Tran Date: Tue, 13 Oct 2026 09:35:00 +0200 Subject: [PATCH 03/11] fix: WPB-28608 override minio images --- values/fake-aws/demo-values.example.yaml | 8 ++++++++ values/fake-aws/prod-values.example.yaml | 10 +++++++++- 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/values/fake-aws/demo-values.example.yaml b/values/fake-aws/demo-values.example.yaml index ad09d557a..b4f5007e5 100644 --- a/values/fake-aws/demo-values.example.yaml +++ b/values/fake-aws/demo-values.example.yaml @@ -1,3 +1,11 @@ # Disable since prod should use an externally provided minio fake-aws-s3: enabled: true + minio: + image: + repository: quay.io/wire/mirror-images/minio/minio + tag: RELEASE.2023-07-07T07-13-57Z + + mcImage: + repository: quay.io/wire/mirror-images/minio/mc + tag: RELEASE.2023-06-28T21-54-17Z \ No newline at end of file diff --git a/values/fake-aws/prod-values.example.yaml b/values/fake-aws/prod-values.example.yaml index 594c756af..b4f5007e5 100644 --- a/values/fake-aws/prod-values.example.yaml +++ b/values/fake-aws/prod-values.example.yaml @@ -1,3 +1,11 @@ # Disable since prod should use an externally provided minio fake-aws-s3: - enabled: false + enabled: true + minio: + image: + repository: quay.io/wire/mirror-images/minio/minio + tag: RELEASE.2023-07-07T07-13-57Z + + mcImage: + repository: quay.io/wire/mirror-images/minio/mc + tag: RELEASE.2023-06-28T21-54-17Z \ No newline at end of file From d5379a1aa24426b509198ebe4f5ca9238cf9f00d Mon Sep 17 00:00:00 2001 From: Cuong Tran Date: Tue, 13 Oct 2026 11:16:09 +0200 Subject: [PATCH 04/11] fix: WPB-28608 override minio images fake-aws-s3 --- values/fake-aws-s3/demo-secrets.example.yaml | 6 ++++++ values/fake-aws-s3/demo-values.example.yaml | 8 ++++++++ values/fake-aws-s3/prod-values.example.yaml | 5 +++++ values/fake-aws/prod-values.example.yaml | 7 ++----- 4 files changed, 21 insertions(+), 5 deletions(-) create mode 100644 values/fake-aws-s3/demo-secrets.example.yaml create mode 100644 values/fake-aws-s3/demo-values.example.yaml create mode 100644 values/fake-aws-s3/prod-values.example.yaml diff --git a/values/fake-aws-s3/demo-secrets.example.yaml b/values/fake-aws-s3/demo-secrets.example.yaml new file mode 100644 index 000000000..654cf13fa --- /dev/null +++ b/values/fake-aws-s3/demo-secrets.example.yaml @@ -0,0 +1,6 @@ +# Disable since prod should use an externally provided minio +minio: + users: + - accessKey: dummykey + secretKey: dummysecret + policy: consoleAdmin diff --git a/values/fake-aws-s3/demo-values.example.yaml b/values/fake-aws-s3/demo-values.example.yaml new file mode 100644 index 000000000..ecbbfa773 --- /dev/null +++ b/values/fake-aws-s3/demo-values.example.yaml @@ -0,0 +1,8 @@ +minio: + image: + repository: quay.io/wire/mirror-images/minio/minio + tag: RELEASE.2023-07-07T07-13-57Z + + mcImage: + repository: quay.io/wire/mirror-images/minio/mc + tag: RELEASE.2023-06-28T21-54-17Z \ No newline at end of file diff --git a/values/fake-aws-s3/prod-values.example.yaml b/values/fake-aws-s3/prod-values.example.yaml new file mode 100644 index 000000000..8c4e6a6a6 --- /dev/null +++ b/values/fake-aws-s3/prod-values.example.yaml @@ -0,0 +1,5 @@ +minio: + image: + repository: quay.io/wire/mirror-images/minio/minio + mcImage: + repository: quay.io/wire/mirror-images/minio/mc \ No newline at end of file diff --git a/values/fake-aws/prod-values.example.yaml b/values/fake-aws/prod-values.example.yaml index b4f5007e5..640373d2e 100644 --- a/values/fake-aws/prod-values.example.yaml +++ b/values/fake-aws/prod-values.example.yaml @@ -1,11 +1,8 @@ # Disable since prod should use an externally provided minio fake-aws-s3: - enabled: true + enabled: false minio: image: repository: quay.io/wire/mirror-images/minio/minio - tag: RELEASE.2023-07-07T07-13-57Z - mcImage: - repository: quay.io/wire/mirror-images/minio/mc - tag: RELEASE.2023-06-28T21-54-17Z \ No newline at end of file + repository: quay.io/wire/mirror-images/minio/mc \ No newline at end of file From 20b5296fa2cf93a1573bad62b7c7c65a8a154a68 Mon Sep 17 00:00:00 2001 From: Leonhardt Wille Date: Thu, 5 Nov 2026 15:19:17 +0100 Subject: [PATCH 05/11] fix(CO-38): use hcloud_locations instead of removed datacenters API Hetzner removed the Datacenters API on 2026-10-01; requests now return HTTP 410 (deprecated_api_endpoint), breaking every CD plan. Switch the location pre-flight check to the hcloud_locations data source and pin the hcloud provider to ~> 1.70 so provider upgrades are deliberate. --- changelog.d/5-bug-fixes/hetzner-datacenters-removed | 1 + terraform/examples/wiab-demo-hetzner/main.tf | 4 ++-- terraform/examples/wiab-demo-hetzner/versions.tf | 3 ++- terraform/examples/wiab-staging-hetzner/main.tf | 4 ++-- terraform/examples/wiab-staging-hetzner/versions.tf | 3 ++- terraform/examples/wire-server-deploy-offline-hetzner/main.tf | 4 ++-- .../examples/wire-server-deploy-offline-hetzner/versions.tf | 3 ++- 7 files changed, 13 insertions(+), 9 deletions(-) create mode 100644 changelog.d/5-bug-fixes/hetzner-datacenters-removed diff --git a/changelog.d/5-bug-fixes/hetzner-datacenters-removed b/changelog.d/5-bug-fixes/hetzner-datacenters-removed new file mode 100644 index 000000000..8e4167f79 --- /dev/null +++ b/changelog.d/5-bug-fixes/hetzner-datacenters-removed @@ -0,0 +1 @@ +Fixed: Replace removed Hetzner `hcloud_datacenters` data source (HTTP 410 since 2026-10-01) with `hcloud_locations` in the CD terraform modules and pin the hcloud provider to `~> 1.70` diff --git a/terraform/examples/wiab-demo-hetzner/main.tf b/terraform/examples/wiab-demo-hetzner/main.tf index e667fecd1..1824c4652 100644 --- a/terraform/examples/wiab-demo-hetzner/main.tf +++ b/terraform/examples/wiab-demo-hetzner/main.tf @@ -15,11 +15,11 @@ variable "server_type" { # Get available server types and locations data "hcloud_server_types" "available" {} -data "hcloud_datacenters" "available" {} +data "hcloud_locations" "available" {} locals { available_server_type_names = [for st in data.hcloud_server_types.available.server_types : st.name] - available_location_names = [for dc in data.hcloud_datacenters.available.datacenters : dc.location.name] + available_location_names = [for l in data.hcloud_locations.available.locations : l.name] } resource "null_resource" "location_validation" { diff --git a/terraform/examples/wiab-demo-hetzner/versions.tf b/terraform/examples/wiab-demo-hetzner/versions.tf index b047ba54e..9260675da 100644 --- a/terraform/examples/wiab-demo-hetzner/versions.tf +++ b/terraform/examples/wiab-demo-hetzner/versions.tf @@ -1,7 +1,8 @@ terraform { required_providers { hcloud = { - source = "hetznercloud/hcloud" + source = "hetznercloud/hcloud" + version = "~> 1.70" } } required_version = "~> 1.1" diff --git a/terraform/examples/wiab-staging-hetzner/main.tf b/terraform/examples/wiab-staging-hetzner/main.tf index 5fb916526..65d7e5e54 100644 --- a/terraform/examples/wiab-staging-hetzner/main.tf +++ b/terraform/examples/wiab-staging-hetzner/main.tf @@ -25,12 +25,12 @@ variable "medium_server_type" { # Get available server types and locations data "hcloud_server_types" "available" {} -data "hcloud_datacenters" "available" {} +data "hcloud_locations" "available" {} # Validate the exact combination requested by the deployment script. locals { available_server_type_names = [for st in data.hcloud_server_types.available.server_types : st.name] - available_location_names = [for dc in data.hcloud_datacenters.available.datacenters : dc.location.name] + available_location_names = [for l in data.hcloud_locations.available.locations : l.name] } resource "null_resource" "location_validation" { diff --git a/terraform/examples/wiab-staging-hetzner/versions.tf b/terraform/examples/wiab-staging-hetzner/versions.tf index b047ba54e..9260675da 100644 --- a/terraform/examples/wiab-staging-hetzner/versions.tf +++ b/terraform/examples/wiab-staging-hetzner/versions.tf @@ -1,7 +1,8 @@ terraform { required_providers { hcloud = { - source = "hetznercloud/hcloud" + source = "hetznercloud/hcloud" + version = "~> 1.70" } } required_version = "~> 1.1" diff --git a/terraform/examples/wire-server-deploy-offline-hetzner/main.tf b/terraform/examples/wire-server-deploy-offline-hetzner/main.tf index 657f6ed0c..de792a0d0 100644 --- a/terraform/examples/wire-server-deploy-offline-hetzner/main.tf +++ b/terraform/examples/wire-server-deploy-offline-hetzner/main.tf @@ -29,12 +29,12 @@ variable "medium_server_type" { # Get available server types and locations data "hcloud_server_types" "available" {} -data "hcloud_datacenters" "available" {} +data "hcloud_locations" "available" {} # Validate the exact combination requested by the deployment script. locals { available_server_type_names = [for st in data.hcloud_server_types.available.server_types : st.name] - available_location_names = [for dc in data.hcloud_datacenters.available.datacenters : dc.location.name] + available_location_names = [for l in data.hcloud_locations.available.locations : l.name] } resource "null_resource" "location_validation" { diff --git a/terraform/examples/wire-server-deploy-offline-hetzner/versions.tf b/terraform/examples/wire-server-deploy-offline-hetzner/versions.tf index b047ba54e..9260675da 100644 --- a/terraform/examples/wire-server-deploy-offline-hetzner/versions.tf +++ b/terraform/examples/wire-server-deploy-offline-hetzner/versions.tf @@ -1,7 +1,8 @@ terraform { required_providers { hcloud = { - source = "hetznercloud/hcloud" + source = "hetznercloud/hcloud" + version = "~> 1.70" } } required_version = "~> 1.1" From c45e31b1f69108512933bcc303b7e4607cd09441 Mon Sep 17 00:00:00 2001 From: Leonhardt Wille Date: Thu, 5 Nov 2026 15:26:59 +0100 Subject: [PATCH 06/11] fix(CO-38): try all server types in hel1 before German locations The retry loop iterated locations inside server types, so a capacity miss for the first server type in hel1 fell through to fsn1/nbg1, where VMs are rarely available. Iterate server types inside locations so hel1 is exhausted first. --- offline/cd.sh | 6 ++++-- offline/cd_demo.sh | 6 ++++-- offline/cd_staging.sh | 6 ++++-- 3 files changed, 12 insertions(+), 6 deletions(-) diff --git a/offline/cd.sh b/offline/cd.sh index 069566d94..a67e9f211 100755 --- a/offline/cd.sh +++ b/offline/cd.sh @@ -11,6 +11,8 @@ COMMIT_HASH="${GITHUB_SHA}" ARTIFACT="wire-server-deploy-static-${COMMIT_HASH}" # Retry matrix +# Locations are tried in order and exhaust all server types before moving on. +# Prefer hel1: German locations rarely have capacity. LOCATIONS=("hel1" "fsn1" "nbg1") SMALL_SERVER_TYPES=("cx23" "cx33" "cpx22") MEDIUM_SERVER_TYPES=("cx33" "cx43" "cpx32") @@ -68,8 +70,8 @@ echo "Retry plan: ${location_count} locations x ${server_type_count} server type attempt=1 deployment_succeeded=false -for server_type_index in $(seq 0 $((server_type_count - 1))); do - for location_index in $(seq 0 $((location_count - 1))); do +for location_index in $(seq 0 $((location_count - 1))); do + for server_type_index in $(seq 0 $((server_type_count - 1))); do attempt_location="${LOCATIONS[$location_index]}" attempt_small_server_type="${SMALL_SERVER_TYPES[$server_type_index]}" attempt_medium_server_type="${MEDIUM_SERVER_TYPES[$server_type_index]}" diff --git a/offline/cd_demo.sh b/offline/cd_demo.sh index d9b0ed932..2ce41674a 100755 --- a/offline/cd_demo.sh +++ b/offline/cd_demo.sh @@ -16,6 +16,8 @@ TEST_USER="demo" COMMIT_HASH="${GITHUB_SHA}" # Retry matrix +# Locations are tried in order and exhaust all server types before moving on. +# Prefer hel1: German locations rarely have capacity. LOCATIONS=("hel1" "fsn1" "nbg1") SERVER_TYPES=("cx53" "cpx62") @@ -62,8 +64,8 @@ echo "Retry plan: ${location_count} locations x ${server_type_count} server type attempt=1 deployment_succeeded=false -for server_type_index in $(seq 0 $((server_type_count - 1))); do - for location_index in $(seq 0 $((location_count - 1))); do +for location_index in $(seq 0 $((location_count - 1))); do + for server_type_index in $(seq 0 $((server_type_count - 1))); do attempt_location="${LOCATIONS[$location_index]}" attempt_server_type="${SERVER_TYPES[$server_type_index]}" diff --git a/offline/cd_staging.sh b/offline/cd_staging.sh index cd4d2ccbc..dc344a4db 100755 --- a/offline/cd_staging.sh +++ b/offline/cd_staging.sh @@ -10,6 +10,8 @@ COMMIT_HASH="${GITHUB_SHA}" ARTIFACT="wire-server-deploy-static-${COMMIT_HASH}" # Retry matrix +# Locations are tried in order and exhaust all server types before moving on. +# Prefer hel1: German locations rarely have capacity. LOCATIONS=("hel1" "nbg1" "fsn1") SMALL_SERVER_TYPES=("cpx22" "cpx32" "cpx42") MEDIUM_SERVER_TYPES=("cpx42" "cpx52" "cpx62") @@ -67,8 +69,8 @@ echo "Starting deployment with automatic retry on resource unavailability..." attempt=1 deployment_succeeded=false -for server_type_index in $(seq 0 $((server_type_count - 1))); do - for location_index in $(seq 0 $((location_count - 1))); do +for location_index in $(seq 0 $((location_count - 1))); do + for server_type_index in $(seq 0 $((server_type_count - 1))); do attempt_location="${LOCATIONS[$location_index]}" attempt_small_server_type="${SMALL_SERVER_TYPES[$server_type_index]}" attempt_medium_server_type="${MEDIUM_SERVER_TYPES[$server_type_index]}" From 0b047933196d3efda3131df4e171c955ddc6d2bf Mon Sep 17 00:00:00 2001 From: Leonhardt Wille Date: Thu, 5 Nov 2026 18:18:43 +0100 Subject: [PATCH 07/11] fix(CO-38): skip hetzner cleanup when terraform was never installed The cleanup steps ran with `if: always()`, so when an earlier step (e.g. the dev build) failed they ran before setup-terraform and died with `terraform: command not found`. Only run them once terraform was installed; if it wasn't, nothing can have been deployed. --- .github/workflows/offline.yml | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/.github/workflows/offline.yml b/.github/workflows/offline.yml index 0df59627c..ecc9b3957 100644 --- a/.github/workflows/offline.yml +++ b/.github/workflows/offline.yml @@ -98,6 +98,7 @@ jobs: run: nix-env -f default.nix -iA env - name: Install terraform + id: install-terraform uses: hashicorp/setup-terraform@v3 with: terraform_version: "^1.3.7" @@ -109,7 +110,8 @@ jobs: HCLOUD_TOKEN: '${{ secrets.HCLOUD_TOKEN }}' - name: Clean up hetzner environment; just in case - if: always() + # Skip when terraform was never installed (earlier step failed): nothing was deployed. + if: always() && steps.install-terraform.outcome == 'success' run: (cd terraform/examples/wire-server-deploy-offline-hetzner ; terraform init && terraform destroy -auto-approve) env: HCLOUD_TOKEN: '${{ secrets.HCLOUD_TOKEN }}' @@ -138,6 +140,7 @@ jobs: run: nix-env -f default.nix -iA env - name: Install terraform + id: install-terraform uses: hashicorp/setup-terraform@v3 with: terraform_version: "^1.3.7" @@ -149,7 +152,8 @@ jobs: HCLOUD_TOKEN: '${{ secrets.HCLOUD_TOKEN }}' - name: Clean up hetzner wiab-staging environment; just in case - if: always() + # Skip when terraform was never installed (earlier step failed): nothing was deployed. + if: always() && steps.install-terraform.outcome == 'success' run: (cd terraform/examples/wiab-staging-hetzner ; terraform init && terraform destroy -auto-approve) env: HCLOUD_TOKEN: '${{ secrets.HCLOUD_TOKEN }}' @@ -221,6 +225,7 @@ jobs: AWS_REGION: "eu-west-1" - name: Install terraform + id: install-terraform uses: hashicorp/setup-terraform@v3 with: terraform_version: "^1.3.7" @@ -232,7 +237,8 @@ jobs: HCLOUD_TOKEN: '${{ secrets.HCLOUD_TOKEN }}' - name: Clean up hetzner wiab environment; just in case - if: always() + # Skip when terraform was never installed (earlier step failed): nothing was deployed. + if: always() && steps.install-terraform.outcome == 'success' run: (cd terraform/examples/wiab-demo-hetzner ; terraform init && terraform destroy -auto-approve) env: HCLOUD_TOKEN: '${{ secrets.HCLOUD_TOKEN }}' From bfb1c6d0be4bd8c31ffe23f9fb92b963c403f467 Mon Sep 17 00:00:00 2001 From: Leonhardt Wille Date: Mon, 9 Nov 2026 11:26:47 +0100 Subject: [PATCH 08/11] WPB-29054: use minio mirror for fake-aws-s3 (#943) * WPB-29054: use minio mirror for fake-aws-s3 Porting: > https://wearezeta.atlassian.net/browse/WPB-29054 > Note: Fixing or replacing the broken fake-aws-s3 chart is not in scope. * lint: add newline at end of file * lint: newline * fix: block fake-aws-s3 from default-build * removed ineffective values --- changelog.d/5-bug-fixes/fix-minio-image | 1 + offline/default-build/build.sh | 2 +- values/fake-aws-s3/demo-values.example.yaml | 4 ++-- values/fake-aws-s3/prod-values.example.yaml | 6 +++++- values/fake-aws/demo-secrets.example.yaml | 1 - values/fake-aws/demo-values.example.yaml | 4 +--- values/fake-aws/prod-values.example.yaml | 4 +++- 7 files changed, 13 insertions(+), 9 deletions(-) create mode 100644 changelog.d/5-bug-fixes/fix-minio-image diff --git a/changelog.d/5-bug-fixes/fix-minio-image b/changelog.d/5-bug-fixes/fix-minio-image new file mode 100644 index 000000000..7cfb278d2 --- /dev/null +++ b/changelog.d/5-bug-fixes/fix-minio-image @@ -0,0 +1 @@ +Fixed: use mirror for fetching unavailable Minio images diff --git a/offline/default-build/build.sh b/offline/default-build/build.sh index 239b5937c..93b4d14f0 100755 --- a/offline/default-build/build.sh +++ b/offline/default-build/build.sh @@ -26,7 +26,7 @@ TASKS_DIR="${SCRIPT_DIR}/../tasks" # -------------------------- # pulling the charts based on builds.json, charts to be skipped are passed as arguments HELM_CHART_EXCLUDE_LIST -"${TASKS_DIR}"/proc_pull_charts.sh OUTPUT_DIR="${OUTPUT_DIR}" HELM_CHART_EXCLUDE_LIST="inbucket,wire-server-enterprise,postgresql,rust-sft,fluent-bit" +"${TASKS_DIR}"/proc_pull_charts.sh OUTPUT_DIR="${OUTPUT_DIR}" HELM_CHART_EXCLUDE_LIST="inbucket,wire-server-enterprise,postgresql,rust-sft,fluent-bit,fake-aws-s3" # pulling the charts from helm-charts repo, charts to be included are passed as arguments HELM_CHART_INCLUDE_LIST # "${TASKS_DIR}"/proc_pull_ext_charts.sh OUTPUT_DIR="${OUTPUT_DIR}" HELM_CHART_INCLUDE_LIST="postgresql-external" diff --git a/values/fake-aws-s3/demo-values.example.yaml b/values/fake-aws-s3/demo-values.example.yaml index ecbbfa773..a6f24ad0a 100644 --- a/values/fake-aws-s3/demo-values.example.yaml +++ b/values/fake-aws-s3/demo-values.example.yaml @@ -1,8 +1,8 @@ +enabled: true minio: image: repository: quay.io/wire/mirror-images/minio/minio tag: RELEASE.2023-07-07T07-13-57Z - mcImage: repository: quay.io/wire/mirror-images/minio/mc - tag: RELEASE.2023-06-28T21-54-17Z \ No newline at end of file + tag: RELEASE.2023-06-28T21-54-17Z diff --git a/values/fake-aws-s3/prod-values.example.yaml b/values/fake-aws-s3/prod-values.example.yaml index 8c4e6a6a6..c03722b48 100644 --- a/values/fake-aws-s3/prod-values.example.yaml +++ b/values/fake-aws-s3/prod-values.example.yaml @@ -1,5 +1,9 @@ +# Disable since prod should use an externally provided minio +enabled: false minio: image: repository: quay.io/wire/mirror-images/minio/minio + tag: RELEASE.2023-07-07T07-13-57Z mcImage: - repository: quay.io/wire/mirror-images/minio/mc \ No newline at end of file + repository: quay.io/wire/mirror-images/minio/mc + tag: RELEASE.2023-06-28T21-54-17Z diff --git a/values/fake-aws/demo-secrets.example.yaml b/values/fake-aws/demo-secrets.example.yaml index 2f475508e..a27832bd5 100644 --- a/values/fake-aws/demo-secrets.example.yaml +++ b/values/fake-aws/demo-secrets.example.yaml @@ -1,4 +1,3 @@ -# Disable since prod should use an externally provided minio fake-aws-s3: enabled: true minio: diff --git a/values/fake-aws/demo-values.example.yaml b/values/fake-aws/demo-values.example.yaml index b4f5007e5..21509f24c 100644 --- a/values/fake-aws/demo-values.example.yaml +++ b/values/fake-aws/demo-values.example.yaml @@ -1,11 +1,9 @@ -# Disable since prod should use an externally provided minio fake-aws-s3: enabled: true minio: image: repository: quay.io/wire/mirror-images/minio/minio tag: RELEASE.2023-07-07T07-13-57Z - mcImage: repository: quay.io/wire/mirror-images/minio/mc - tag: RELEASE.2023-06-28T21-54-17Z \ No newline at end of file + tag: RELEASE.2023-06-28T21-54-17Z diff --git a/values/fake-aws/prod-values.example.yaml b/values/fake-aws/prod-values.example.yaml index 640373d2e..998eeba6e 100644 --- a/values/fake-aws/prod-values.example.yaml +++ b/values/fake-aws/prod-values.example.yaml @@ -4,5 +4,7 @@ fake-aws-s3: minio: image: repository: quay.io/wire/mirror-images/minio/minio + tag: RELEASE.2023-07-07T07-13-57Z mcImage: - repository: quay.io/wire/mirror-images/minio/mc \ No newline at end of file + repository: quay.io/wire/mirror-images/minio/mc + tag: RELEASE.2023-06-28T21-54-17Z From 5ecda6e4cc205774f34b1a754c14083fdb22366d Mon Sep 17 00:00:00 2001 From: Cuong Tran Date: Wed, 11 Nov 2026 23:33:43 +0100 Subject: [PATCH 09/11] WPB-27966 fix reaper images --- values/reaper/demo-values.example.yaml | 6 ++---- values/reaper/prod-values.example.yaml | 6 ++---- 2 files changed, 4 insertions(+), 8 deletions(-) diff --git a/values/reaper/demo-values.example.yaml b/values/reaper/demo-values.example.yaml index 79e1a22a3..9f1db84ea 100644 --- a/values/reaper/demo-values.example.yaml +++ b/values/reaper/demo-values.example.yaml @@ -1,6 +1,4 @@ image: registry: docker.io - # Override kubectl image to use available version in bitnamilegacy - # Using the last available version in 1.32.x series - repository: bitnamilegacy/kubectl - tag: 1.32.4 + repository: alpine/kubectl + tag: 1.36.3 diff --git a/values/reaper/prod-values.example.yaml b/values/reaper/prod-values.example.yaml index 79e1a22a3..9f1db84ea 100644 --- a/values/reaper/prod-values.example.yaml +++ b/values/reaper/prod-values.example.yaml @@ -1,6 +1,4 @@ image: registry: docker.io - # Override kubectl image to use available version in bitnamilegacy - # Using the last available version in 1.32.x series - repository: bitnamilegacy/kubectl - tag: 1.32.4 + repository: alpine/kubectl + tag: 1.36.3 From e15759a0490249737490522e96eb0f851ed658b3 Mon Sep 17 00:00:00 2001 From: Leonhardt Wille Date: Mon, 9 Nov 2026 17:30:27 +0100 Subject: [PATCH 10/11] fix(CO-38): wait for adminhost SSH in default Hetzner CD setup_nodes.yml connected to adminhost_local (private IP, through the public adminhost) right after the VMs were created and failed with 'Connection timed out during banner exchange'. Wait for SSH first, as #919 does for wiab-staging. --- .../5-bug-fixes/cd-default-wait-for-adminhost | 1 + .../setup_nodes.yml | 16 ++++++++++++++++ 2 files changed, 17 insertions(+) create mode 100644 changelog.d/5-bug-fixes/cd-default-wait-for-adminhost diff --git a/changelog.d/5-bug-fixes/cd-default-wait-for-adminhost b/changelog.d/5-bug-fixes/cd-default-wait-for-adminhost new file mode 100644 index 000000000..be225e21e --- /dev/null +++ b/changelog.d/5-bug-fixes/cd-default-wait-for-adminhost @@ -0,0 +1 @@ +Fixed: wait for SSH on the adminhost private IP before running setup_nodes.yml in the default Hetzner CD environment (same as wiab-staging, #919) diff --git a/terraform/examples/wire-server-deploy-offline-hetzner/setup_nodes.yml b/terraform/examples/wire-server-deploy-offline-hetzner/setup_nodes.yml index 316e2d97d..f7c2d9be7 100644 --- a/terraform/examples/wire-server-deploy-offline-hetzner/setup_nodes.yml +++ b/terraform/examples/wire-server-deploy-offline-hetzner/setup_nodes.yml @@ -1,4 +1,20 @@ --- +- name: Wait for adminhost private SSH + hosts: adminhost + gather_facts: no + tasks: + - name: Wait for SSH on public adminhost + wait_for_connection: + timeout: 300 + delay: 5 + + - name: Wait until adminhost private IP is reachable from public adminhost + wait_for: + host: "{{ hostvars['adminhost_local'].ansible_host }}" + port: 22 + timeout: 300 + delay: 5 + - name: Setup adminhost with dnsmasq and Docker hosts: adminhost_local become: yes From 256a278d47c5df15877b000b65230327842b2fd8 Mon Sep 17 00:00:00 2001 From: Cuong Tran Date: Thu, 12 Nov 2026 17:36:00 +0100 Subject: [PATCH 11/11] CO55 fix: update reference for 5.38 --- changelog.d/2-wire-builds/dump-version-info | 1 - changelog.d/2-wire-builds/release-5.38 | 1 + offline/tasks/proc_pull_charts.sh | 2 +- 3 files changed, 2 insertions(+), 2 deletions(-) delete mode 100644 changelog.d/2-wire-builds/dump-version-info create mode 100644 changelog.d/2-wire-builds/release-5.38 diff --git a/changelog.d/2-wire-builds/dump-version-info b/changelog.d/2-wire-builds/dump-version-info deleted file mode 100644 index 562586784..000000000 --- a/changelog.d/2-wire-builds/dump-version-info +++ /dev/null @@ -1 +0,0 @@ -Added: Dump version information post creating the artifacts on the stdout diff --git a/changelog.d/2-wire-builds/release-5.38 b/changelog.d/2-wire-builds/release-5.38 new file mode 100644 index 000000000..ca29608e1 --- /dev/null +++ b/changelog.d/2-wire-builds/release-5.38 @@ -0,0 +1 @@ +Fixed: update reference for 5.38 \ No newline at end of file diff --git a/offline/tasks/proc_pull_charts.sh b/offline/tasks/proc_pull_charts.sh index c6cc51a9b..577934f62 100755 --- a/offline/tasks/proc_pull_charts.sh +++ b/offline/tasks/proc_pull_charts.sh @@ -85,5 +85,5 @@ pull_charts() { } -wire_build="https://raw.githubusercontent.com/wireapp/wire-builds/70531ae076b1e4e33bd5c9b44a21628eb2a127b2/build.json" +wire_build="https://raw.githubusercontent.com/wireapp/wire-builds/223f0cad2211287f9ebaed38ae4df4c5fdc01eb9/build.json" wire_build_chart_release "$wire_build" | pull_charts