Co 55 release 5.38.0

.github/workflows/offline.yml

@@ -98,6 +98,7 @@ jobs:
         run: nix-env -f default.nix -iA env
 
       - name: Install terraform
+        id: install-terraform
         uses: hashicorp/setup-terraform@v3
         with:
           terraform_version: "^1.3.7"
@@ -109,7 +110,8 @@ jobs:
           HCLOUD_TOKEN: '${{ secrets.HCLOUD_TOKEN }}'
 
       - name: Clean up hetzner environment; just in case
-        if: always()
+        # Skip when terraform was never installed (earlier step failed): nothing was deployed.
+        if: always() && steps.install-terraform.outcome == 'success'
         run: (cd terraform/examples/wire-server-deploy-offline-hetzner ; terraform init && terraform destroy -auto-approve)
         env:
           HCLOUD_TOKEN: '${{ secrets.HCLOUD_TOKEN }}'
@@ -138,6 +140,7 @@ jobs:
         run: nix-env -f default.nix -iA env
 
       - name: Install terraform
+        id: install-terraform
         uses: hashicorp/setup-terraform@v3
         with:
           terraform_version: "^1.3.7"
@@ -149,7 +152,8 @@ jobs:
           HCLOUD_TOKEN: '${{ secrets.HCLOUD_TOKEN }}'
 
       - name: Clean up hetzner wiab-staging environment; just in case
-        if: always()
+        # Skip when terraform was never installed (earlier step failed): nothing was deployed.
+        if: always() && steps.install-terraform.outcome == 'success'
         run: (cd terraform/examples/wiab-staging-hetzner ; terraform init && terraform destroy -auto-approve)
         env:
           HCLOUD_TOKEN: '${{ secrets.HCLOUD_TOKEN }}'
@@ -221,6 +225,7 @@ jobs:
           AWS_REGION: "eu-west-1"
 
       - name: Install terraform
+        id: install-terraform
         uses: hashicorp/setup-terraform@v3
         with:
           terraform_version: "^1.3.7"
@@ -232,7 +237,8 @@ jobs:
           HCLOUD_TOKEN: '${{ secrets.HCLOUD_TOKEN }}'
 
       - name: Clean up hetzner wiab environment; just in case
-        if: always()
+        # Skip when terraform was never installed (earlier step failed): nothing was deployed.
+        if: always() && steps.install-terraform.outcome == 'success'
         run: (cd terraform/examples/wiab-demo-hetzner ; terraform init && terraform destroy -auto-approve)
         env:
           HCLOUD_TOKEN: '${{ secrets.HCLOUD_TOKEN }}'

changelog.d/2-wire-builds/release-5.38

@@ -0,0 +1 @@
+Fixed: update reference for 5.38

changelog.d/5-bug-fixes/cd-default-wait-for-adminhost

@@ -0,0 +1 @@
+Fixed: wait for SSH on the adminhost private IP before running setup_nodes.yml in the default Hetzner CD environment (same as wiab-staging, #919)

changelog.d/5-bug-fixes/fix-minio-image

@@ -0,0 +1 @@
+Fixed: use mirror for fetching unavailable Minio images

changelog.d/5-bug-fixes/hetzner-datacenters-removed

@@ -0,0 +1 @@
+Fixed: Replace removed Hetzner `hcloud_datacenters` data source (HTTP 410 since 2026-10-01) with `hcloud_locations` in the CD terraform modules and pin the hcloud provider to `~> 1.70`

offline/cd.sh

@@ -11,6 +11,8 @@ COMMIT_HASH="${GITHUB_SHA}"
 ARTIFACT="wire-server-deploy-static-${COMMIT_HASH}"
 
 # Retry matrix
+# Locations are tried in order and exhaust all server types before moving on.
+# Prefer hel1: German locations rarely have capacity.
 LOCATIONS=("hel1" "fsn1" "nbg1")
 SMALL_SERVER_TYPES=("cx23" "cx33" "cpx22")
 MEDIUM_SERVER_TYPES=("cx33" "cx43" "cpx32")
@@ -68,8 +70,8 @@ echo "Retry plan: ${location_count} locations x ${server_type_count} server type
 attempt=1
 deployment_succeeded=false
 
-for server_type_index in $(seq 0 $((server_type_count - 1))); do
-    for location_index in $(seq 0 $((location_count - 1))); do
+for location_index in $(seq 0 $((location_count - 1))); do
+    for server_type_index in $(seq 0 $((server_type_count - 1))); do
         attempt_location="${LOCATIONS[$location_index]}"
         attempt_small_server_type="${SMALL_SERVER_TYPES[$server_type_index]}"
         attempt_medium_server_type="${MEDIUM_SERVER_TYPES[$server_type_index]}"

offline/cd_demo.sh

@@ -16,6 +16,8 @@ TEST_USER="demo"
 COMMIT_HASH="${GITHUB_SHA}"
 
 # Retry matrix
+# Locations are tried in order and exhaust all server types before moving on.
+# Prefer hel1: German locations rarely have capacity.
 LOCATIONS=("hel1" "fsn1" "nbg1")
 SERVER_TYPES=("cx53" "cpx62")
 
@@ -62,8 +64,8 @@ echo "Retry plan: ${location_count} locations x ${server_type_count} server type
 attempt=1
 deployment_succeeded=false
 
-for server_type_index in $(seq 0 $((server_type_count - 1))); do
-	for location_index in $(seq 0 $((location_count - 1))); do
+for location_index in $(seq 0 $((location_count - 1))); do
+	for server_type_index in $(seq 0 $((server_type_count - 1))); do
 		attempt_location="${LOCATIONS[$location_index]}"
 		attempt_server_type="${SERVER_TYPES[$server_type_index]}"
 

offline/cd_staging.sh

@@ -10,6 +10,8 @@ COMMIT_HASH="${GITHUB_SHA}"
 ARTIFACT="wire-server-deploy-static-${COMMIT_HASH}"
 
 # Retry matrix
+# Locations are tried in order and exhaust all server types before moving on.
+# Prefer hel1: German locations rarely have capacity.
 LOCATIONS=("hel1" "nbg1" "fsn1")
 SMALL_SERVER_TYPES=("cpx22" "cpx32" "cpx42")
 MEDIUM_SERVER_TYPES=("cpx42" "cpx52" "cpx62")
@@ -67,8 +69,8 @@ echo "Starting deployment with automatic retry on resource unavailability..."
 attempt=1
 deployment_succeeded=false
 
-for server_type_index in $(seq 0 $((server_type_count - 1))); do
-    for location_index in $(seq 0 $((location_count - 1))); do
+for location_index in $(seq 0 $((location_count - 1))); do
+    for server_type_index in $(seq 0 $((server_type_count - 1))); do
         attempt_location="${LOCATIONS[$location_index]}"
         attempt_small_server_type="${SMALL_SERVER_TYPES[$server_type_index]}"
         attempt_medium_server_type="${MEDIUM_SERVER_TYPES[$server_type_index]}"

offline/default-build/build.sh

@@ -26,7 +26,7 @@ TASKS_DIR="${SCRIPT_DIR}/../tasks"
 # --------------------------
 
 # pulling the charts based on builds.json, charts to be skipped are passed as arguments HELM_CHART_EXCLUDE_LIST
-"${TASKS_DIR}"/proc_pull_charts.sh OUTPUT_DIR="${OUTPUT_DIR}" HELM_CHART_EXCLUDE_LIST="inbucket,wire-server-enterprise,postgresql,rust-sft,fluent-bit"
+"${TASKS_DIR}"/proc_pull_charts.sh OUTPUT_DIR="${OUTPUT_DIR}" HELM_CHART_EXCLUDE_LIST="inbucket,wire-server-enterprise,postgresql,rust-sft,fluent-bit,fake-aws-s3"
 
 # pulling the charts from helm-charts repo, charts to be included are passed as arguments HELM_CHART_INCLUDE_LIST
 # "${TASKS_DIR}"/proc_pull_ext_charts.sh OUTPUT_DIR="${OUTPUT_DIR}" HELM_CHART_INCLUDE_LIST="postgresql-external"

offline/tasks/proc_pull_charts.sh

@@ -85,5 +85,5 @@ pull_charts() {
 
 }
 
-wire_build="https://raw.githubusercontent.com/wireapp/wire-builds/refs/heads/pinned-offline-5.34.0/build.json"
+wire_build="https://raw.githubusercontent.com/wireapp/wire-builds/223f0cad2211287f9ebaed38ae4df4c5fdc01eb9/build.json"
 wire_build_chart_release "$wire_build" | pull_charts

terraform/examples/wiab-demo-hetzner/main.tf

@@ -15,11 +15,11 @@ variable "server_type" {
 
 # Get available server types and locations
 data "hcloud_server_types" "available" {}
-data "hcloud_datacenters" "available" {}
+data "hcloud_locations" "available" {}
 
 locals {
   available_server_type_names = [for st in data.hcloud_server_types.available.server_types : st.name]
-  available_location_names    = [for dc in data.hcloud_datacenters.available.datacenters : dc.location.name]
+  available_location_names    = [for l in data.hcloud_locations.available.locations : l.name]
 }
 
 resource "null_resource" "location_validation" {

terraform/examples/wiab-demo-hetzner/versions.tf

@@ -1,7 +1,8 @@
 terraform {
   required_providers {
     hcloud = {
-      source = "hetznercloud/hcloud"
+      source  = "hetznercloud/hcloud"
+      version = "~> 1.70"
     }
   }
   required_version = "~> 1.1"

terraform/examples/wiab-staging-hetzner/main.tf

@@ -25,12 +25,12 @@ variable "medium_server_type" {
 
 # Get available server types and locations
 data "hcloud_server_types" "available" {}
-data "hcloud_datacenters" "available" {}
+data "hcloud_locations" "available" {}
 
 # Validate the exact combination requested by the deployment script.
 locals {
   available_server_type_names = [for st in data.hcloud_server_types.available.server_types : st.name]
-  available_location_names    = [for dc in data.hcloud_datacenters.available.datacenters : dc.location.name]
+  available_location_names    = [for l in data.hcloud_locations.available.locations : l.name]
 }
 
 resource "null_resource" "location_validation" {

terraform/examples/wiab-staging-hetzner/versions.tf

@@ -1,7 +1,8 @@
 terraform {
   required_providers {
     hcloud = {
-      source = "hetznercloud/hcloud"
+      source  = "hetznercloud/hcloud"
+      version = "~> 1.70"
     }
   }
   required_version = "~> 1.1"

terraform/examples/wire-server-deploy-offline-hetzner/main.tf

@@ -29,12 +29,12 @@ variable "medium_server_type" {
 
 # Get available server types and locations
 data "hcloud_server_types" "available" {}
-data "hcloud_datacenters" "available" {}
+data "hcloud_locations" "available" {}
 
 # Validate the exact combination requested by the deployment script.
 locals {
   available_server_type_names = [for st in data.hcloud_server_types.available.server_types : st.name]
-  available_location_names    = [for dc in data.hcloud_datacenters.available.datacenters : dc.location.name]
+  available_location_names    = [for l in data.hcloud_locations.available.locations : l.name]
 }
 
 resource "null_resource" "location_validation" {

terraform/examples/wire-server-deploy-offline-hetzner/setup_nodes.yml

@@ -1,4 +1,20 @@
 ---
+- name: Wait for adminhost private SSH
+  hosts: adminhost
+  gather_facts: no
+  tasks:
+    - name: Wait for SSH on public adminhost
+      wait_for_connection:
+        timeout: 300
+        delay: 5
+
+    - name: Wait until adminhost private IP is reachable from public adminhost
+      wait_for:
+        host: "{{ hostvars['adminhost_local'].ansible_host }}"
+        port: 22
+        timeout: 300
+        delay: 5
+
 - name: Setup adminhost with dnsmasq and Docker
   hosts: adminhost_local
   become: yes

terraform/examples/wire-server-deploy-offline-hetzner/versions.tf

@@ -1,7 +1,8 @@
 terraform {
   required_providers {
     hcloud = {
-      source = "hetznercloud/hcloud"
+      source  = "hetznercloud/hcloud"
+      version = "~> 1.70"
     }
   }
   required_version = "~> 1.1"

values/fake-aws-s3/demo-secrets.example.yaml

@@ -0,0 +1,6 @@
+# Disable since prod should use an externally provided minio
+minio:
+  users:
+    - accessKey: dummykey
+      secretKey: dummysecret
+      policy: consoleAdmin

values/fake-aws-s3/demo-values.example.yaml

@@ -0,0 +1,8 @@
+enabled: true
+minio:
+  image:
+    repository: quay.io/wire/mirror-images/minio/minio
+    tag: RELEASE.2023-07-07T07-13-57Z
+  mcImage:
+    repository: quay.io/wire/mirror-images/minio/mc
+    tag: RELEASE.2023-06-28T21-54-17Z

values/fake-aws-s3/prod-values.example.yaml

@@ -0,0 +1,9 @@
+# Disable since prod should use an externally provided minio
+enabled: false
+minio:
+  image:
+    repository: quay.io/wire/mirror-images/minio/minio
+    tag: RELEASE.2023-07-07T07-13-57Z
+  mcImage:
+    repository: quay.io/wire/mirror-images/minio/mc
+    tag: RELEASE.2023-06-28T21-54-17Z

values/fake-aws/demo-secrets.example.yaml

@@ -1,4 +1,3 @@
-# Disable since prod should use an externally provided minio
 fake-aws-s3:
   enabled: true
   minio:

values/fake-aws/demo-values.example.yaml

@@ -1,3 +1,9 @@
-# Disable since prod should use an externally provided minio
 fake-aws-s3:
   enabled: true
+  minio:
+    image:
+      repository: quay.io/wire/mirror-images/minio/minio
+      tag: RELEASE.2023-07-07T07-13-57Z
+    mcImage:
+      repository: quay.io/wire/mirror-images/minio/mc
+      tag: RELEASE.2023-06-28T21-54-17Z

values/fake-aws/prod-values.example.yaml

@@ -1,3 +1,10 @@
 # Disable since prod should use an externally provided minio
 fake-aws-s3:
   enabled: false
+  minio:
+    image:
+      repository: quay.io/wire/mirror-images/minio/minio
+      tag: RELEASE.2023-07-07T07-13-57Z
+    mcImage:
+      repository: quay.io/wire/mirror-images/minio/mc
+      tag: RELEASE.2023-06-28T21-54-17Z

values/reaper/demo-values.example.yaml

@@ -1,6 +1,4 @@
 image:
   registry: docker.io
-  # Override kubectl image to use available version in bitnamilegacy
-  # Using the last available version in 1.32.x series
-  repository: bitnamilegacy/kubectl
-  tag: 1.32.4
+  repository: alpine/kubectl
+  tag: 1.36.3

values/reaper/prod-values.example.yaml

@@ -1,6 +1,4 @@
 image:
   registry: docker.io
-  # Override kubectl image to use available version in bitnamilegacy
-  # Using the last available version in 1.32.x series
-  repository: bitnamilegacy/kubectl
-  tag: 1.32.4
+  repository: alpine/kubectl
+  tag: 1.36.3

values/sftd/demo-values.example.yaml

@@ -4,9 +4,9 @@ replicaCount: 1
 joinCall:
   replicaCount: 1
   image:
-    repository: docker.io/bitnamilegacy/nginx
+    repository: nginxinc/nginx-unprivileged
     pullPolicy: IfNotPresent
-    tag: "1.27.3-debian-12-r5"
+    tag: "1.29.5-alpine3.23-perl"
 tls:
   issuerRef:
     name: letsencrypt-http01

values/sftd/prod-values.example.yaml

@@ -15,9 +15,9 @@ joinCall:
 # replicaCount = 1 is to support the simple wiab-staging solution
   replicaCount: 1
   image:
-    repository: docker.io/bitnamilegacy/nginx
+    repository: nginxinc/nginx-unprivileged
     pullPolicy: IfNotPresent
-    tag: "1.27.3-debian-12-r5"
+    tag: "1.29.5-alpine3.23-perl"
 
 # Uncomment to enable SFT to SFT communication for federated calls
 # multiSFT: