Skip to content

Wpb 23988 fix internet access wiab stag #881

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mohitrajain merged 16 commits into from
Apr 2, 2026
Merged

Wpb 23988 fix internet access wiab stag #881

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
16 commits
Select commit Hold shift + click to select a range
b1a13ab
fix: wpb-23988 sync wire-server helm chart values for wiab-dev from p…
mohitrajain Mar 12, 2026
652b5dc
fix: wpb-23988 fix the changelog verification workflow to consider th…
mohitrajain Mar 12, 2026
4af5a98
fix: wpb-23988 remove the changelog trigger for every push operation
mohitrajain Mar 12, 2026
c47f96d
add: wpb-23988 variable private_deployment with default true to disab…
mohitrajain Mar 17, 2026
6894038
fix: wpb-23988 cert_master_email env var
mohitrajain Mar 17, 2026
0100f78
fix: wpb-23988 running wiab-staging-nftables.yaml playbook is explicit
mohitrajain Mar 17, 2026
d89ea79
fix: wpb-23988 wiab-staging.md documentation to add details about def…
mohitrajain Mar 17, 2026
9a6ef75
fix: wpb-23988 add changelog
mohitrajain Mar 17, 2026
b5f7858
fix: wpb-23988 update the wiab-staging.md to improve documentation ar…
mohitrajain Mar 18, 2026
79a1fba
fix: wpb-23988 update the artifact hash
mohitrajain Mar 18, 2026
807c14c
Apply suggestions from code review
mohitrajain Mar 24, 2026
af9ba0e
fix: wpb-24291 update the documentation for wiab-staging
mohitrajain Mar 24, 2026
b56f8b2
fix wpb-24291: fix the minio endpoint for s3 endpoint
mohitrajain Mar 25, 2026
56a624c
fix wpb-23988: fix the logic in wiab_server_nftables.conf.j2 and upda…
mohitrajain Mar 27, 2026
f5f5d62
fix wpb-23988: upgrade documentation and small fixes for inventory
mohitrajain Mar 27, 2026
4219879
Wpb 23988 disable smallstep (#882)
mohitrajain Apr 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .github/workflows/changelog-verify.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,8 @@ name: Changelog verification
on:
pull_request:
branches: ["**"]
push:
branches: ["master"]

permissions:
contents: read
Expand Down
2 changes: 2 additions & 0 deletions ansible/files/wiab_server_nftables.conf.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,7 +67,9 @@ table ip nat {
chain POSTROUTING {
type nat hook postrouting priority 100;
oifname != docker0 ip saddr 172.17.0.0/16 counter masquerade
{% if not (private_deployment | default(true) | bool) %}
oifname $INF_WAN counter masquerade comment "{{ wire_comment }} masquerade outgoing traffic"
{% endif %}
}
chain DOCKER {
iifname docker0 counter return
Expand Down
1 change: 0 additions & 1 deletion ansible/inventory/demo/host.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,6 @@ wiab:
- databases-ephemeral
- postgresql
- reaper
- smallstep-accomp
- wire-server
- webapp
- account-pages
Expand Down
4 changes: 3 additions & 1 deletion ansible/inventory/demo/wiab-staging.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,4 +6,6 @@ wiab-staging:
ansible_user: 'demo'
ansible_ssh_private_key_file: "~/.ssh/id_ed25519"
vars:
artifact_hash: 2200257f7a528f3a8157e8878fc7ee1c945594d1
artifact_hash: 7da2319729ba792f91d7ccba4e026c21cd3a3691
# when enabled, disable WAN SNAT/masquerading for VMs on the private network
private_deployment: true
3 changes: 1 addition & 2 deletions ansible/wiab-staging-provision.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -298,9 +298,8 @@
kubenode2_ip: "{{ kubenode_ip_result.results[1].stdout }}"
kubenode3_ip: "{{ kubenode_ip_result.results[2].stdout }}"
wire_comment: "wiab-stag"

tags: always

- name: Configure nftables
import_playbook: ./wiab-staging-nftables.yaml
tags: nftables
tags: [never, nftables]
6 changes: 3 additions & 3 deletions bin/helm-operations.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ set -Eeo pipefail
# Read values from environment variables with defaults
BASE_DIR="${BASE_DIR:-/wire-server-deploy}"
TARGET_SYSTEM="${TARGET_SYSTEM:-example.com}"
CERT_MASTER_EMAIL="certmaster@${CERT_MASTER_EMAIL}:-certmaster@${TARGET_SYSTEM}"
CERT_MASTER_EMAIL="${CERT_MASTER_EMAIL:-certmaster@example.com}"

# DEPLOY_CERT_MANAGER env variable is used to decide if cert_manager and nginx-ingress-services charts should get deployed
# default is set to TRUE to deploy it unless changed
Expand Down Expand Up @@ -60,7 +60,7 @@ process_values() {

ENV=$1
TYPE=$2
charts=(fake-aws smtp rabbitmq databases-ephemeral reaper wire-server webapp account-pages team-settings smallstep-accomp ingress-nginx-controller nginx-ingress-services coturn sftd cert-manager)
charts=(fake-aws smtp rabbitmq databases-ephemeral reaper wire-server webapp account-pages team-settings ingress-nginx-controller nginx-ingress-services coturn sftd cert-manager)

if [[ "$ENV" != "prod" ]] || [[ -z "$TYPE" ]] ; then
echo "Error: This function only supports prod deployments with TYPE as values or secrets. ENV must be 'prod', got: '$ENV' and '$TYPE'"
Expand Down Expand Up @@ -214,7 +214,7 @@ sync_pg_secrets
configure_values

# deploying with external datastores, useful for prod setup
deploy_charts cassandra-external elasticsearch-external minio-external postgresql-external fake-aws smtp rabbitmq-external databases-ephemeral reaper wire-server webapp account-pages team-settings smallstep-accomp ingress-nginx-controller
deploy_charts cassandra-external elasticsearch-external minio-external postgresql-external fake-aws smtp rabbitmq-external databases-ephemeral reaper wire-server webapp account-pages team-settings ingress-nginx-controller

# deploying cert-manager only when the env var DEPLOY_CERT_MANAGER is set to TRUE
if [[ "$DEPLOY_CERT_MANAGER" == "TRUE" ]]; then
Expand Down
1 change: 1 addition & 0 deletions changelog.d/3-deploy-builds/disable-smallstep
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Fixed: stop deploying smallstep in wiab-staging and wiab-dev environments
5 changes: 5 additions & 0 deletions changelog.d/3-deploy-builds/wiab-stag-nftables-snat-fix
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
Added: variable private_deployment with default true to disable SNAT on adminhost
Copy link

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changelog says private_deployment has a default of true, but the nftables template currently uses default(false) when the variable is unset (SNAT enabled by default unless explicitly set). Consider adjusting either the implementation or this entry so the stated default matches actual behavior.

Suggested change
Added: variable private_deployment with default true to disable SNAT on adminhost
Added: variable private_deployment (default false) to optionally disable SNAT on adminhost (SNAT enabled by default unless explicitly set)

Copilot uses AI. Check for mistakes.
Fixed: cert_master_email env var parsing in helm-operations.sh
Fixed: made running wiab-staging-nftables.yaml playbook explicit
Added: wiab-staging.md documentation to add details about default SNAT access being denied and how to enable it
Added: wiab-staging.md network flow diagram
264 changes: 191 additions & 73 deletions offline/wiab-staging.md
View file
Open in desktop

Large diffs are not rendered by default.

Loading