release: prepare 17.0.0

.circleci/config.yml

@@ -78,11 +78,14 @@ references:
           persistence:
             size: 10Gi
 
-      minio:
-        persistence:
-          size: 10Gi
+      rustfs:
+        storageclass:
+          dataStorageSize: 10Gi
       rabbitmq-ha:
         replicaCount: 1
+        image:
+          repository: bitnamilegacy/rabbitmq
+          tag: "3.8.5"
         ulimitNofiles: 32768
 
   qa_automation_image: &qa_automation_image
@@ -327,9 +330,10 @@ references:
     steps:
       - <<: *attach_workspace
       - <<: *doctl_authenticate
-      - codacy/run_skip_ssh:
-          cmd_name: Install Codacy
-          cmd: make -e -C .do/ deploy_to_doks_from_chartmuseum VERSION=$(cat .version)
+      - run:
+          name: Install Codacy
+          no_output_timeout: 30m
+          command: make -e -C .do/ deploy_to_doks_from_chartmuseum VERSION=$(cat .version) LISTENER_REPLICAS=1
 
   helm_push: &helm_push
     steps:
@@ -347,7 +351,16 @@ references:
             helm dep build ./codacy
             echo "Adding 'https://charts.codacy.com/${CHANNEL}'"
             helm repo add --username "${CHARTS_REPO_USER}" --password "${CHARTS_REPO_PASS}" ${HELM_REPOSITORY} https://charts.codacy.com/${CHANNEL}
-            helm push ./codacy ${HELM_REPOSITORY}
+            echo "Removing existing chart version from chart museum (if present)..."
+            curl -s -u "${CHARTS_REPO_USER}:${CHARTS_REPO_PASS}" -X DELETE "https://charts.codacy.com/${CHANNEL}/api/charts/codacy/$(cat .version)" || true
+            # The bundled helm-push 0.9.0 fails on a v1 parent chart (ours)
+            # depending on a v2 subchart (rustfs) - it loads v1 parents with
+            # an old Helm 2 library that can't read v2 subcharts
+            # (chartmuseum/helm-push#93). Fixed and renamed to cm-push in
+            # v0.10.0+.
+            helm plugin uninstall push || true
+            helm plugin install https://github.com/chartmuseum/helm-push --version v0.10.4
+            helm cm-push ./codacy ${HELM_REPOSITORY}
       - <<: *persist_to_workspace
 
   qa_job: &qa_job
@@ -507,6 +520,56 @@ jobs:
           command: cat .version
       - <<: *persist_to_workspace
 
+  tag_version_ssh:
+    <<: *default_doks_image
+    parameters:
+      version:
+        type: string
+        default: ""
+      force:
+        type: boolean
+        default: false
+    steps:
+      - <<: *attach_workspace
+      - add_ssh_keys:
+          fingerprints:
+            - "df:83:d7:c7:d5:79:06:c2:3b:d1:fd:e2:a3:d1:12:c5"
+      - run:
+          name: Setup SSH
+          command: ssh-keyscan github.com >> ~/.ssh/known_hosts
+      - run:
+          name: Set Git Config
+          command: |
+            git config --global user.email "circleci@codacy.com"
+            git config --global user.name "CircleCI"
+            git remote set-url origin git@github.com:codacy/chart.git
+      - run:
+          name: Fetch Tags
+          command: git fetch --tags
+      - run:
+          name: Tag
+          command: |
+            TAG="<< parameters.version >>"
+            if [ -z "$TAG" ]; then
+              TAG=$(cat .version)
+            fi
+            if [ "<< parameters.force >>" = "true" ]; then
+              git tag -f "$TAG"
+              git push origin -f "refs/tags/$TAG"
+            else
+              git tag "$TAG"
+              git push origin "refs/tags/$TAG"
+            fi
+
+  tests_start:
+    docker:
+      - image: codacy/ci-base:1.0.1
+    working_directory: ~/workdir/
+    steps:
+      - run:
+          name: All microk8s installs are green
+          command: echo "microk8s install jobs finished successfully - starting QA tests"
+
   build_docs:
     docker:
       - image: circleci/python:3.8
@@ -746,20 +809,28 @@ workflows:
           requires:
             - helm_push_incubator
 
+      - tests_start:
+          requires:
+            - deploy_to_doks_release
+            - install_k8s-1.30_helm-3.16.3
+            - install_k8s-1.31_helm-3.16.3
+            - install_k8s-1.32_helm-3.19.0
+            - install_k8s-1.33_helm-3.19.0
+
       - test_api:
           context: CodacyAWS
           requires:
-            - deploy_to_doks_release
+            - tests_start
 
       - test_apiv3:
           context: CodacyAWS
           requires:
-            - deploy_to_doks_release
+            - tests_start
 
       - test_check_cookies_expired_releases_k8s:
           context: CodacyAWS
           requires:
-            - deploy_to_doks_release
+            - tests_start
 
       - test_web:
           context: CodacyAWS
@@ -787,10 +858,7 @@ workflows:
           type: approval
           context: CodacyDO
           requires:
-            - install_k8s-1.30_helm-3.16.3
-            - install_k8s-1.31_helm-3.16.3
-            - install_k8s-1.32_helm-3.19.0
-            - install_k8s-1.33_helm-3.19.0
+            - tests_start
       # Intentionally does not depend on the QA test jobs so that a manual
       # approval path to the deploy remains available even if any of them fail.
       - manual_solutions_eng_hold:
@@ -806,7 +874,7 @@ workflows:
           requires:
             - manual_qa_hold
             - manual_solutions_eng_hold
-      - codacy/tag_version:
+      - tag_version_ssh:
           name: tag_version
           context: CodacyDO
           requires:
@@ -820,7 +888,7 @@ workflows:
           target_charts_repo_url: "https://charts.codacy.com/stable"
           requires:
             - tag_version
-      - codacy/tag_version:
+      - tag_version_ssh:
           name: tag_version_latest
           context: CodacyDO
           version: latest

.do/Makefile

@@ -3,17 +3,18 @@ GRAFANA_URL?="https://grafana.k8s.dev.codacy.org"
 RELEASE_NAME?="codacy"
 NAMESPACE?="codacy"
 HELM_REPOSITORY?=codacy-incubator
-DEPLOYMENTS?=$(shell kubectl get deployments -n "${NAMESPACE}" | awk '{print $$1}' | tail -n +2 | grep -v minio)
+DEPLOYMENTS?=$(shell kubectl get deployments -n "${NAMESPACE}" | awk '{print $$1}' | tail -n +2 | grep -v rustfs)
 WORKER_VERSION?=$(shell grep "engine" -A 2 ../codacy/requirements.lock | grep version | cut -d : -f 2 | tr -d '[:blank:]')
 HELM_INSTALL_EXTRA_FLAGS ?= ""
 SHELL := /bin/bash # we need this for the extra args in `call_helm_install`
 ENVIRONMENT?=dev
+LISTENER_REPLICAS?=1
 
 define call_helm_install
 	eval "extra_args=($$HELM_INSTALL_EXTRA_FLAGS)"; \
 	helm upgrade --install ${1} ${3} \
 	--atomic \
-	--timeout=900s \
+	--timeout=2400s \
 	-f ../codacy/values-production.yaml \
 	-f values.yaml \
 	--namespace ${2} \
@@ -33,13 +34,14 @@ define call_helm_install
 	--set global.crow.config.passwordAuth.password=$${CROW_PASSWORD} \
 	--set rabbitmq.image.repository=bitnamilegacy/rabbitmq \
 	"$${extra_args[@]}"
+	kubectl scale deploy --replicas=${LISTENER_REPLICAS} -n ${2} codacy-listener
 endef
 
 define call_helm_install_infrastructure
 	eval "extra_args=($$HELM_INSTALL_EXTRA_FLAGS)"; \
 	helm upgrade --install ${1} ${3} \
 	--atomic \
-	--timeout=600s \
+	--timeout=1200s \
 	-f ../codacy/values-production.yaml \
 	-f values.yaml \
 	--namespace ${2} \
@@ -60,16 +62,27 @@ endef
 setup_helm_repos:
 	$(MAKE) -C ../ setup_helm_repos
 
+.PHONY: ensure_modern_helm
+ensure_modern_helm:
+	# codacy/ci-do bakes in helm v3.2.1 (2020), whose template parser cannot
+	# read modern apiVersion v2 charts with multi-line template actions (e.g.
+	# the rustfs dependency) - fails with "parse error ...: unclosed action".
+	# Replace it with a current build before installing anything.
+	curl -fsSL https://get.helm.sh/helm-v3.19.0-linux-amd64.tar.gz | tar xz -C /tmp
+	mv /tmp/linux-amd64/helm /usr/local/bin/helm
+	rm -rf /tmp/linux-amd64
+	helm version --short
+
 .PHONY: helm_install_infrastructure
-helm_install_infrastructure:
+helm_install_infrastructure: ensure_modern_helm
 	$(call call_helm_install_infrastructure,${RELEASE_NAME},${NAMESPACE},../codacy/,${CODACY_URL},sh-${WORKER_VERSION},${ENVIRONMENT})
 
 .PHONY: helm_install_from_local_dir
-helm_install_from_local_dir: update_ingress_values
+helm_install_from_local_dir: update_ingress_values ensure_modern_helm
 	$(call call_helm_install,${RELEASE_NAME},${NAMESPACE},../codacy/,${CODACY_URL},sh-${WORKER_VERSION},${ENVIRONMENT})
 
 .PHONY: helm_install_from_chart_museum
-helm_install_from_chart_museum: update_ingress_values
+helm_install_from_chart_museum: update_ingress_values ensure_modern_helm
 	$(call call_helm_install,${RELEASE_NAME},${NAMESPACE},${HELM_REPOSITORY}/codacy --version ${VERSION},${CODACY_URL},sh-${WORKER_VERSION},${ENVIRONMENT})
 
 .PHONY: update_dependencies
@@ -85,10 +98,17 @@ update_ingress_values:
 deploy_to_doks_infrastructure: set_cluster_context update_dependencies helm_install_infrastructure
 
 .PHONY: deploy_to_doks_from_local_dir
-deploy_to_doks_from_local_dir: set_cluster_context update_dependencies helm_install_from_local_dir
+deploy_to_doks_from_local_dir: set_cluster_context update_dependencies clean_jobs helm_install_from_local_dir
+
+.PHONY: clean_jobs
+clean_jobs:
+	-kubectl delete jobs -l app.kubernetes.io/instance=${RELEASE_NAME} --namespace ${NAMESPACE} --ignore-not-found=true
+	-kubectl delete jobs -l release=${RELEASE_NAME} --namespace ${NAMESPACE} --ignore-not-found=true
 
 .PHONY: deploy_to_doks_from_chartmuseum
-deploy_to_doks_from_chartmuseum: set_cluster_context setup_helm_repos helm_install_from_chart_museum
+deploy_to_doks_from_chartmuseum: set_cluster_context setup_helm_repos
+	-$(MAKE) clean_jobs
+	$(MAKE) helm_install_from_chart_museum || ($(MAKE) clean_jobs && $(MAKE) helm_install_from_chart_museum)
 
 .PHONY: set_cluster_context
 set_cluster_context:

.do/db-cluster/Makefile

@@ -64,6 +64,7 @@ replace_db_values:
 	@sed -i "s/postgresqlDatabase: crow/postgresqlDatabase: \"crow?sslmode=require\"/g" ../../codacy/values-production.yaml
 	@sed -i "s/<--- codacy-db-username --->/$(username)/g; s/<--- codacy-db-password --->/$(password)/g; s/<--- codacy-db-host --->/$(host)/g; s/<--- codacy-db-port --->/$(port)/g;" ../values.yaml
 	@sed -i "s/postgresqlDatabase: crow/postgresqlDatabase: \"crow?sslmode=require\"/g" ../values.yaml
+	@sed -i "s/\.a\./\.d\./g;" ../../codacy/values-production.yaml
 	@echo "Replaced template values for db connections"
 
 .PHONY: tf_init

.do/nfs-patch.yaml

@@ -0,0 +1,10 @@
+spec:
+  template:
+    spec:
+      replicas: 1
+      containers:
+        - name: nfsserverprovisioner
+          command:
+            - /bin/sh
+            - -c
+            - ulimit -n 65536 && exec /nfs-provisioner

.do/values.yaml

@@ -107,7 +107,7 @@ remote-provider-service:
       enabled: true
 
 listener:
-  replicaCount: 1
+  replicaCount: 0
   listenerdb:
     create: false
   persistence:
@@ -178,7 +178,6 @@ rabbitmq-ha:
             description: |
               No Rabbitmq Nodes
 
-minio:
-  persistence:
-    enabled: true
-    size: 40Gi
+rustfs:
+  storageclass:
+    dataStorageSize: 40Gi

Makefile

@@ -1,7 +1,8 @@
 .PHONY: setup_helm_repos
 setup_helm_repos:
 	# Add legacy Bitnami snapshot repo used by requirements.yaml (apiVersion v1)
-	helm repo add stable https://charts.helm.sh/stable
+	helm repo add bitnami-pre-2022 https://raw.githubusercontent.com/bitnami/charts/defb094c658024e4aa8245622dab202874880cbc/bitnami # Github tag before bitnami truncated the index. Old link didn't work anymore
+	helm repo add rustfs https://charts.rustfs.com
 	helm repo add codacy-stable https://charts.codacy.com/stable
 	helm repo add codacy-unstable https://charts.codacy.com/unstable
 	helm repo add codacy-incubator https://charts.codacy.com/incubator

README.md

@@ -31,7 +31,7 @@ Some of these repositories are private and accessible to Codacy engineers only.
 ![Helm Chart Structure](https://raw.githubusercontent.com/codacy/chart/master/docs/images/charts.png)
 [edit image](https://docs.google.com/drawings/d/1o7z3L8XnnNjHBOTWKHiIYUkBP3DDiogdUyxNdUfzyfY/edit)
 
--   [MinIO](https://github.com/minio/charts/tree/master)
+-   [RustFS](https://github.com/rustfs/rustfs/tree/main/helm/rustfs)
 -   [RabbitMQ-HA](https://github.com/helm/charts/tree/master/stable/rabbitmq-ha)
 -   [PostgreSQL](https://github.com/bitnami/charts/tree/master/bitnami/postgresql)
 -   [kube-fluentd-operator](https://github.com/codacy/kube-fluentd-operator)
@@ -61,7 +61,7 @@ Global parameters apply to all sub-charts and make it easier to configure resour
 | `global.filestore.contentsSecret`                                | Secrets used internally for encryption. Generate one with \`openssl rand -base64 128 \| tr -dc 'a-zA-Z0-9'\` | `nil`                                        |
 | `global.filestore.uuidSecret`                                    | Secrets used internally for encryption. Generate one with \`openssl rand -base64 128 \| tr -dc 'a-zA-Z0-9'\` | `nil`                                        |
 | `global.cacheSecret`                                             | Secrets used internally for encryption. Generate one with \`openssl rand -base64 128 \| tr -dc 'a-zA-Z0-9'\` | `nil`                                        |
-| `global.minio.create`                                            | Create minio internally                                                                                      | `nil`                                        |
+| `global.minio.create`                                            | Create the bundled RustFS object store internally                                                            | `nil`                                        |
 | `global.rabbitmq.create`                                         | Create rabbitmq internally                                                                                   | `nil`                                        |
 | `global.rabbitmq.rabbitmqUsername`                               | Username for rabbitmq. If you are using the bundled version, change the `rabbitmq-ha.rabbitmqUsername` also. | `nil`                                        |
 | `global.rabbitmq.rabbitmqPassword`                               | Password for rabbitmq. If you are using the bundled version, change the `rabbitmq-ha.rabbitmqPassword` also. | `nil`                                        |
@@ -214,7 +214,7 @@ The following parameters refer to components that are not internal to Codacy, bu
 | Parameter                          | Description                                                                                                           | Default           |
 | ---------------------------------- | --------------------------------------------------------------------------------------------------------------------- | ----------------- |
 | `fluentdoperator.enable`           | Enable fluentd operator. It gathers logs from Codacy so that you can send it to our support if needed.                | `true`            |
-| `fluentdoperator.expirationDays`   | Number of days to retain logs. More time uses more disk on minio and retention over 7 days is not recommended.        | `7`               |
+| `fluentdoperator.expirationDays`   | Number of days to retain logs. More time uses more disk on the object store and retention over 7 days is not recommended. | `7`               |
 | `fluentdoperator.flushTimeout`     | Maximum time until Fluentd stops retrying to flush the logs. Values must be expressed using a unit, e.g. `10s`, `5h`. | `1h`              |
 | `rabbitmq-ha.rabbitmqUsername`     | Username for the bundled RabbitMQ.                                                                                    | `rabbitmq-codacy` |
 | `rabbitmq-ha.rabbitmqPassword`     | Password for the bundled RabbitMQ.                                                                                    | `rabbitmq-codacy` |

codacy/Chart.yaml

@@ -4,6 +4,6 @@ description: |
   This is the top level chart to run Codacy in self-hosted mode.
   With this chart, it is possible to run all the components from Codacy,
   plugs all the dependencies with a single command line, including Codacy,
-  PostgreSQL, RabbitMQ, Minio, Ingress etc...
+  PostgreSQL, RabbitMQ, RustFS, Ingress etc...
 name: codacy
 version: 0.1.1

codacy/requirements-dev.yaml

@@ -1,9 +1,9 @@
 dependencies:
-- name: minio
-  version: 5.0.33
-  repository: https://charts.helm.sh/stable
+- name: rustfs
+  version: 1.0.3
+  repository: https://charts.rustfs.com
   condition: global.minio.create
-  alias: minio
+  alias: rustfs
 
 - name: rabbitmq
   version: 7.5.7