Table of Contents

Build & push docker image

Please follow below guide after the tech team has cut the new release. You need to be authorized to push the image to docker.sunet.se, see this.

git clone https://github.com/TheIdentitySelector/thiss-js
git checkout <version-to-be-released>
make docker && make docker_push_sunet

Beta deployment (use.thiss.io)

Frontend

To deploy <version> to beta (use.thiss.io)

Clone the git repository in your computer (git@github.com:TheIdentitySelector/thiss-ops.git)
Open cosmos-rules.yaml, check the 'max-age' under 'cache_control'. If the current max age is 1 hour, you need to change it to zero 1 hour before the deployment. If it is one day, you need to change it to zero exactly 1 day before. We need to do it so the browsers old cache gets cleared and new files are requested from Fastly during the deployment.
Log into Fastly management web GUI https://manage.fastly.com/ and purge all cache for the service 'use.thiss.io'
Wait as long as the old 'max-age' and then proceed to the next step. Befor you do that, you can check in the 'developer tools' of your browser (e.g. Chrome, Firefox) that the old cache has been cleared and the new files have max-age=0 in their response header now.**screenshot**
Update the ds_version under thiss::static.

Code Block

language	bash

'^static-[0-9]+\.thiss\.io$':
   sunet_iaas_cloud:
   thiss::dockerhost:
      version: '5:19.03.13~3-0~ubuntu-focal'
   thiss::static:
      ds_version: 1.6.3
      base_url: https://use.thiss.io/
      mdq_search_url: https://md.thiss.io/entities/
      domain: use.thiss.io
      context: thiss.io
      cache_control: 'public, max-age=3601, must-revalidate, s-maxage=3601, proxy-revalidate'
   https:

Do git add global/overlay/etc/puppet/cosmos-rules.yaml and git commit. You should ofcourse have right to commit in the repository.
Run the script thiss-ops/bump-tag afterwards.
To verify that the new version is installed, log in to the servers static-1.thiss.io and static-2.thiss.io and enter 'run-cosmo -v'.
You can check the status by running the command service docker-thiss_js status.
You can also enter 'docker ps' in order to see if the new version is present on docker image tag.
After the verification step is done, everything looks good and few hours have passed open cosmos-rules.yaml and change 'max-age' under 'cache_control' to original value.

Verification

Verify that the changes have taken effect - this may take a while depending on how quickly the CDN picks up the changes. Find out which changes should be tested, check with the developer team or technical lead Leif Johansson. In addition to that, it should be checked that the discovery service works by visiting https://use.thiss.io. It is good to do it in a private window of your browser in case your browser has cached the old version. Click on the 'Login' button and see that it is possible to choose different IDPs from there. Check that the persistent service works by going back and choosing different organizations. You should be able to see the list of organizations that you have chosen and be able to edit them as well. Check that these functions work. https://use.thiss.io/manifest.json is supposed to show the latest version number. You can check the login works through https://demo.beta.seamlessaccess.org as well.

Rollback

In order to rollback simply downgrade the version in cosmos-rules.yaml and follow the exact steps for committing and pushing the the changes to the git remote repo.

Backend

Clone the git repository in your computer (git@github.com:TheIdentitySelector/thiss-ops.git)
Update the ds_version under thiss::mdq for both 'md-1.thiss.io' and 'md-2.thiss.io'

Code Block

md-1.thiss.io:
   sunet_iaas_cloud:
   thiss::dockerhost:
      version: '5:20.10.12~3-0~ubuntu-bionic'
   thiss::mdq:
      version: 1.3.2
      src: https://a-1.thiss.io/metadata.json
      base_url: https://md.thiss.io
      post: /usr/sbin/service docker-thiss_mdq restart
   https:
   http:

Do git add global/overlay/etc/puppet/cosmos-rules.yaml and git commit. You should ofcourse have right to commit in the repository.
Run the script thiss-ops/bump-tag afterwards.
To verify that the new version is installed, log in to the servers md-1.thiss.io and md-2.thiss.io and enter 'run-cosmo -v'.
You can check the status by running the command service docker-thiss_mdq status.
You can also enter 'docker ps' in order to see if the new version is present on docker image tag.

Verification

Check that https://md.thiss.io is up and showing the right version. Keep an eye on the metadata check alarm on the internal Nagios instance https://monitor.seamlessaccess.org

Rollback

Simply undo the changes and go back to old changes and commit them in thiss-ops repository.

Production deployment (service.seamlessaccess.org)

Frontend

The current whitelist needs to be checked with the master list before each deploy. Note that use.thiss.io does not do whitelisting which means the WHITELIST variable is not set.

To deploy <version> to production (service.seamlessaccess.org)

Clone the git repository in your computer (git@github.com:TheIdentitySelector/thiss-ops.git)

Open global/overlay/etc/hiera/data/common.yaml and check that the whitelist is right or change it if needed.

Warning

title	Whitelisting

It is important to set the WHITELIST environment variable to the comma-separated list of the current whitelisted domains before deploying. Ask Marina or Leif to verify the list. The list is updated here Seamless Access Configuration Parameters.

Open cosmos-rules.yaml, check the 'max-age' under 'cache_control'. If the current max age is 1 hour, you need to change it to zero 1 hour before the deployment. If it is one day, you need to change it to zero exactly 1 day before. We need to do it so the browsers old cache gets cleared and new files are requested from Fastly during the deployment.
Log into Fastly management web GUI https://manage.fastly.com/ and purge all cache for the service 'service.seamlessaccess.org'
Wait as long as the old 'max-age' and then proceed to the next step. Befor you do that, you can check in the 'developer tools' of your browser (e.g. Chrome, Firefox) that the old cache has been cleared and the new files have max-age=0 in their response header now.**screenshot**

Update the ds_version under thiss::static_prod for each site (ntx, se-east, aws1 and aws2)

Code Block

language	bash

'^static-[0-9]\.ntx\.sunet\.eu\.seamlessaccess\.org$':
   thiss::dockerhost:
      version: '5:20.10.6~3-0~ubuntu-focal'
   thiss::static_prod:
      ds_version: 1.6.3
      base_url:

Installing development tools

Building thiss-js and related packages requires node 12.x and npm 6.x. Install using the appropriate package manager.

Ubuntu 18.04

Code Block

language	bash

curl -sL https://deb.nodesource.com/setup_12.x | sudo -E bash -
sudo apt install nodejs

Brew (MacOS)

https://formulae.brew.sh/formula/node@12

service.seamlessaccess.org

Frontend

Prepare your deploy environement. The current whitelist needs to be checked with the master list before each deploy.

To deploy <version> to production

...

language	bash

...

https://service.seamlessaccess.org/

...


      mdq_search_url: https://md.seamlessaccess.org/entities/

...


      domain: service.seamlessaccess.org

...


      context: seamlessaccess.org
      cache_control: 'public, max-age=36000, must-revalidate, s-maxage=604800, proxy-revalidate'

Do git add global/overlay/etc/puppet/cosmos-rules.yaml and git commit. Do git add global/overlay/etc/hiera/data/common.yaml as well if whitelist is changed. You should ofcourse have right to commit in the repository.
Run the script thiss-ops/bump-tag afterwards.
To verify that the new version is installed, log in to below servers and enter 'run-cosmo -v'.

static-1.aws1.geant.eu.seamlessaccess.org
static-1.aws2.geant.eu.seamlessaccess.org
static-1.ntx.sunet.eu.seamlessaccess.org
static-1.se-east.sunet.eu.seamlessaccess.org
static-2.aws1.geant.eu.seamlessaccess.org
static-2.aws2.geant.eu.seamlessaccess.org
static-2.ntx.sunet.eu.seamlessaccess.org
static-2.se-east.sunet.eu.seamlessaccess.org
You can check the status by running the command service docker-thiss_js status.
You can also enter 'docker ps' in order to see if the new version is present on docker image tag.
After the verification step is done, everything looks good and few hours have passed open cosmos-rules.yaml and change 'max-age' under 'cache_control' to original value for all 4 sites.

Verification

The final "git diff" should show a set of differences against the currently deployed version. Now commit and push this version to origin-service:

Code Block

language	bash

git commit && git push

Verify that the changes have taken effect - this may take a while depending on how quickly the CDN picks up the changes. Find out which changes should be tested, check with the developer team or technical lead Leif Johansson.

Backend

Deploying the backend components using standard cosmos-process for docker components.

use.thiss.io

Frontend

Prepare your deploy environement. Note that use.thiss.io does not do whitelisting which means the WHITELIST variable is not set.

Code Block

language	bash

git clone https://github.com/TheIdentitySelector/thiss-js
git clone https://github.com/TheIdentitySelector/origin.thiss.io

To deploy <version> to beta (use.thiss.io)

Code Block

language	bash

cd thiss-js && git pull
git checkout <version>
make clean
make BASE_URL='https://use.thiss.io/' COMPONENT_URL='https://use.thiss.io/cta/' MDQ_URL='https://md.thiss.io/entities/' PERSISTENCE_URL='https://use.thiss.io/ps/' SEARCH_URL='https://md.thiss.io/entities/' STORAGE_DOMAIN='use.this.io' LOGLEVEL='error' DEFAULT_CONTEXT='thiss.io' TARGET='../origin.thiss.io/' build deploy
cd ../origin.thiss.io
git diff

The final "git diff" should show a set of differences against the currently deployed version. Now commit and push this version to origin.thiss.io:

Code Block

language	bash

git commit && git push

Verify that the changes have taken effect - this may take a while depending on how quickly the CDN picks up the changes.

Backend

In addition to that, it should be checked that the discovery service works as usual by trying to login to a service for example wiki.sunet.se. It is good to do it in a private window of your browser in case your browser has cached the old version. https://service.seamlessaccess.org/manifest.json is supposed to show the latest version number. You can check the login works through https://demo.seamlessaccess.org as well.

Rollback

In order to rollback simply downgrade the version in cosmos-rules.yaml and follow the exact steps for committing and pushing the the changes to the git remote repo.

Whitelist Update

If the task is to just update the whitelist, then we are only required to redeploy the software.

Clone the git repository in your computer (git@github.com:TheIdentitySelector/thiss-ops.git)

Open global/overlay/etc/hiera/data/common.yaml and check that the whitelist is right or change it if needed.

Warning

title	Whitelisting

It is important to set the WHITELIST environment variable to the comma-separated list of the current whitelisted domains before deploying. Ask Marina or Leif to verify the list. The list is updated here Seamless Access Configuration Parameters.

Do git add global/overlay/etc/hiera/data/common.yaml as well if whitelist is changed. You should ofcourse have right to commit in the repository.
Run the script thiss-ops/bump-tag afterwards.
Log in to below servers and enter 'run-cosmo -v'. 'thiss-js' docker container should get restarted.

static-1.aws1.geant.eu.seamlessaccess.org
static-1.aws2.geant.eu.seamlessaccess.org
static-1.ntx.sunet.eu.seamlessaccess.org
static-1.se-east.sunet.eu.seamlessaccess.org
static-2.aws1.geant.eu.seamlessaccess.org
static-2.aws2.geant.eu.seamlessaccess.org
static-2.ntx.sunet.eu.seamlessaccess.org
static-2.se-east.sunet.eu.seamlessaccess.org
You can check the status by running the command service docker-thiss_js status.
Log into Fastly management web GUI https://manage.fastly.com/ and purge all cache for the service 'service.seamlessaccess.org' otherwise it will take the amount of seconds set in 's-maxage' in the static servers for the Fastly servers to fetch the updated JSON page.

Verification

https://service.seamlessaccess.org/ps.js should contain the new whitelisted domain. It may take a while to get updated depending on the age of the cache in your browser. It is also good to check that the service is working by visiting https://demo.seamlessaccess.org.

Backend

Clone the git repository in your computer (git@github.com:TheIdentitySelector/thiss-ops.git)

Update the ds_version under thiss::mdq for each site (ntx, se-east, aws1 and aws2)

Code Block

'^md-[0-9]\.ntx\.sunet\.eu\.seamlessaccess\.org$':
   thiss::dockerhost:
   thiss::mdq:
      version: 1.3.2
      src: https://meta.ntx.sunet.eu.seamlessaccess.org/metadata.json
      base_url: https://md.seamlessaccess.org
      post: /usr/sbin/service docker-thiss_mdq restart

Do git add global/overlay/etc/puppet/cosmos-rules.yaml and git commit. You should ofcourse have right to commit in the repository.
Run the script thiss-ops/bump-tag afterwards.
To verify that the new version is installed, log in to below servers and enter 'run-cosmo -v'.
md-1.aws1.geant.eu.seamlessaccess.org
md-1.aws2.geant.eu.seamlessaccess.org
md-1.ntx.sunet.eu.seamlessaccess.org
md-1.se-east.sunet.eu.seamlessaccess.org
md-2.aws1.geant.eu.seamlessaccess.org
md-2.aws2.geant.eu.seamlessaccess.org
md-2.ntx.sunet.eu.seamlessaccess.org
md-2.se-east.sunet.eu.seamlessaccess.org
You can check the status by running the command service docker-thiss_mdq status.
You can also enter 'docker ps' in order to see if the new version is present on docker image tag.

Verification

Check that https://md.seamlessaccess.org is up and showing the right version. Keep an eye on the metadata check alarm on the NagiosXI instance for SUNET NOC, there are checks for each site as well.

Rollback

Simply undo the changes and go back to old changes and commit them in thiss-ops repositoryDeploying the backend components using standard cosmos-process for docker components.

Page tree

Versions Compared

Old Version 7

New Version Current

Key

Build & push docker image

Beta deployment (use.thiss.io)

Frontend

Verification

Rollback

Backend

Production deployment (service.seamlessaccess.org)

Frontend

Installing development tools

Ubuntu 18.04

Brew (MacOS)

service.seamlessaccess.org

Frontend

Verification

Backend

use.thiss.io

Frontend

Backend

Rollback

Whitelist Update

Verification

Backend

Page tree

Page History

Versions Compared

Old Version 7

New Version Current

Key

Build & push docker image

Beta deployment (use.thiss.io)

Frontend

Verification

Rollback

Backend

Production deployment (service.seamlessaccess.org)

Frontend

Installing development tools

Ubuntu 18.04

Brew (MacOS)

service.seamlessaccess.org

Frontend

Verification

Backend

use.thiss.io

Frontend

Backend

Rollback

Whitelist Update

Verification

Backend