Skip to content

ReleaseNotes.md

Latest commit

 

History

History
356 lines (314 loc) · 17.9 KB

ReleaseNotes.md

File metadata and controls

356 lines (314 loc) · 17.9 KB
Raw

gematik

Release Notes DEMIS Kubernetes Environment

Release 5.12.0

  • added new Loki module (infrastructure/service-mesh/loki) as central log receiver, configurable per stage and only deployed together with Grafana
    • deployment topology selectable via service_mesh_loki_deployment_mode (Monolithic or SimpleScalable)
    • storage configurable as local filesystem (default) or external S3
    • services push logs directly via Push-API or native OTLP/HTTP endpoint (no collector)
  • refactored http_timeouts_retries module: standard timeout/retry defaults (common and no-retries) are now defined inside the module
    • The full service list is passed via the new service_names input (keys of deployment_information)
    • any service without an explicit no_retries_services or custom_timeout_retry entry automatically receives the common default, so services using standard settings no longer need explicit per-service definitions
    • added validation to http_timeouts_retries module ensuring the configured timeout is >= perTryTimeout * attempts
    • the validation is computed only from the known configuration inputs (independent of service_names) so an invalid timeout fails already at plan time instead of being deferred to apply
  • added audit log service resource for fhir storage writer service (als-fssw)
  • added appProtocol property to created kubernetes network services
  • added audit log service resource for fhir storage reader service (als-fssr)
  • removed version info in "igsServiceUrl" for S3 endpoint in igs

Release 5.11.0

  • removed feature flag FEATURE_FLAG_SEPARATION_API_VERSION_AND_PROFILE_VERSION, external routing configuration is now applied by default
  • removed FEATURE_FLAG_FHIR_CORE_SPLIT and vs-core + futs-core services
  • removed default profile-snapshots fhir-, ars-, igs-, are-profile-snapshots from deployment project
  • added new object-storage-service as new service for storing and managing object data
  • refactored helm template usage for helm values to accept also yaml files for overriding helm values
  • renamed stage name test-fra to test

Release 5.10.0

  • added new job bulk-inbound-purger for purging old data from bulk-inbound-service
  • added new job ars-purger for purging old data from statistic database
  • added terraform plugin-cache directory
  • changed default keycloak timeout
  • removed feature flag FEATURE_FLAG_NEW_ISTIO_SIDECAR_REQUEST_AND_LIMITS, istio sidecar requests and limits are now set by default
  • fixed misspelled podAnnotations key in redis-cus, pod annotations (including istio sidecar resources) for apply annotations use project feature flag FEATURE_FLAG_NEW_REDIS_CUS_ANNOTATION_HANDLING
  • added FHIR profile version validation to istio_routing_configuration module
  • upgraded terraform providers
    • hashicorp/helm to 3.2.0
    • hashicorp/kubernetes to 3.2.0
    • hashicorp/random to 3.9.0
    • hashicorp/external to 2.4.0
  • enable keycloak debug for teststages
  • fixed typo for local prometheus config & servicename of rabbitMq
  • fixed ARE dockerhub image pull names
  • setup default resources for validation-services with one package in app helm template
  • refactored api versions usage for frontends and gateways

Release 5.9.0

  • added new RabbitMQ user credentials for ARS, Bulk-Inbound-Service and Secure-Message-Gateway
  • fixed ARE ANPS routing configuration
  • fixed templates for validation services (igs and ars) for correct affinity configuration and istio template for bulk-inbound-service
  • fixed missing references to futs-istio resource to be available for other services on deployment
  • documented -m parameter of update-service-local.sh script for patching multiple matching deployments at once
  • added new module for validation service handling, now deployments of validation services depending on profile provisioning mode will be managed by terraform
    • configurations like feature-flags, config-options, resource definitions and timeouts and retries could be addressed to specific validation service by package major version (e.g. validation-service-bedoccupancy:v6 for bedoccupancy package 6.X.X)
    • all futs and validation service modules needs to define profiles in main section with at least one defined package version
  • added improvements of tests on fhir-profile-metadata and helm_deployment modules
  • removed ignoring cronjobs kiali for referencing scheduled jobs
  • fixed ARE Gateway routing configuration

Release 5.8.0

  • added ARE deployment targets for TEST-Stage
  • changed ARE FHIR package name
  • added Helm release for Istio network policies to ARE
  • split futs-core in futs-bedoccupancy, futs-disease and futs-pathogen
  • split validation-service-core in validation-service-bedoccupancy, validation-service-disease and validation-service-pathogen
  • fixed validation for WIF
  • removed CONFIG_OPTION_PACKAGE_REGISTRY_URL from Validation Service and moved to Stage Configuration
  • removed variable enable_native_sidecar_injection
    • now native sidecar injection mode for istio is handled by istio (default true)
  • added mf_logging_enabled variable for enabling logging in microfrontend framework

Release 5.7.0

  • removed dependency for gematik-idp to pg-bouncer in local
  • removed deployment pipelines from project
  • fixed Stage-Parameter for validation Pipeline
  • added encryption keys for in-queue and secure-queue for services BIS, SMG and ARS
  • refactored modules fhir-profile-metadata and maintenance_mode for planning completely resources in application moduls
  • added Validation Service with Delegation for ARE
  • added istio_routing_configurations module for ARE
  • fixed remote backend configuration for ARE deployment
  • fixed Kyverno policies for ARE deployment

Release 5.6.0

  • updated the release pipeline to automatically add new versions
  • modified local cluster deployment to use resource quotas from startup
  • added subnet address variable for services configuration for local cluster and set default value to '10.0.26.0/16'
  • split internal and external virtual service for minio service
  • extended rabbitmq scraping for specific queues
  • refactored infrastructure resources istio, jaeger and prometheus
  • deactivate validateJwt for bundidp-mock
  • refactored resource module for better handling of resource definitions
  • fixed application modules will not be planned caused by pull secrets implementation
  • refactored module istio_routing_configurations for trigger errors on plan
  • upgraded provider hashicorp/kubernets to 3.1.0
  • updated install-/update-tools scripts for use latest terraform-docs version

Release 5.5.0

  • added Kyverno and Policy Reporter Metrics + prometheus scraping annotations
  • added Kyverno Dashboard
  • added Authentication-Policies for idm
  • fixed service annotation for Kyverno
  • handed over the image pull secret to the kyverno policies in all namespaces
  • new batch endpoints in ARS
  • changed REF-FKB postgres host in switchDatabase.sh
  • update Database Pipeline for location switching and add surveillance-pseudonym-service-ars, ars-service to restart list
  • simplified ARS/BIS virtual service configuration
  • changed PROD-FKB postgres host in switchDatabase.sh
  • fixed restart all services for test stages and including handling for dmz and ARE namespaces
  • fixed service dependencies in the dmz namespace
  • added new module istio_routing_configurations for define to create istio routing rules by yaml file
  • added pgbouncer to dependency to ars-service
  • extended install-tools script with python3-pip and python3-venv
  • added -m flag to .scripts/update-service-local.sh to patch multiple matching deployments/cronjobs at once (e.g. all variants of a service like validation-service-*)
  • fixed HTTP method matching in Istio routing rule generation (istio_routing_configurations module now correctly applies method filter in match blocks)
  • add ARE Setup

Release 5.4.0

  • Added ResourceQuota configuration for namespaces
  • fixed wrong namespace module name in idm
  • removed feature flag FEATURE_FLAG_NEW_API_ENDPOINTS and related configurations
  • upgraded provider hashicorp/random to 3.8.1
  • enable ResourceQuota admission plugin in KIND cluster

Release 5.3.1

  • reverted removed ff NEW_API_ENDPOINTS for portal-igs

Release 5.3.0

  • removed ff NEW_API_ENDPOINTS for portal-igs
  • fixed prometheus scraping for local cluster
  • added rabbitmq url for secure-message-gateway
  • added spring profiles config for ars-service
  • added new deployment strategy "rolling" to deploy i.a. stateful sets without downtime
  • added RabbitMq secret to demis namespace
  • fix apt-key command in install-tools.sh
  • deploy dmz before services
  • remove profile for ars-service
  • added rabbitmq user password hash
  • changed/fixed refresh rancher api token pipeline for fkb location
  • added new helm values for istio-ingressgateway
  • moved Pipeline to other project
  • added environment variable for code mapping client addresses to futs and lifecycle-validation-service
  • fixed typos in validation-service-charts
  • update pipelines/targets of dmz-dev, dmz-qs, dmz-prod-test for test-stages
  • fix mesh secret handling
  • removed feature flag FEATURE_FLAG_NEW_API_ENDPOINTS and related configurations
  • upgraded provider hashicorp/random to 3.8.1

Release 5.2.0

  • fixed pipeline for infrastructure rollout for correct defining of GOOGLE_APPLICATION_CREDENTIALS
  • added postgres and pgbouncer to dmz namespace
  • added database-configurations for bulk
  • set headers x-fhir-profile, x-fhir-api-version, x-fhir-api-request-origin, x-fhir-api-submission-type in istio-values.yaml of notification-gateway and notification-processing-service
  • modularized http timeouts and retries for all services
  • added hmac secret variable for ars bulk service
  • made bulk-inbound-service reachable for bulk and upload
  • Remove unnecessary IGS-variable storage_tls_certificate
  • added environment variables to dmz/bulk-inbound-service
  • added waf and secure-message-gateway to dmz namespace
  • adjusted paths for ARS bulk upload to current specification
  • set timeout for minio to 5 min for local cluster

Release 5.1.0

  • bulk-inbound-service reachable from ingres
  • added functionality of kubeconfig usage for terraform on kkp stages
  • edit depends_on to futs for gateway igs
  • fixed package-registry url for validation-services and futs services
  • added make target for ref-fkb and prod-fkb
  • fixed kiali configuration for connecting to istio resources

Release 5.0.0

  • added new policies: kubernetes-network-policies for all application namespaces
  • upgraded providers
    • hashicorp/helm version to 3.1.1
    • hashicorp/kubernetes version to 3.0.1
  • refactored jaeger deployment
  • fixed naming errors and enforce lint conventions
  • added flag for enabling istio native sidecar usage (default false)
  • increased default memory limit for istio proxy to 256Mi

Release 4.4.1

  • fixed DMZ terraform backend activation
  • fixed ignoring config options with null value
  • fixed 'all' keyword for feature flags and configs
  • fixed Jaeger Resource requests and limits
  • added fhir-profiles-metadata module for services futs-core and futs-igs
  • added validation for services ARE allowed to define profiles in active versions file
  • modified deployment order. Now services validation-service-core, validation-service-igs, validation-service-ars, futs-core and futs-igs depends on package-registry.

Release 4.4.0

  • added ARE modul (EKM3)
  • added DMZ modul
  • added destination-lookup-service urls to NPS, NRS and LVS
  • fix gitlab urls in scripts
  • removed truststore-certs-secrets for keycloak
  • add resource requests and limits for istio proxy sidecars
  • added prometheus jobs for rabbitmq and improved for services in local

Release 4.3.3

  • fix namespace name for new testenvironment

Release 4.3.2

  • fix istio metrics path for metric scraping

Release 4.3.1

  • fix default db for ref environment in switch database script

Release 4.3.0

  • added truststore-certs-secrets for keycloak
  • Fix new API endpoints routing for portal pathogen and disease to futs
  • added tsl-download endpoint
  • added support of FHIR packages
  • add grafana metrics annotations for istiod
  • add meldungs domain for mesh network policies

Release 4.2.1

  • truncate checksums

Release 4.2.0

  • refactor module fhir-profiles-metadata for better profile update handling on non-canary deployment of validation services (requires service version 2.9.1)
  • Add additional test-configuration for prod-test environment
  • cron jobs will be only manually triggered if references services or own service will be updated
  • adding coding standards to CONTRIBUTING.md

Release 4.1.0

  • added versioned s3-controller urls for igs
  • receiving sequence data for outdated api version supported
  • removed Test User IDs from Notification Processing Service Template
  • add scale down and scale up make targets for all demis deployments
  • add secretKeyRef for ars-pseudo-purger
  • fix traffic weight for non-canary deployments
  • adjust tests for modules helm_deployment and flags
  • environment variable added to surveillance-pseudonym-service-ars
  • removed ars-pseudonymization-service
  • add new cronjob surveillance-pseudonym-purger-ars
  • add starting dependency for keycloak to local idp
  • add checksums to all secrets
  • add secret checksums to all helm charts from all services that use these secrets
  • split file chart-destination-lookup.tf in files chart-destination-lookup-writer.tf, chart-destination-lookup-reader.tf and chart-destination-lookup-purger.tf
  • added sidecar tsl-deliverer-mock for keycloak. Needed only for local and dev deployment
  • changed redis ACL for the reader and writer accounts

Release 4.0.0

Breaking:

  • upgrade required terraform version to 1.9.0
  • upgrade provider hashicorp/helm to 3.0.2
  • for local development KIND version 0.30.0 is required
  • update apt package manager resource for helm (old is unavailable)

improvements and features:

  • add db entries for pgbouncer only if necessary
  • determine postgres initialization config from running services
  • updating kyverno
  • fix grafana dashboard download issue on empty folder in terraform
  • upgrade provider hashicorp/kubernetes to 2.38.0
  • update custom dashboards
  • add more documentation for customizing new EKM deployment modules
  • add destination lookup services to switch database script

Release 3.8.1

  • Update structure of the service account Kubernetes secret.
  • add database for destination-lookup to pgbouncer and postgres
  • remove unused variables from ekm-template
  • add resource for destination-lookup-service
  • make stage-configuration-data optional
  • remove unused secret for gematik-idp
  • changed routing of requests to FUTS
  • added profile version for IGS in Gateway-IGS

Release 3.8.0

  • add module fhir-profiles-metadata v2
  • add setup for provisioning modes dedicated, distributed and combined on validation services
  • add setup for versioned profile snapshots and external access on validation services, ars-service, igs-service, report-processing-service and notification-processing-service
  • add Support for new API Endpoint for Backend-Services
  • new API Endpoint change for FFS Reader Search url
  • add new API endpoints for portal-bedoccupancy
  • add new API endpoints for portal-pathogen
  • add new API endpoints for HLS
  • add new API endpoints for NG
  • add new API endpoints for RPS
  • add new API endpoints for policies-authorizations
  • add new API endpoints for portal-disease
  • add new API endpoints for notification-gateway
  • add new API endpoints for portal-shell
  • add new API endpoints for portal-igs
  • new API endpoint use profile header x-fhir-profile instead of fhirProfile
  • make TF_EXTRA_ARGS environment variable available for passing parameters from command line to opentofu
  • ARS: use surveillance-pseudonym-service-ars instead of ars-pseudonymization-service
  • ARS: add secret ars-pseudo-hash-pepper to demis environment
  • surveillance-pseudonym-service-ars: app-values extended
  • add support for using Kubernetes secrets to provide GCP service account key files.
  • add ekm-template

Release 3.7.2

  • skip manual job creation if job is suspended (CUS, FSP, KUP)
  • add surveillance-pseudonym database to pgbouncer

Release 3.7.1

  • remove NCAPI mirror

Release 3.7.0

  • Add new service: surveillance-pseudonym-service-ars
  • Remove external virtual service from package-registry
  • remove NCAPI and pseudo-storage database from pgbouncer and postgres
  • Update switch Database Script

Release 3.6.0

  • Remove deprecated Pseudonymization-Storage-Service
  • use last version of activated gcp secrets for deployments
  • Remove NCAPI References + API Key
  • Add Filter to exclude option values with null values
  • Added new service: Package Registry
  • Add ABC Prod Fra
  • Remove external virtual service from ars-pseudonymization-service

Release 3.5.0

  • Remove keycloak-gematik-idp-public-key as variable and add as config option.

Release 3.4.3

  • Remove keycloak-gematik-idp-public-key as variable and add as config option.
  • Terminology server FHIR snapshot configuration change to apply all validation services' snapshots
  • Update Database Pipeline for abc Cluster
  • Added default addresses for 'ars-service'

Release 3.4.2

  • Update gitignore

Release 3.4.1

  • Update Readme with new disclaimer

Release 3.4.0

  • Update Jenkins Pipelines for publishing to GitHub
  • Update Jenkins Pipelines for automatic validation

Release 3.3.0

  • Add functionality defining alternative fhir-profile-snapshot version for futs
  • fix null update for profiles in canary to main transition on active-versions.yaml

Release 3.2.0

  • Add charts for new service 'ars-pseudonymization-service'
  • Add charts for new service 'terminology-server'
  • Add functionality defining multiple profiles for validation services

Release 3.1.0

  • Add new secret for keycloak token exchange
  • Add new secret for certificate-update-service

Release 3.0.0

  • Helm Chart Template Values are now part of theis repository
  • Resources and Replicas can be fully customised over a variable
  • Added new Makefile targets for linting, docs, formatting

Release 2.0.0

  • New Project Structure, centralization of identity management services in own namespace
  • Minor bugfixes

Release 1.3.0

  • First official GitHub-Release