From 715bc9e76d8360cb47c0da29c2c2aac55ff117b4 Mon Sep 17 00:00:00 2001 From: Alice Thorne Date: Mon, 28 Nov 2022 14:07:01 -0500 Subject: [PATCH] bump to v2.7.0, document OP_TRACE --- aws-ecsfargate-terraform/task-definitions/scim.json | 2 +- docker/README.md | 1 + docker/compose/docker-compose.yml | 2 +- docker/compose/scim.env | 3 +++ docker/swarm/docker-compose.yml | 2 +- docker/swarm/scim.env | 3 +++ kubernetes/README.md | 12 +++++++++++- kubernetes/op-scim-config.yaml | 1 + kubernetes/op-scim-deployment.yaml | 2 +- 9 files changed, 23 insertions(+), 5 deletions(-) diff --git a/aws-ecsfargate-terraform/task-definitions/scim.json b/aws-ecsfargate-terraform/task-definitions/scim.json index 09e9113..6047067 100644 --- a/aws-ecsfargate-terraform/task-definitions/scim.json +++ b/aws-ecsfargate-terraform/task-definitions/scim.json @@ -1,7 +1,7 @@ [ { "name": "op_scim_bridge", - "image": "1password/scim:v2.6.2", + "image": "1password/scim:v2.7.0", "cpu": 128, "memory": 512, "essential": true, diff --git a/docker/README.md b/docker/README.md index 5a8feb2..5d29c70 100644 --- a/docker/README.md +++ b/docker/README.md @@ -225,6 +225,7 @@ The following options are available for advanced or custom deployments. Unless y * `OP_REDIS_URL` - you can specify `redis://` or `rediss://` (for TLS) URL here to point towards an alternative Redis host. You can then strip out the sections in `docker-compose.yml` that refer to Redis to not deploy that container. Note that Redis is still required for the SCIM bridge to function. * `OP_PRETTY_LOGS` - can be set to `1` if you would like the SCIM bridge to output logs in a human-readable format. This can be helpful if you aren’t planning on doing custom log ingestion in your environment. * `OP_DEBUG` - can be set to `1` to enable debug output in the logs. Useful for troubleshooting or when contacting 1Password Support. +* `OP_TRACE` - can be set to `1` to enable Trace-level log output. Useful for debugging Let’s Encrypt integration errors. * `OP_PING_SERVER` - can be set to `1` to enable an optional `/ping` endpoint on port `80`. Useful for health checks. Disabled if `OP_LETSENCRYPT_DOMAIN` is unset and TLS is not utilized. ## Generating `scim.env` file on Windows diff --git a/docker/compose/docker-compose.yml b/docker/compose/docker-compose.yml index 5b87d56..03715b4 100644 --- a/docker/compose/docker-compose.yml +++ b/docker/compose/docker-compose.yml @@ -1,7 +1,7 @@ version: "2.2" services: scim: - image: 1password/scim:v2.6.2 + image: 1password/scim:v2.7.0 ports: - "3002:3002" - "80:8080" diff --git a/docker/compose/scim.env b/docker/compose/scim.env index 90658b0..19c6feb 100644 --- a/docker/compose/scim.env +++ b/docker/compose/scim.env @@ -26,6 +26,9 @@ OP_REDIS_URL=redis://redis:6379 # OP_DEBUG enables more detailed logging, which can be useful during troubleshooting or debugging #OP_DEBUG=1 +# OP_TRACE enables Trace-level debugging, primarily used to debug Let's Encrypt integration errors +#OP_TRACE=1 + # OP_LETSENCRYPT_EMAIL changes the email address provided to Let's Encrypt when a certificate is issued for your SCIM bridge, default: "1pw@[OP_LETSENCRYPT_DOMAIN]" #OP_LETSENCRYPT_EMAIL=scim@example.com diff --git a/docker/swarm/docker-compose.yml b/docker/swarm/docker-compose.yml index 9c5dbe4..52ac106 100644 --- a/docker/swarm/docker-compose.yml +++ b/docker/swarm/docker-compose.yml @@ -1,7 +1,7 @@ version: "3.3" services: scim: - image: 1password/scim:v2.6.2 + image: 1password/scim:v2.7.0 deploy: replicas: 1 restart_policy: diff --git a/docker/swarm/scim.env b/docker/swarm/scim.env index 5780ea7..e0a2445 100644 --- a/docker/swarm/scim.env +++ b/docker/swarm/scim.env @@ -21,6 +21,9 @@ OP_REDIS_URL=redis://redis:6379 # OP_DEBUG enables more detailed logging, which can be useful during troubleshooting or debugging #OP_DEBUG=1 +# OP_TRACE enables Trace-level debugging, primarily used to debug Let's Encrypt integration errors +#OP_TRACE=1 + # OP_PING_SERVER brings up a `/ping` endpoint which can be useful for health checks # It is disabled if OP_LETSENCRYPT_DOMAIN is unset #OP_PING_SERVER=1 diff --git a/kubernetes/README.md b/kubernetes/README.md index b67ad98..ccf97b7 100644 --- a/kubernetes/README.md +++ b/kubernetes/README.md @@ -139,7 +139,7 @@ You can now continue with the administration guide to configure your Identity Pr To update SCIM bridge, connect to your Kubernetes cluster and run the following command: ```bash -kubectl set image deploy/op-scim-bridge op-scim-bridge=1password/scim:v2.6.2 +kubectl set image deploy/op-scim-bridge op-scim-bridge=1password/scim:v2.7.0 ``` This will upgrade your SCIM bridge to the latest version, which should take about 2-3 minutes for Kubernetes to process. @@ -287,6 +287,16 @@ kubectl set env deploy/op-scim-bridge OP_DEBUG=1 This may be useful for troubleshooting, or when contacting 1Password Support. +### Trace Mode + +Set `OP_TRACE` to `1` to enable Trace-level debug output in the logs: + +```bash +kubectl set env deploy/op-scim-bridge OP_TRACE=1 +``` + +This may be useful for troubleshooting Let’s Encrypt integration issues. + ### Health Check Ping Server When using Let’s Encrypt on some Kubernetes clusters, health checks can fail for the SCIM bridge before the bridge is able to obtain a Let’s Encrypt certificate. Set `OP_PING_SERVER` to `1` to enable a `/ping` endpoint on port `80` so that health checks will always be brought online: diff --git a/kubernetes/op-scim-config.yaml b/kubernetes/op-scim-config.yaml index 28a8b7b..f17a9cf 100644 --- a/kubernetes/op-scim-config.yaml +++ b/kubernetes/op-scim-config.yaml @@ -10,6 +10,7 @@ data: OP_SESSION: "/secrets/scimsession" OP_PRETTY_LOGS: "0" OP_DEBUG: "0" + OP_TRACE: "0" OP_PING_SERVER: "0" # (optional) uncomment this line to change the email that is used when Let's Encrypt issues your SCIM bridge a certificate # default: "1pw@[OP_LETSENCRYPT_DOMAIN]" diff --git a/kubernetes/op-scim-deployment.yaml b/kubernetes/op-scim-deployment.yaml index ffb185f..aae32d6 100644 --- a/kubernetes/op-scim-deployment.yaml +++ b/kubernetes/op-scim-deployment.yaml @@ -14,7 +14,7 @@ spec: spec: containers: - name: op-scim-bridge - image: 1password/scim:v2.6.2 + image: 1password/scim:v2.7.0 ports: # HTTPS port (external TCP traffic should be forwarded to this port by default) - name: https