3.6.0 Rolling release

[ScharfViktor]

Related #1537

Prerequisites

• web release

  • bump 4.1.0 version
  • squash and merge Release PR
  • bump web v4.1.0 in the opencloud chore/bump-web-4.1.0 #1652

• reva release

  • squash and merge Release PR 🎉 Release 2.39.1 reva#379
  • bump reva revaBump-2.39.1 #1718

QA Phase

• run all working tests in CI [full-ci] bump-opencloud-3.6.0. run all tests web#1442
• compatibility test
• confirmatory testing
• • Data loss from a restored folder #1523
• • Etag change after tus upload reva#380

Collected bugs

After QA Phase

• bump version in pkg/version.go [decomposed] bump-version-v3.6.0 #1719
• squash and merge Release PR 🎉 Release 3.6.0 #1537
• publish release notes to the docs publish release note 3.6.0 docs#485
• Update the public matrix channel topic
• update version in the demo.opencloud.eu @AlexAndBear
• update https://update.opencloud.eu/server.json @flimmy

[ScharfViktor]

Compatibility test between opencloudeu/opencloud-rolling:3.5.0 and opencloudeu/opencloud:3.6.0(builded locally)
using opencloud_full with:

• posix✅️

personal space:

• public share (with an expiration date)
• share with user as role editor (with an expiration date)
• share with group as role viewer
• check activities
• uploaded folder & files are exist
• file versions
• trashed files

project space:

• share space with user edit role
• public share space
• check space activities
• uploaded folder & files are exist
• file versions
• trashed files
• set space image/ description
• change space quota

users/groups:

• created new user
• user has space admin role
• disabled user
• created new group

settings:

• language settings
• new password
• avatar
• GDPR export
• app token

[ScharfViktor]

🎉 Final Release 3.6.0

Docker

Rolling:
docker pull opencloudeu/opencloud-rolling:3.6.0

Quay:

docker pull quay.io/opencloudeu/opencloud-rolling:3.6.0

Binaries

You can download it here https://github.com/opencloud-eu/opencloud/releases/tag/v3.6.0

[suse-coder]

@ScharfViktor Do you know if something has changed from the version before with the graph service? As I get with the new version now only for the graph service: "nats: no servers available for connection"

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: "2025-10-27T16:43:58Z"
  generateName: graph-f5d6f986-
  labels:
    app: graph
    app.kubernetes.io/instance: opencloud
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: opencloud-microservices
    app.kubernetes.io/version: 3.6.0
    helm.sh/chart: opencloud-microservices-0.3.5
    pod-template-hash: f5d6f986
  name: graph-f5d6f986-lnjhn
  namespace: opencloud
  ownerReferences:
  - apiVersion: apps/v1
    blockOwnerDeletion: true
    controller: true
    kind: ReplicaSet
    name: graph-f5d6f986
    uid: 4e48cdb8-6610-4225-a494-f089484843ab
  resourceVersion: "23548537"
  uid: 979bf91c-ae87-490e-8c43-f12a866c8c2a
spec:
  containers:
  - args:
    - graph
    - server
    command:
    - opencloud
    env:
    - name: MICRO_REGISTRY
      value: nats-js-kv
    - name: MICRO_REGISTRY_ADDRESS
      value: nats:9233
    - name: OC_CORS_ALLOW_ORIGINS
      value: https://cloud.opencloud.test
    - name: OC_EVENTS_ENDPOINT
      value: nats:9233
    - name: OC_CACHE_STORE
      value: nats-js-kv
    - name: OC_CACHE_STORE_NODES
      value: nats:9233
    - name: OC_CACHE_DISABLE_PERSISTENCE
      value: "true"
    - name: GRAPH_LOG_COLOR
      value: "false"
    - name: GRAPH_LOG_LEVEL
      value: debug
    - name: GRAPH_LOG_PRETTY
      value: "false"
    - name: GRAPH_TRACING_ENABLED
      value: "false"
    - name: GRAPH_TRACING_TYPE
      value: jaeger
    - name: GRAPH_TRACING_ENDPOINT
    - name: GRAPH_TRACING_COLLECTOR
    - name: GRAPH_DEBUG_PPROF
      value: "false"
    - name: GRAPH_HTTP_ADDR
      value: 0.0.0.0:9120
    - name: GRAPH_DEBUG_ADDR
      value: 0.0.0.0:9124
    - name: GRAPH_SPACES_WEBDAV_BASE
      value: https://cloud.opencloud.test
    - name: GRAPH_IDENTITY_SEARCH_MIN_LENGTH
      value: "3"
    - name: GRAPH_LDAP_URI
      value: ldaps://openldap.openldap.svc.cluster.local:636
    - name: GRAPH_LDAP_BIND_DN
      value: cn=admin,dc=opencloud,dc=eu
    - name: GRAPH_LDAP_BIND_PASSWORD
      valueFrom:
        secretKeyRef:
          key: reva-ldap-bind-password
          name: ldap-bind-secrets
    - name: GRAPH_LDAP_SERVER_WRITE_ENABLED
      value: "true"
    - name: GRAPH_LDAP_CACERT
    - name: GRAPH_LDAP_INSECURE
      value: "true"
    - name: GRAPH_LDAP_SERVER_UUID
      value: "false"
    - name: GRAPH_LDAP_SERVER_USE_PASSWORD_MODIFY_EXOP
      value: "false"
    - name: GRAPH_LDAP_REFINT_ENABLED
      value: "true"
    - name: GRAPH_LDAP_USER_BASE_DN
      value: ou=users,dc=opencloud,dc=eu
    - name: GRAPH_LDAP_GROUP_BASE_DN
      value: ou=groups,dc=opencloud,dc=eu
    - name: GRAPH_LDAP_GROUP_CREATE_BASE_DN
      value: ou=custom,ou=groups,dc=opencloud,dc=eu
    - name: GRAPH_LDAP_USER_SCOPE
      value: sub
    - name: GRAPH_LDAP_GROUP_SEARCH_SCOPE
      value: sub
    - name: SETTINGS_SETUP_DEFAULT_ASSIGNMENTS
      value: "false"
    - name: GRAPH_ASSIGN_DEFAULT_USER_ROLE
      value: "false"
    - name: GRAPH_USERNAME_MATCH
      value: none
    - name: GRAPH_LDAP_USER_FILTER
      value: (objectclass=inetOrgPerson)
    - name: GRAPH_LDAP_GROUP_FILTER
    - name: GRAPH_LDAP_USER_OBJECTCLASS
      value: inetOrgPerson
    - name: GRAPH_LDAP_GROUP_OBJECTCLASS
      value: groupOfNames
    - name: GRAPH_LDAP_USER_UID_ATTRIBUTE
      value: openCloudUUID
    - name: GRAPH_LDAP_GROUP_ID_ATTRIBUTE
      value: openCloudUUID
    - name: GRAPH_LDAP_USER_EMAIL_ATTRIBUTE
      value: mail
    - name: GRAPH_LDAP_USER_DISPLAYNAME_ATTRIBUTE
      value: displayname
    - name: GRAPH_LDAP_USER_NAME_ATTRIBUTE
      value: uid
    - name: GRAPH_LDAP_USER_TYPE_ATTRIBUTE
      value: openCloudUserType
    - name: GRAPH_LDAP_GROUP_NAME_ATTRIBUTE
      value: cn
    - name: GRAPH_LDAP_USER_SCHEMA_ID_IS_OCTETSTRING
      value: "false"
    - name: GRAPH_LDAP_GROUP_SCHEMA_ID_IS_OCTETSTRING
      value: "false"
    - name: GRAPH_USER_ENABLED_ATTRIBUTE
      value: openCloudUserEnabled
    - name: GRAPH_DISABLE_USER_MECHANISM
      value: attribute
    - name: GRAPH_DISABLED_USERS_GROUP_DN
      value: cn=DisabledUsersGroup,ou=groups,o=libregraph-idm
    - name: OC_SHOW_USER_EMAIL_IN_RESULTS
      value: "false"
    - name: GRAPH_APPLICATION_ID
      valueFrom:
        configMapKeyRef:
          key: application-id
          name: graph
    - name: GRAPH_JWT_SECRET
      valueFrom:
        secretKeyRef:
          key: jwt-secret
          name: jwt-secret
    - name: OC_DEFAULT_LANGUAGE
      value: en
    - name: GRAPH_SERVICE_ACCOUNT_ID
      valueFrom:
        configMapKeyRef:
          key: service-account-id
          name: auth-service
    - name: GRAPH_SERVICE_ACCOUNT_SECRET
      valueFrom:
        secretKeyRef:
          key: service-account-secret
          name: service-account-secret
    - name: OC_ENABLE_OCM
      value: "false"
    image: opencloudeu/opencloud-rolling:3.6.0
    imagePullPolicy: IfNotPresent
    livenessProbe:
      failureThreshold: 3
      httpGet:
        path: /healthz
        port: metrics-debug
        scheme: HTTP
      initialDelaySeconds: 60
      periodSeconds: 20
      successThreshold: 1
      timeoutSeconds: 10
    name: graph
    ports:
    - containerPort: 9120
      name: http
      protocol: TCP
    - containerPort: 9124
      name: metrics-debug
      protocol: TCP
    resources: {}
    securityContext:
      readOnlyRootFilesystem: true
      runAsGroup: 1000
      runAsNonRoot: true
      runAsUser: 1000
    terminationMessagePath: /dev/termination-log
    terminationMessagePolicy: File
    volumeMounts:
    - mountPath: /etc/opencloud/messaging-system-ca
      name: messaging-system-ca
      readOnly: true
    - mountPath: /etc/opencloud/ldap-ca
      name: ldap-ca
      readOnly: true
    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
      name: kube-api-access-6xj7d
      readOnly: true
  dnsPolicy: ClusterFirst
  enableServiceLinks: true
  nodeName: talos-u29-csd
  preemptionPolicy: PreemptLowerPriority
  priority: 0
  restartPolicy: Always
  schedulerName: default-scheduler
  securityContext:
    fsGroup: 1000
    fsGroupChangePolicy: OnRootMismatch
  serviceAccount: default
  serviceAccountName: default
  terminationGracePeriodSeconds: 30
  tolerations:
  - effect: NoExecute
    key: node.kubernetes.io/not-ready
    operator: Exists
    tolerationSeconds: 300
  - effect: NoExecute
    key: node.kubernetes.io/unreachable
    operator: Exists
    tolerationSeconds: 300
  volumes:
  - emptyDir: {}
    name: messaging-system-ca
  - emptyDir: {}
    name: ldap-ca
  - name: kube-api-access-6xj7d
    projected:
      defaultMode: 420
      sources:
      - serviceAccountToken:
          expirationSeconds: 3607
          path: token
      - configMap:
          items:
          - key: ca.crt
            path: ca.crt
          name: kube-root-ca.crt
      - downwardAPI:
          items:
          - fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
            path: namespace
status:
  conditions:
  - lastProbeTime: null
    lastTransitionTime: "2025-10-27T16:43:59Z"
    status: "True"
    type: PodReadyToStartContainers
  - lastProbeTime: null
    lastTransitionTime: "2025-10-27T16:43:58Z"
    status: "True"
    type: Initialized
  - lastProbeTime: null
    lastTransitionTime: "2025-10-27T17:30:27Z"
    message: 'containers with unready status: [graph]'
    reason: ContainersNotReady
    status: "False"
    type: Ready
  - lastProbeTime: null
    lastTransitionTime: "2025-10-27T17:30:27Z"
    message: 'containers with unready status: [graph]'
    reason: ContainersNotReady
    status: "False"
    type: ContainersReady
  - lastProbeTime: null
    lastTransitionTime: "2025-10-27T16:43:58Z"
    status: "True"
    type: PodScheduled
  containerStatuses:
  - containerID: containerd://d6548f91cf9bb844e1885cd9d6f421b7a39a255a1b90ccb2f1eb9f8f2ca82f9c
    image: docker.io/opencloudeu/opencloud-rolling:3.6.0
    imageID: docker.io/opencloudeu/opencloud-rolling@sha256:6732f01b1411fe9ba6efca6a7e72e98f1801f75b533eb34a96e48c0fefb1afaa
    lastState:
      terminated:
        containerID: containerd://d6548f91cf9bb844e1885cd9d6f421b7a39a255a1b90ccb2f1eb9f8f2ca82f9c
        exitCode: 1
        finishedAt: "2025-10-27T17:30:26Z"
        reason: Error
        startedAt: "2025-10-27T17:30:26Z"
    name: graph
    ready: false

[micbar]

Something changed yes. How did you deploy openCloud?

[suse-coder]

Normally via Kubernetes. As until 3.5.0 all was fine, now also, just that the graph pod is not coming up and says it cant reach the nats (own pod). Like if the graph service is not using the ENVs anymore or so.

"nats: no servers available for connection"

[suse-coder]

#1605 (comment)
Interesting that in the CI it also says of nats error, but could also be not related.

[micbar]

just that the graph pod is not coming up and says it cant reach the nats (own pod).

I do not deploy graph on a separate pod. Not sure why. Maybe a problem of your chart?

The Graph Service has nats as a dependency now. But that should work with the normal default variables. Are you using GRAPH_* variables or OC_* ones?

[suse-coder]

  env:
    - name: MICRO_REGISTRY
      value: nats-js-kv
    - name: MICRO_REGISTRY_ADDRESS
      value: nats:9233
    - name: OC_CORS_ALLOW_ORIGINS
      value: https://cloud.opencloud.test
    - name: OC_EVENTS_ENDPOINT
      value: nats:9233
    - name: OC_CACHE_STORE
      value: nats-js-kv
    - name: OC_CACHE_STORE_NODES
      value: nats:9233
    - name: OC_CACHE_DISABLE_PERSISTENCE
      value: "true"
    - name: GRAPH_LOG_COLOR
      value: "false"
    - name: GRAPH_LOG_LEVEL
      value: debug
    - name: GRAPH_LOG_PRETTY
      value: "false"
    - name: GRAPH_TRACING_ENABLED
      value: "false"
    - name: GRAPH_TRACING_TYPE
      value: jaeger
    - name: GRAPH_TRACING_ENDPOINT
    - name: GRAPH_TRACING_COLLECTOR
    - name: GRAPH_DEBUG_PPROF
      value: "false"
    - name: GRAPH_HTTP_ADDR
      value: 0.0.0.0:9120
    - name: GRAPH_DEBUG_ADDR
      value: 0.0.0.0:9124
    - name: GRAPH_SPACES_WEBDAV_BASE
      value: https://cloud.opencloud.test
    - name: GRAPH_IDENTITY_SEARCH_MIN_LENGTH
      value: "3"
    - name: GRAPH_LDAP_URI
      value: ldaps://openldap.openldap.svc.cluster.local:636
    - name: GRAPH_LDAP_BIND_DN
      value: cn=admin,dc=opencloud,dc=eu
    - name: GRAPH_LDAP_BIND_PASSWORD
      valueFrom:
        secretKeyRef:
          key: reva-ldap-bind-password
          name: ldap-bind-secrets
    - name: GRAPH_LDAP_SERVER_WRITE_ENABLED
      value: "true"
    - name: GRAPH_LDAP_CACERT
    - name: GRAPH_LDAP_INSECURE
      value: "true"
    - name: GRAPH_LDAP_SERVER_UUID
      value: "false"
    - name: GRAPH_LDAP_SERVER_USE_PASSWORD_MODIFY_EXOP
      value: "false"
    - name: GRAPH_LDAP_REFINT_ENABLED
      value: "true"
    - name: GRAPH_LDAP_USER_BASE_DN
      value: ou=users,dc=opencloud,dc=eu
    - name: GRAPH_LDAP_GROUP_BASE_DN
      value: ou=groups,dc=opencloud,dc=eu
    - name: GRAPH_LDAP_GROUP_CREATE_BASE_DN
      value: ou=custom,ou=groups,dc=opencloud,dc=eu
    - name: GRAPH_LDAP_USER_SCOPE
      value: sub
    - name: GRAPH_LDAP_GROUP_SEARCH_SCOPE
      value: sub
    - name: SETTINGS_SETUP_DEFAULT_ASSIGNMENTS
      value: "false"
    - name: GRAPH_ASSIGN_DEFAULT_USER_ROLE
      value: "false"
    - name: GRAPH_USERNAME_MATCH
      value: none
    - name: GRAPH_LDAP_USER_FILTER
      value: (objectclass=inetOrgPerson)
    - name: GRAPH_LDAP_GROUP_FILTER
    - name: GRAPH_LDAP_USER_OBJECTCLASS
      value: inetOrgPerson
    - name: GRAPH_LDAP_GROUP_OBJECTCLASS
      value: groupOfNames
    - name: GRAPH_LDAP_USER_UID_ATTRIBUTE
      value: openCloudUUID
    - name: GRAPH_LDAP_GROUP_ID_ATTRIBUTE
      value: openCloudUUID
    - name: GRAPH_LDAP_USER_EMAIL_ATTRIBUTE
      value: mail
    - name: GRAPH_LDAP_USER_DISPLAYNAME_ATTRIBUTE
      value: displayname
    - name: GRAPH_LDAP_USER_NAME_ATTRIBUTE
      value: uid
    - name: GRAPH_LDAP_USER_TYPE_ATTRIBUTE
      value: openCloudUserType
    - name: GRAPH_LDAP_GROUP_NAME_ATTRIBUTE
      value: cn
    - name: GRAPH_LDAP_USER_SCHEMA_ID_IS_OCTETSTRING
      value: "false"
    - name: GRAPH_LDAP_GROUP_SCHEMA_ID_IS_OCTETSTRING
      value: "false"
    - name: GRAPH_USER_ENABLED_ATTRIBUTE
      value: openCloudUserEnabled
    - name: GRAPH_DISABLE_USER_MECHANISM
      value: attribute
    - name: GRAPH_DISABLED_USERS_GROUP_DN
      value: cn=DisabledUsersGroup,ou=groups,o=libregraph-idm
    - name: OC_SHOW_USER_EMAIL_IN_RESULTS
      value: "false"
    - name: GRAPH_APPLICATION_ID
      valueFrom:
        configMapKeyRef:
          key: application-id
          name: graph
    - name: GRAPH_JWT_SECRET
      valueFrom:
        secretKeyRef:
          key: jwt-secret
          name: jwt-secret
    - name: OC_DEFAULT_LANGUAGE
      value: en
    - name: GRAPH_SERVICE_ACCOUNT_ID
      valueFrom:
        configMapKeyRef:
          key: service-account-id
          name: auth-service
    - name: GRAPH_SERVICE_ACCOUNT_SECRET
      valueFrom:
        secretKeyRef:
          key: service-account-secret
          name: service-account-secret
    - name: OC_ENABLE_OCM
      value: "false"

[suse-coder]

"The Graph Service has nats as a dependency now". How does that work? Will it not connect to the nats service anymore?