syn2mas: make sure we cant migrate twice with the deployment markers

Author: gaelgatelement

charts/matrix-stack/source/matrixAuthenticationService.yaml.j2

@@ -47,13 +47,15 @@ privateKeys:
 ## The migration process must follow the following steps:
 ## 1. Set `matrixAuthenticationService.enabled: true` and `matrixAuthenticationService.syn2mas.enable: true`, run the  helm upgrade command, check the result of the pre-upgrade hook job
 ## 2. Set `matrixAuthenticationService.syn2mas.dryRun`: false, run the helm upgrade command, check the result of the pre-upgrade hook job
-## 3. To disable the job scaling-down Synapse in future helm-upgrades, set `matrixAuthenticationService.syn2mas.enabled: false`
+## 3. Set `matrixAuthenticationService.syn2mas.enabled: false` to disable syn2mas and allow running `helm upgrade` again.
 ##
 ## If `deploymentMarkers` are enabled, following the steps above will cause the following `MATRIX_STACK_MSC3861` marker transitions :
 ## 1. Stay on `legacy_auth`
 ## 2. `legacy_auth` -> `syn2mas_migrated`
 ## 3. `syn2mas_migrated` -> `delegated_auth`
-## The marker will effectively prevent downgrading from `syn2mas_migrated`/`delegated_auth` to `legacy_auth`
+## The marker will effectively prevent :
+## - Running syn2mas migration again after it has run successfully and is in `syn2mas_migrated` state
+## - Downgrading from `syn2mas_migrated`/`delegated_auth` to `legacy_auth`
 syn2mas:
   enabled: false
 

charts/matrix-stack/templates/deployment-markers/_helpers.tpl

@@ -62,7 +62,7 @@ app.kubernetes.io/version: {{ include "element-io.ess-library.labels.makeSafe" $
           $root.Values.matrixAuthenticationService.enabled
           $root.Values.matrixAuthenticationService.syn2mas.enabled
           (not $root.Values.matrixAuthenticationService.syn2mas.dryRun) }}
-- {{ (printf "%s-markers" $root.Release.Name) }}:MATRIX_STACK_MSC3861:syn2mas_migrated:legacy_auth;syn2mas_migrated
+- {{ (printf "%s-markers" $root.Release.Name) }}:MATRIX_STACK_MSC3861:syn2mas_migrated:legacy_auth
 {{- end }}
 
 {{- /* We allow deploying of Synapse with Matrix Authentication Service, only

charts/matrix-stack/values.yaml

@@ -1732,13 +1732,15 @@ matrixAuthenticationService:
   ## The migration process must follow the following steps:
   ## 1. Set `matrixAuthenticationService.enabled: true` and `matrixAuthenticationService.syn2mas.enable: true`, run the  helm upgrade command, check the result of the pre-upgrade hook job
   ## 2. Set `matrixAuthenticationService.syn2mas.dryRun`: false, run the helm upgrade command, check the result of the pre-upgrade hook job
-  ## 3. To disable the job scaling-down Synapse in future helm-upgrades, set `matrixAuthenticationService.syn2mas.enabled: false`
+  ## 3. Set `matrixAuthenticationService.syn2mas.enabled: false` to disable syn2mas and allow running `helm upgrade` again.
   ##
   ## If `deploymentMarkers` are enabled, following the steps above will cause the following `MATRIX_STACK_MSC3861` marker transitions :
   ## 1. Stay on `legacy_auth`
   ## 2. `legacy_auth` -> `syn2mas_migrated`
   ## 3. `syn2mas_migrated` -> `delegated_auth`
-  ## The marker will effectively prevent downgrading from `syn2mas_migrated`/`delegated_auth` to `legacy_auth`
+  ## The marker will effectively prevent :
+  ## - Running syn2mas migration again after it has run successfully and is in `syn2mas_migrated` state
+  ## - Downgrading from `syn2mas_migrated`/`delegated_auth` to `legacy_auth`
   syn2mas:
     enabled: false
 

tests/integration/test_syn2mas.py

@@ -62,6 +62,11 @@ async def test_run_syn2mas_upgrade(
     # Syn2Mas is running in migrate mode, so the state must have changed
     assert await get_deployment_marker(kube_client, generated_data, "MATRIX_STACK_MSC3861") == "syn2mas_migrated"
 
+    # Assert we cant run syn2mas again
+    revision, error = await deploy_with_values_patch(generated_data, helm_client, {}, timeout="15s")
+    assert error is not None
+    assert revision.status == pyhelm3.ReleaseRevisionStatus.FAILED
+
     # Auth metadata endpoint should be reachable
     response = await aiohttp_get_json(
         f"https://synapse.{generated_data.server_name}/_matrix/client/unstable/org.matrix.msc2965/auth_metadata",