Matrix-Synapse chart: security hardening, naming scheme, configurable probes

- Values-driven securityContext for the Synapse pod/container with hardened
  defaults: runAsNonRoot as uid/gid 1000 (matching the image's previous gosu
  drop target), readOnlyRootFilesystem, allowPrivilegeEscalation false, all
  capabilities dropped; /tmp mounted as emptyDir. The now-ineffective UID/GID
  env vars are removed (the securityContext controls the user).
- Naming scheme: delegation Deployment renamed to ...-delegation-nginx-deployment,
  ConfigMap to ...-delegation-nginx-configmap (references and service selector
  updated).
- matrix.configSecretRef moved to secrets.configSecretRef (repo standard).
- Probes for Synapse and the delegation nginx are values-configurable;
  defaults are the previous hardcoded settings.
- Flexible ingress standard: ingress.className (default nginx) and
  ingress.annotations merged with the cert-manager annotation.
- Additive matrix.env block rendered through tpl (value/secretKeyRef/
  configMapKeyRef forms).
- CI fixtures: secret ref moved, seed job image synced to appVersion.
- Chart 4.2.1+upv1.159.0 -> 5.0.0+upv1.159.0 (major; app version unchanged).

matrix-synapse/templates/matrix-delegation-nginx.deployment.yaml

@@ -2,18 +2,18 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ .Release.Name }}-{{ .Chart.Name }}-delegation-nginx
+  name: {{ .Release.Name }}-{{ .Chart.Name }}-delegation-nginx-deployment
   labels:
-    app: {{ .Release.Name }}-{{ .Chart.Name }}-delegation-nginx
+    app: {{ .Release.Name }}-{{ .Chart.Name }}-delegation-nginx-deployment
 spec:
   replicas: {{ include "matrix-synapse.replicas" (dict "scaleDown" .Values.scaleDown "replicas" .Values.matrix.delegation.replicas) }}
   selector:
     matchLabels:
-      app: {{ .Release.Name }}-{{ .Chart.Name }}-delegation-nginx
+      app: {{ .Release.Name }}-{{ .Chart.Name }}-delegation-nginx-deployment
   template:
     metadata:
       labels:
-        app: {{ .Release.Name }}-{{ .Chart.Name }}-delegation-nginx
+        app: {{ .Release.Name }}-{{ .Chart.Name }}-delegation-nginx-deployment
     spec:
       automountServiceAccountToken: false
       securityContext:
@@ -38,37 +38,18 @@ spec:
           resources:
             {{- include "matrix-synapse.resources" .Values.matrix.delegation.resources | nindent 12 }}
           readinessProbe:
-            httpGet:
-              path: /.well-known/matrix/server
-              port: http
-              scheme: HTTP
-            periodSeconds: 10
-            timeoutSeconds: 3
-            failureThreshold: 3
+            {{- toYaml .Values.matrix.delegation.readinessProbe | nindent 12 }}
           livenessProbe:
-            httpGet:
-              path: /.well-known/matrix/server
-              port: http
-              scheme: HTTP
-            periodSeconds: 10
-            timeoutSeconds: 3
-            failureThreshold: 3
-          # The startup probe gates liveness/readiness. Startup budget = 5s * 30 = 150s.
+            {{- toYaml .Values.matrix.delegation.livenessProbe | nindent 12 }}
           startupProbe:
-            httpGet:
-              path: /.well-known/matrix/server
-              port: http
-              scheme: HTTP
-            periodSeconds: 5
-            timeoutSeconds: 3
-            failureThreshold: 30
+            {{- toYaml .Values.matrix.delegation.startupProbe | nindent 12 }}
       volumes:
         - name: tmp
           emptyDir: {}
         - name: nginx-config
           configMap:
-            name: {{ .Release.Name }}-{{ .Chart.Name }}-delegation-nginx-config
+            name: {{ .Release.Name }}-{{ .Chart.Name }}-delegation-nginx-configmap
             items:
               - key: nginx.conf
                 path: nginx.conf
-{{- end }}
+{{- end }}