From 9f739e44936c86162c5dbded93802705b6c67083 Mon Sep 17 00:00:00 2001 From: jklein Date: Sun, 23 Aug 2026 18:56:49 +0200 Subject: [PATCH] matrix-synapse: restart the delegation nginx when its ConfigMap changes The delegation nginx serves the .well-known documents from an nginx.conf that is rendered from ingress.domain and mounted with subPath. Changing the domain rewrote the ConfigMap but left the running pod untouched: the pod template was unchanged, so nothing rolled, and the kubelet never refreshes a subPath mount. The pod kept serving the old delegation while looking perfectly healthy - the failure mode from #82. The pod template now carries checksum/config over the rendered delegation ConfigMap, so a changed nginx.conf rolls the deployment. Also documents the limit that remains for homeserver.yaml: it comes from a 1Password-backed Secret, whose content Helm never sees, and the operator's own auto-restart only ever covers Deployments - not this StatefulSet. That case needs a manual rollout restart, which the values.yaml now says out loud. Major bump: runtime behavior changes - a delegation config change now costs a restart of the nginx pod (a few seconds, no persistent state). --- matrix-synapse/Chart.yaml | 2 +- .../matrix-delegation-nginx.deployment.yaml | 7 +++++++ matrix-synapse/values.yaml | 12 ++++++++++++ 3 files changed, 20 insertions(+), 1 deletion(-) diff --git a/matrix-synapse/Chart.yaml b/matrix-synapse/Chart.yaml index 7af98eb..db86dbf 100644 --- a/matrix-synapse/Chart.yaml +++ b/matrix-synapse/Chart.yaml @@ -3,7 +3,7 @@ name: matrix-synapse description: A Helm chart to deploy a Matrix Synapse server on Kubernetes icon: https://raw.githubusercontent.com/element-hq/synapse/develop/docs/favicon.png type: application -version: 5.0.0+upv1.159.0 +version: 6.0.0+upv1.159.0 appVersion: "v1.159.0" maintainers: - name: jklein \ No newline at end of file diff --git a/matrix-synapse/templates/matrix-delegation-nginx.deployment.yaml b/matrix-synapse/templates/matrix-delegation-nginx.deployment.yaml index 3934c0c..14f62f8 100644 --- a/matrix-synapse/templates/matrix-delegation-nginx.deployment.yaml +++ b/matrix-synapse/templates/matrix-delegation-nginx.deployment.yaml @@ -14,6 +14,13 @@ spec: metadata: labels: app: {{ .Release.Name }}-{{ .Chart.Name }}-delegation-nginx-deployment + annotations: + # Hash of the rendered delegation ConfigMap: a changed nginx.conf + # changes the pod template and thus rolls the pods. Without it the + # running nginx keeps serving the old .well-known documents - the + # config is mounted with subPath (never refreshed by the kubelet) and + # nginx reads it only at start. + checksum/config: {{ include (print $.Template.BasePath "/matrix-delegation-nginx.configmap.yaml") . | sha256sum }} spec: automountServiceAccountToken: false securityContext: diff --git a/matrix-synapse/values.yaml b/matrix-synapse/values.yaml index 0375764..bc5c00f 100644 --- a/matrix-synapse/values.yaml +++ b/matrix-synapse/values.yaml @@ -5,6 +5,18 @@ scaleDown: false secrets: + # homeserver.yaml is mounted into the Synapse StatefulSet from the Secret the + # 1Password operator materializes from this item. + # + # Known limitation (#82): a change to the item in the vault does NOT restart + # Synapse. Helm cannot hash the content (it never sees it - the operator fills + # the Secret in-cluster after rendering), so the checksum/config mechanism the + # delegation nginx uses does not apply here. The operator's own + # "operator.1password.io/auto-restart" annotation is no help either: it only + # ever restarts Deployments, and this workload is a StatefulSet (verified + # against onepassword-operator 1.12.0). After changing the item, restart + # Synapse by hand: + # kubectl rollout restart statefulset -matrix-synapse-sfs configSecretRef: null matrix: