jklein
0021becba2
- Values-driven securityContext for the Synapse pod/container with hardened defaults: runAsNonRoot as uid/gid 1000 (matching the image's previous gosu drop target), readOnlyRootFilesystem, allowPrivilegeEscalation false, all capabilities dropped; /tmp mounted as emptyDir. The now-ineffective UID/GID env vars are removed (the securityContext controls the user). - Naming scheme: delegation Deployment renamed to ...-delegation-nginx-deployment, ConfigMap to ...-delegation-nginx-configmap (references and service selector updated). - matrix.configSecretRef moved to secrets.configSecretRef (repo standard). - Probes for Synapse and the delegation nginx are values-configurable; defaults are the previous hardcoded settings. - Flexible ingress standard: ingress.className (default nginx) and ingress.annotations merged with the cert-manager annotation. - Additive matrix.env block rendered through tpl (value/secretKeyRef/ configMapKeyRef forms). - CI fixtures: secret ref moved, seed job image synced to appVersion. - Chart 4.2.1+upv1.159.0 -> 5.0.0+upv1.159.0 (major; app version unchanged).
56 lines
2.2 KiB
YAML
56 lines
2.2 KiB
YAML
{{- if .Values.matrix.delegation.enabled }}
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-delegation-nginx-deployment
|
|
labels:
|
|
app: {{ .Release.Name }}-{{ .Chart.Name }}-delegation-nginx-deployment
|
|
spec:
|
|
replicas: {{ include "matrix-synapse.replicas" (dict "scaleDown" .Values.scaleDown "replicas" .Values.matrix.delegation.replicas) }}
|
|
selector:
|
|
matchLabels:
|
|
app: {{ .Release.Name }}-{{ .Chart.Name }}-delegation-nginx-deployment
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: {{ .Release.Name }}-{{ .Chart.Name }}-delegation-nginx-deployment
|
|
spec:
|
|
automountServiceAccountToken: false
|
|
securityContext:
|
|
{{- toYaml .Values.matrix.delegation.securityContext.pod | nindent 8 }}
|
|
containers:
|
|
- name: {{ .Release.Name }}-{{ .Chart.Name }}-delegation-nginx
|
|
image: "{{ .Values.matrix.delegation.image.repository }}:{{ .Values.matrix.delegation.image.tag }}"
|
|
securityContext:
|
|
{{- toYaml .Values.matrix.delegation.securityContext.container | nindent 12 }}
|
|
ports:
|
|
- containerPort: 8080
|
|
name: http
|
|
volumeMounts:
|
|
- name: nginx-config
|
|
mountPath: /etc/nginx/nginx.conf
|
|
subPath: nginx.conf
|
|
# The mounted nginx.conf points the pid file and all temp paths to
|
|
# /tmp, so a single writable emptyDir suffices with a read-only
|
|
# root filesystem.
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
resources:
|
|
{{- include "matrix-synapse.resources" .Values.matrix.delegation.resources | nindent 12 }}
|
|
readinessProbe:
|
|
{{- toYaml .Values.matrix.delegation.readinessProbe | nindent 12 }}
|
|
livenessProbe:
|
|
{{- toYaml .Values.matrix.delegation.livenessProbe | nindent 12 }}
|
|
startupProbe:
|
|
{{- toYaml .Values.matrix.delegation.startupProbe | nindent 12 }}
|
|
volumes:
|
|
- name: tmp
|
|
emptyDir: {}
|
|
- name: nginx-config
|
|
configMap:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-delegation-nginx-configmap
|
|
items:
|
|
- key: nginx.conf
|
|
path: nginx.conf
|
|
{{- end }}
|