jklein
0021becba2
- Values-driven securityContext for the Synapse pod/container with hardened defaults: runAsNonRoot as uid/gid 1000 (matching the image's previous gosu drop target), readOnlyRootFilesystem, allowPrivilegeEscalation false, all capabilities dropped; /tmp mounted as emptyDir. The now-ineffective UID/GID env vars are removed (the securityContext controls the user). - Naming scheme: delegation Deployment renamed to ...-delegation-nginx-deployment, ConfigMap to ...-delegation-nginx-configmap (references and service selector updated). - matrix.configSecretRef moved to secrets.configSecretRef (repo standard). - Probes for Synapse and the delegation nginx are values-configurable; defaults are the previous hardcoded settings. - Flexible ingress standard: ingress.className (default nginx) and ingress.annotations merged with the cert-manager annotation. - Additive matrix.env block rendered through tpl (value/secretKeyRef/ configMapKeyRef forms). - CI fixtures: secret ref moved, seed job image synced to appVersion. - Chart 4.2.1+upv1.159.0 -> 5.0.0+upv1.159.0 (major; app version unchanged).
92 lines
3.6 KiB
YAML
92 lines
3.6 KiB
YAML
apiVersion: apps/v1
|
|
kind: StatefulSet
|
|
metadata:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
|
|
labels:
|
|
app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
|
|
spec:
|
|
serviceName: {{ .Release.Name }}-{{ .Chart.Name }}-service
|
|
replicas: {{ include "matrix-synapse.replicas" (dict "scaleDown" .Values.scaleDown "replicas" .Values.matrix.replicas) }}
|
|
selector:
|
|
matchLabels:
|
|
app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
|
|
template:
|
|
metadata:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
|
|
labels:
|
|
app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
|
|
spec:
|
|
automountServiceAccountToken: false
|
|
securityContext:
|
|
{{- toYaml .Values.matrix.securityContext.pod | nindent 8 }}
|
|
containers:
|
|
- name: "{{ .Release.Name }}-{{ .Chart.Name }}-container"
|
|
image: "ghcr.io/element-hq/synapse:{{ .Chart.AppVersion }}"
|
|
securityContext:
|
|
{{- toYaml .Values.matrix.securityContext.container | nindent 12 }}
|
|
env:
|
|
- name: SYNAPSE_SERVER_NAME
|
|
value: "{{ required "You must provide a Server-Name" .Values.matrix.serverName }}"
|
|
- name: SYNAPSE_REPORT_STATS
|
|
value: "no"
|
|
- name: TZ
|
|
value: "{{ .Values.matrix.timezone }}"
|
|
{{- range $value := .Values.matrix.env }}
|
|
{{- if $value.value }}
|
|
- name: {{ $value.name }}
|
|
value: {{ tpl $value.value $ }}
|
|
{{- else if $value.valueFrom }}
|
|
{{- if $value.valueFrom.secretKeyRef }}
|
|
- name: {{ $value.name }}
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ tpl $value.valueFrom.secretKeyRef.name $ }}
|
|
key: {{ tpl $value.valueFrom.secretKeyRef.key $ }}
|
|
{{- else if $value.valueFrom.configMapKeyRef }}
|
|
- name: {{ $value.name }}
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: {{ tpl $value.valueFrom.configMapKeyRef.name $ }}
|
|
key: {{ tpl $value.valueFrom.configMapKeyRef.key $ }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
ports:
|
|
- name: http
|
|
containerPort: 8008
|
|
protocol: TCP
|
|
readinessProbe:
|
|
{{- toYaml .Values.matrix.readinessProbe | nindent 12 }}
|
|
livenessProbe:
|
|
{{- toYaml .Values.matrix.livenessProbe | nindent 12 }}
|
|
startupProbe:
|
|
{{- toYaml .Values.matrix.startupProbe | nindent 12 }}
|
|
resources:
|
|
{{- include "matrix-synapse.resources" .Values.matrix.resources | nindent 12 }}
|
|
volumeMounts:
|
|
- name: matrix-synapse-volume
|
|
mountPath: /data
|
|
subPath: matrix-synapse-data/
|
|
- name: matrix-synapse-volume
|
|
mountPath: /media_store
|
|
subPath: matrix-media-store/
|
|
- name: matrix-synapse-config-secret
|
|
mountPath: /data/homeserver.yaml
|
|
subPath: homeserver.yaml
|
|
# Scratch space so the read-only root filesystem never blocks
|
|
# temp-file writes (e.g. URL-preview downloads).
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
volumes:
|
|
- name: tmp
|
|
emptyDir: {}
|
|
- name: matrix-synapse-volume
|
|
persistentVolumeClaim:
|
|
claimName: {{ .Release.Name }}-{{ .Chart.Name }}-pvc
|
|
- name: matrix-synapse-config-secret
|
|
secret:
|
|
secretName: {{ .Release.Name }}-{{ .Chart.Name }}-config-secret
|
|
items:
|
|
- key: homeserver.yaml
|
|
path: homeserver.yaml
|