jklein
1ddb5f457e
Three changes, across both workloads (Synapse StatefulSet and delegation nginx Deployment). 1. values.schema.json (#68): additionalProperties: false on every chart-owned object level, including the whole matrix.delegation block with its own contexts, probes and resources. 2. Ingress gate (#93): the Ingress template is wrapped in {{- if .Values.ingress.enabled }} and the key is added to values.yaml with default true, so behaviour is unchanged. The domain checkpoint found a second reader: the delegation nginx serves ingress.domain in its /.well-known/matrix/{server,client} endpoints, and read it without a guard. Gating alone would therefore have published '{"m.server": ":443"}' and base_url "https://" - a federation-breaking answer that renders and starts cleanly. Both reads are now required(), so that case fails loudly. Only clusterIssuer actually becomes unnecessary when the Ingress is off. 3. Null-safety for hardening, probes and resources (#99) for both workloads. The rebuilt probes keep each workload's own endpoint: Synapse /health, delegation /.well-known/matrix/server - the endpoint that workload exists to serve - including its shorter 3s timeout. The delegation pod context keeps having no fsGroup, because it mounts no volume that needs one. The nginx checksum/config annotation from #82 is untouched. storage stays deliberately not null-safe: an erased block yields an invalid PVC, which is the loud class #99 excludes. Rendering is byte-identical to 6.0.0, both with the CI values (which enable delegation) and with the production bundle values.
92 lines
3.7 KiB
YAML
92 lines
3.7 KiB
YAML
apiVersion: apps/v1
|
|
kind: StatefulSet
|
|
metadata:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
|
|
labels:
|
|
app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
|
|
spec:
|
|
serviceName: {{ .Release.Name }}-{{ .Chart.Name }}-service
|
|
replicas: {{ include "matrix-synapse.replicas" (dict "scaleDown" .Values.scaleDown "replicas" .Values.matrix.replicas) }}
|
|
selector:
|
|
matchLabels:
|
|
app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
|
|
template:
|
|
metadata:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
|
|
labels:
|
|
app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
|
|
spec:
|
|
automountServiceAccountToken: false
|
|
securityContext:
|
|
{{- include "matrix-synapse.podSecurityContext" .Values.matrix.securityContext | nindent 8 }}
|
|
containers:
|
|
- name: "{{ .Release.Name }}-{{ .Chart.Name }}-container"
|
|
image: "ghcr.io/element-hq/synapse:{{ .Chart.AppVersion }}"
|
|
securityContext:
|
|
{{- include "matrix-synapse.containerSecurityContext" .Values.matrix.securityContext | nindent 12 }}
|
|
env:
|
|
- name: SYNAPSE_SERVER_NAME
|
|
value: "{{ required "You must provide a Server-Name" .Values.matrix.serverName }}"
|
|
- name: SYNAPSE_REPORT_STATS
|
|
value: "no"
|
|
- name: TZ
|
|
value: "{{ .Values.matrix.timezone }}"
|
|
{{- range $value := .Values.matrix.env }}
|
|
{{- if $value.value }}
|
|
- name: {{ $value.name }}
|
|
value: {{ tpl $value.value $ }}
|
|
{{- else if $value.valueFrom }}
|
|
{{- if $value.valueFrom.secretKeyRef }}
|
|
- name: {{ $value.name }}
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ tpl $value.valueFrom.secretKeyRef.name $ }}
|
|
key: {{ tpl $value.valueFrom.secretKeyRef.key $ }}
|
|
{{- else if $value.valueFrom.configMapKeyRef }}
|
|
- name: {{ $value.name }}
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: {{ tpl $value.valueFrom.configMapKeyRef.name $ }}
|
|
key: {{ tpl $value.valueFrom.configMapKeyRef.key $ }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
ports:
|
|
- name: http
|
|
containerPort: 8008
|
|
protocol: TCP
|
|
readinessProbe:
|
|
{{- include "matrix-synapse.readinessProbe" .Values.matrix.readinessProbe | nindent 12 }}
|
|
livenessProbe:
|
|
{{- include "matrix-synapse.livenessProbe" .Values.matrix.livenessProbe | nindent 12 }}
|
|
startupProbe:
|
|
{{- include "matrix-synapse.startupProbe" .Values.matrix.startupProbe | nindent 12 }}
|
|
resources:
|
|
{{- include "matrix-synapse.effectiveResources" .Values.matrix.resources | nindent 12 }}
|
|
volumeMounts:
|
|
- name: matrix-synapse-volume
|
|
mountPath: /data
|
|
subPath: matrix-synapse-data/
|
|
- name: matrix-synapse-volume
|
|
mountPath: /media_store
|
|
subPath: matrix-media-store/
|
|
- name: matrix-synapse-config-secret
|
|
mountPath: /data/homeserver.yaml
|
|
subPath: homeserver.yaml
|
|
# Scratch space so the read-only root filesystem never blocks
|
|
# temp-file writes (e.g. URL-preview downloads).
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
volumes:
|
|
- name: tmp
|
|
emptyDir: {}
|
|
- name: matrix-synapse-volume
|
|
persistentVolumeClaim:
|
|
claimName: {{ .Release.Name }}-{{ .Chart.Name }}-pvc
|
|
- name: matrix-synapse-config-secret
|
|
secret:
|
|
secretName: {{ .Release.Name }}-{{ .Chart.Name }}-config-secret
|
|
items:
|
|
- key: homeserver.yaml
|
|
path: homeserver.yaml
|