jklein
1ddb5f457e
Three changes, across both workloads (Synapse StatefulSet and delegation nginx Deployment). 1. values.schema.json (#68): additionalProperties: false on every chart-owned object level, including the whole matrix.delegation block with its own contexts, probes and resources. 2. Ingress gate (#93): the Ingress template is wrapped in {{- if .Values.ingress.enabled }} and the key is added to values.yaml with default true, so behaviour is unchanged. The domain checkpoint found a second reader: the delegation nginx serves ingress.domain in its /.well-known/matrix/{server,client} endpoints, and read it without a guard. Gating alone would therefore have published '{"m.server": ":443"}' and base_url "https://" - a federation-breaking answer that renders and starts cleanly. Both reads are now required(), so that case fails loudly. Only clusterIssuer actually becomes unnecessary when the Ingress is off. 3. Null-safety for hardening, probes and resources (#99) for both workloads. The rebuilt probes keep each workload's own endpoint: Synapse /health, delegation /.well-known/matrix/server - the endpoint that workload exists to serve - including its shorter 3s timeout. The delegation pod context keeps having no fsGroup, because it mounts no volume that needs one. The nginx checksum/config annotation from #82 is untouched. storage stays deliberately not null-safe: an erased block yields an invalid PVC, which is the loud class #99 excludes. Rendering is byte-identical to 6.0.0, both with the CI values (which enable delegation) and with the production bundle values.
46 lines
1.6 KiB
YAML
46 lines
1.6 KiB
YAML
{{- if .Values.ingress.enabled }}
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-ingress
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: {{ required "A Cluster-Issuer must be provided" .Values.ingress.clusterIssuer }}
|
|
{{- with .Values.ingress.annotations }}
|
|
{{- toYaml . | nindent 4 }}
|
|
{{- end }}
|
|
spec:
|
|
ingressClassName: {{ .Values.ingress.className }}
|
|
rules:
|
|
- host: {{ required "A Domain/Host must be provided" .Values.ingress.domain }}
|
|
http:
|
|
paths:
|
|
- backend:
|
|
service:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-service
|
|
port:
|
|
name: http
|
|
path: /
|
|
pathType: Prefix
|
|
{{- if .Values.matrix.delegation.enabled }}
|
|
- host: {{ required "If delegation is enabled you must provide a serverUrl" .Values.matrix.delegation.serverUrl }}
|
|
http:
|
|
paths:
|
|
- backend:
|
|
service:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-delegation-service
|
|
port:
|
|
name: http
|
|
path: /.well-known/matrix
|
|
pathType: Prefix
|
|
{{- end }}
|
|
tls:
|
|
{{- if .Values.matrix.delegation.enabled }}
|
|
- hosts:
|
|
- {{ required "A Domain/Host must be provided" .Values.matrix.delegation.serverUrl }}
|
|
secretName: tls-{{ .Release.Name }}-{{ .Chart.Name }}-delegation
|
|
{{- end }}
|
|
- hosts:
|
|
- {{ required "A Domain/Host must be provided" .Values.ingress.domain }}
|
|
secretName: tls-{{ .Release.Name }}-{{ .Chart.Name }}-ingress
|
|
{{- end }}
|