246 lines
8.4 KiB
YAML
246 lines
8.4 KiB
YAML
{{- if not .Values.config.serverName -}}
|
|
{{- fail "A valid .Values.config.serverName is required" -}}
|
|
{{- end -}}
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: {{ include "matrix-synapse.fullname" . }}
|
|
labels:
|
|
{{- include "matrix-synapse.labels" . | nindent 4 }}
|
|
component: synapse
|
|
spec:
|
|
replicas: {{ .Values.replicaCount }}
|
|
selector:
|
|
matchLabels:
|
|
{{- include "matrix-synapse.selectorLabels" . | nindent 6 }}
|
|
component: synapse
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
checksum/config: {{ include (print $.Template.BasePath "/configuration.yaml") . | sha256sum }}
|
|
checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
|
|
labels:
|
|
{{- include "matrix-synapse.selectorLabels" . | nindent 8 }}
|
|
component: synapse
|
|
spec:
|
|
{{- with .Values.imagePullSecrets }}
|
|
imagePullSecrets:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
securityContext:
|
|
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
|
containers:
|
|
- name: {{ .Chart.Name }}
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
cat /synapse/secrets/*.yaml | \
|
|
sed -e "s/@@POSTGRES_PASSWORD@@/${POSTGRES_PASSWORD:-}/" \
|
|
-e "s/@@REDIS_PASSWORD@@/${REDIS_PASSWORD:-}/" \
|
|
> /synapse/config/conf.d/secrets.yaml
|
|
|
|
/matrix-synapse $@
|
|
args:
|
|
- synapse.app.homeserver
|
|
env:
|
|
{{- if .Values.postgresql.enabled }}
|
|
- name: POSTGRES_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ include "matrix-synapse.postgresql.fullname" . }}
|
|
key: postgresql-password
|
|
{{- end }}
|
|
{{- if and .Values.redis.enabled (default .Values.redis.usePassword true) }}
|
|
- name: REDIS_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ include "matrix-synapse.redis.fullname" . }}
|
|
key: redis-password
|
|
{{- end }}
|
|
securityContext:
|
|
{{- toYaml .Values.securityContext | nindent 12 }}
|
|
image: "{{ .Values.image.repository }}:{{ include "matrix-synapse.imageTag" . }}"
|
|
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
|
ports:
|
|
- name: http
|
|
containerPort: 8008
|
|
protocol: TCP
|
|
- name: replication
|
|
containerPort: 9093
|
|
protocol: TCP
|
|
- name: metrics
|
|
containerPort: 9090
|
|
protocol: TCP
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /_matrix/client/versions
|
|
port: http
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /_matrix/client/versions
|
|
port: http
|
|
volumeMounts:
|
|
- name: config
|
|
mountPath: /synapse/config
|
|
- name: tmpconf
|
|
mountPath: /synapse/config/conf.d
|
|
- name: secrets
|
|
mountPath: /synapse/secrets
|
|
- name: signingkey
|
|
mountPath: /synapse/keys
|
|
resources:
|
|
{{- toYaml .Values.resources | nindent 12 }}
|
|
volumes:
|
|
- name: config
|
|
configMap:
|
|
name: {{ include "matrix-synapse.fullname" . }}
|
|
- name: secrets
|
|
secret:
|
|
secretName: {{ include "matrix-synapse.fullname" . }}
|
|
- name: signingkey
|
|
secret:
|
|
secretName: {{ default .Values.signingkey.existingSecret (include "matrix-synapse.workername" (dict "global" . "worker" "signingkey")) | quote }}
|
|
items:
|
|
- key: {{ default .Values.signingkey.existingSecretKey "signing.key" | quote }}
|
|
path: signing.key
|
|
- name: tmpconf
|
|
emptyDir: {}
|
|
{{- with .Values.nodeSelector }}
|
|
nodeSelector:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.affinity }}
|
|
affinity:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.tolerations }}
|
|
tolerations:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
|
|
{{- $default := .Values.workers.default }}
|
|
{{- range $worker, $config := .Values.workers }}
|
|
{{- if $config.enabled }}
|
|
{{- $name := $worker | replace "_" "-" }}
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: {{ include "matrix-synapse.workername" (dict "global" $ "worker" $name) }}
|
|
labels:
|
|
{{- include "matrix-synapse.labels" $ | nindent 4 }}
|
|
component: worker
|
|
worker: {{ $name }}
|
|
spec:
|
|
replicas: {{ $config.replicaCount | default $default.replicaCount }}
|
|
selector:
|
|
matchLabels:
|
|
{{- include "matrix-synapse.selectorLabels" $ | nindent 6 }}
|
|
component: worker
|
|
worker: {{ $name }}
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
checksum/config: {{ include (print $.Template.BasePath "/configuration.yaml") $ | sha256sum }}
|
|
checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") $ | sha256sum }}
|
|
labels:
|
|
{{- include "matrix-synapse.selectorLabels" $ | nindent 8 }}
|
|
component: worker
|
|
worker: {{ $name }}
|
|
spec:
|
|
{{- with $.Values.imagePullSecrets }}
|
|
imagePullSecrets:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
securityContext:
|
|
{{- $config.podSecurityContext | default $default.podSecurityContext | toYaml | nindent 8 }}
|
|
containers:
|
|
- name: {{ $name }}
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
cat /synapse/secrets/*.yaml | \
|
|
sed -e "s/@@POSTGRES_PASSWORD@@/${POSTGRES_PASSWORD:-}/" \
|
|
-e "s/@@REDIS_PASSWORD@@/${REDIS_PASSWORD:-}/" \
|
|
> /synapse/config/conf.d/secrets.yaml
|
|
|
|
/matrix-synapse synapse.app.{{ $worker }} -c /synapse/config/{{ $name }}.worker
|
|
securityContext:
|
|
{{- $config.securityContext | default $default.securityContext | toYaml | nindent 12 }}
|
|
image: "{{ $.Values.image.repository }}:{{ $.Chart.AppVersion }}"
|
|
imagePullPolicy: {{ $.Values.image.pullPolicy }}
|
|
ports:
|
|
{{- if $config.metrics | default $default.metrics }}
|
|
- name: metrics
|
|
containerPort: 9090
|
|
protocol: TCP
|
|
{{- end }}
|
|
{{- if $config.listeners }}
|
|
- name: listener
|
|
containerPort: 8083
|
|
protocol: TCP
|
|
livenessProbe:
|
|
tcpSocket:
|
|
port: listener
|
|
readinessProbe:
|
|
tcpSocket:
|
|
port: listener
|
|
{{- end }}
|
|
resources:
|
|
{{- $config.resources | default $default.resources | toYaml | nindent 12 }}
|
|
volumeMounts:
|
|
- name: config
|
|
mountPath: /synapse/config
|
|
- name: tmpconf
|
|
mountPath: /synapse/config/conf.d
|
|
- name: secrets
|
|
mountPath: /synapse/secrets
|
|
- name: signingkey
|
|
mountPath: /synapse/keys
|
|
{{- if eq $name "media-repository" }}
|
|
- name: media
|
|
mountPath: /synapse/data
|
|
{{- end }}
|
|
{{- with $config.volumeMounts | default $default.volumeMounts }}
|
|
{{ . | toYaml | nindent 12 }}
|
|
{{- end }}
|
|
{{- with $config.nodeSelector | default $default.nodeSelector }}
|
|
nodeSelector:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with $config.affinity | default $default.affinity }}
|
|
affinity:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with $config.tolerations | default $default.tolerations }}
|
|
tolerations:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
volumes:
|
|
- name: config
|
|
configMap:
|
|
name: {{ include "matrix-synapse.fullname" $ }}
|
|
- name: secrets
|
|
secret:
|
|
secretName: {{ include "matrix-synapse.fullname" $ }}
|
|
- name: signingkey
|
|
secret:
|
|
secretName: {{ default $.Values.signingkey.existingSecret (include "matrix-synapse.workername" (dict "global" $ "worker" "signingkey")) | quote }}
|
|
items:
|
|
- key: {{ default $.Values.signingkey.existingSecretKey "signing.key" | quote }}
|
|
path: signing.key
|
|
- name: tmpconf
|
|
emptyDir: {}
|
|
{{- if eq $name "media-repository" }}
|
|
- name: media
|
|
persistentVolumeClaim:
|
|
claimName:
|
|
{{- end }}
|
|
{{- with $config.volumes }}
|
|
{{ . | toYaml | nindent 8 }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|