helm-charts/matrix-synapse/templates/deployment.yaml

{{- $needsVolumePermissions := and .Values.volumePermissions.enabled (or .Values.persistence.enabled .Values.persistence.existingClaim) }}
{{- if (and .Values.postgresql.enabled (and (not .Values.postgresql.auth.password) (not .Values.postgresql.existingSecret))) -}}
{{-  fail "You must specify a static postgres password or existing secret if using the included postgres chart" -}}
{{- end -}}
{{- if (and .Values.redis.enabled (and .Values.redis.usePassword (and (not .Values.redis.auth.password) (not .Values.redis.auth.existingSecret)))) -}}
{{-  fail "You must specify a static redis password or existing secret if using the included redis chart" -}}
{{- end -}}
---
# Server: {{ required "A valid serverName is required" .Values.serverName }}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "matrix-synapse.fullname" . }}
  labels:
    {{- include "matrix-synapse.labels" . | nindent 4 }}
    app.kubernetes.io/component: synapse
spec:
  replicas: 1
  strategy:
    {{- toYaml .Values.synapse.strategy | nindent 4 }}
  selector:
    matchLabels:
      {{- include "matrix-synapse.selectorLabels" . | nindent 6 }}
      app.kubernetes.io/component: synapse
  template:
    metadata:
      annotations:
        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
        checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
        {{- with .Values.synapse.annotations }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
      labels:
        {{- include "matrix-synapse.selectorLabels" . | nindent 8 }}
        app.kubernetes.io/component: synapse
        {{- with .Values.synapse.labels }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
    spec:
      serviceAccountName: {{ include "matrix-synapse.serviceAccountName" . }}
      {{- include "matrix-synapse.imagePullSecrets" . | nindent 6 }}
      securityContext:
        {{- toYaml .Values.synapse.podSecurityContext | nindent 8 }}
      {{- if $needsVolumePermissions }}
      initContainers:
        - name: volume-permissions
          command:
            - sh
            - -c
            - |
              chown {{ .Values.volumePermissions.uid }}:{{ .Values.volumePermissions.gid }} -R /synapse/data
          {{- with .Values.volumePermissions.image }}
          image: "{{ coalesce $.Values.global.image.registry .registry }}/{{ .repository }}:{{ .tag }}"
          imagePullPolicy: {{ coalesce $.Values.global.image.pullPolicy .pullPolicy }}
          {{- end }}
          resources:
            {{- toYaml .Values.volumePermissions.resources | nindent 12 }}
          securityContext:
            runAsNonRoot: false
            runAsUser: 0
          volumeMounts:
            - name: media
              mountPath: /synapse/data
      {{- end }}
      containers:
        - name: synapse
          {{- with .Values.image }}
          image: "{{ coalesce $.Values.global.image.registry .registry }}/{{ .repository }}:{{ .tag | default (printf "v%s" $.Chart.AppVersion) }}"
          imagePullPolicy: {{ coalesce $.Values.global.image.pullPolicy .pullPolicy }}
          {{- end }}
          env:
          {{- if or .Values.postgresql.enabled .Values.externalPostgresql.existingSecret }}
            - name: POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef:
                  {{- if .Values.postgresql.enabled }}
                  name: {{ .Values.postgresql.existingSecret | default (include "matrix-synapse.postgresql.fullname" .) }}
                  key: password
                  {{- else }}
                  name: {{ .Values.externalPostgresql.existingSecret }}
                  key: {{ .Values.externalPostgresql.existingSecretPasswordKey }}
                  {{- end }}
          {{- end }}
          {{- if or (and .Values.redis.enabled (default .Values.redis.usePassword true)) .Values.externalRedis.existingSecret }}
            - name: REDIS_PASSWORD
              valueFrom:
                secretKeyRef:
                  {{- if .Values.redis.enabled }}
                  name: {{ .Values.redis.auth.existingSecret | default (include "matrix-synapse.redis.fullname" .) }}
                  key: redis-password
                  {{- else }}
                  name: {{ .Values.externalRedis.existingSecret }}
                  key: {{ .Values.externalRedis.existingSecretPasswordKey }}
                  {{- end -}}
          {{- end }}
          {{- with .Values.synapse.extraEnv }}
            {{- . | toYaml | nindent 12 }}
          {{- end }}
          command:
            - sh
            - -c
            - |
              cat /synapse/secrets/*.yaml | \
                sed -e "s/@@POSTGRES_PASSWORD@@/${POSTGRES_PASSWORD:-}/" \
                    -e "s/@@REDIS_PASSWORD@@/${REDIS_PASSWORD:-}/" \
                       > /synapse/config/conf.d/secrets.yaml

              {{- if .Values.synapse.extraCommands }}

              {{ range .Values.synapse.extraCommands }}
              {{ . }}
              {{- end }}
              {{- end }}

              exec python -B -m synapse.app.homeserver \
                          -c /synapse/config/homeserver.yaml \
                          -c /synapse/config/conf.d/
          securityContext:
            {{- toYaml .Values.synapse.securityContext | nindent 12 }}
          ports:
            - name: http
              containerPort: 8008
              protocol: TCP
            - name: replication
              containerPort: 9093
              protocol: TCP
            - name: metrics
              containerPort: 9090
              protocol: TCP
          {{- with .Values.synapse.livenessProbe }}
          livenessProbe:
            {{- . | toYaml | nindent 12 }}
          {{- end }}
          {{- with .Values.synapse.readinessProbe }}
          readinessProbe:
            {{- . | toYaml | nindent 12 }}
          {{- end }}
          {{- with .Values.synapse.startupProbe }}
          startupProbe:
            {{- . | toYaml | nindent 12 }}
          {{- end }}
          volumeMounts:
            - name: config
              mountPath: /synapse/config
            - name: tmpconf
              mountPath: /synapse/config/conf.d
            - name: secrets
              mountPath: /synapse/secrets
            - name: signingkey
              mountPath: /synapse/keys
            - name: media
              mountPath: /synapse/data
            - name: tmpdir
              mountPath: /tmp
            {{- with .Values.synapse.extraVolumeMounts }}
            {{- . | toYaml | nindent 12 }}
            {{- end }}
          resources:
            {{- toYaml .Values.synapse.resources | nindent 12 }}
      volumes:
        - name: config
          configMap:
            name: {{ include "matrix-synapse.fullname" . }}
        - name: secrets
          secret:
            secretName: {{ include "matrix-synapse.fullname" . }}
        - name: signingkey
          secret:
            secretName: {{ .Values.signingkey.existingSecret | default (include "matrix-synapse.workername" (dict "root" . "worker" "signingkey")) | quote }}
            items:
              - key: {{ .Values.signingkey.existingSecretKey | default "signing.key" | quote }}
                path: signing.key
        - name: tmpconf
          emptyDir: {}
        - name: tmpdir
          emptyDir: {}
        - name: media
          {{- $mediaworker := false }}
          {{- range $worker, $config := .Values.workers }}
          {{- if eq $worker "media_repository" }}
          {{- $mediaworker = ($config.enabled | default false) }}
          {{- end }}
          {{- end }}
          {{- if $mediaworker }}
          emptyDir: {}
          {{- else }}
          {{- if .Values.persistence.hostPath }}
          hostPath:
            type: Directory
            path: {{ .Values.persistence.hostPath | quote }}
          {{- else if .Values.persistence.enabled }}
          persistentVolumeClaim:
            claimName: {{ .Values.persistence.existingClaim | default (include "matrix-synapse.fullname" .) }}
          {{- else }}
          emptyDir: {}
          {{- end }}{{/* end-if hostPath+persistent*/}}
          {{- end }}{{/* end-if not $mediaworker */}}
        {{- with .Values.synapse.extraVolumes }}
        {{- . | toYaml | nindent 8 }}
        {{- end }}
      {{- with .Values.synapse.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.synapse.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.synapse.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}