helm-charts/matrix-synapse/templates/worker/deployment.yaml

{{- $needsVolumePermissions := and .Values.volumePermissions.enabled (or .Values.persistence.enabled .Values.persistence.existingClaim) }}
{{- $default := .Values.workers.default }}
{{- range $worker, $config := .Values.workers }}
{{- if $config.enabled }}
{{- $name := $worker | replace "_" "-" }}
{{- $app := $config.app | default $worker }}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "matrix-synapse.workername" (dict "root" $ "worker" $name) }}
  labels:
    {{- include "matrix-synapse.labels" $ | nindent 4 }}
    app.kubernetes.io/component: {{ $name }}
spec:
  replicas: {{ $config.replicaCount | default $default.replicaCount }}
  {{- with ($config.strategy | default $default.strategy) }}
  strategy:
    {{- toYaml . | nindent 4 }}
  {{- end }}
  selector:
    matchLabels:
      {{- include "matrix-synapse.selectorLabels" $ | nindent 6 }}
      app.kubernetes.io/component: {{ $name }}
  template:
    metadata:
      annotations:
        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") $ | sha256sum }}
        checksum/worker-config: {{ include (print $.Template.BasePath "/worker/configmap.yaml") $ | sha256sum }}
        checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") $ | sha256sum }}
      {{- with ($config.annotations | default $default.annotations) }}
        {{ . | toYaml | nindent 8 }}
      {{- end }}
      labels:
        {{- include "matrix-synapse.selectorLabels" $ | nindent 8 }}
        app.kubernetes.io/component: {{ $name }}
      {{- with ($config.labels | default $default.labels) }}
        {{ . | toYaml | nindent 8 }}
      {{- end }}
    spec:
      serviceAccountName: {{ include "matrix-synapse.serviceAccountName" $ }}
      {{- include "matrix-synapse.imagePullSecrets" $ | nindent 6 }}
      securityContext:
        {{- $config.podSecurityContext | default $default.podSecurityContext | toYaml | nindent 8 }}
    {{- if and $needsVolumePermissions (eq $name "media-repository") }}
      initContainers:
        - name: volume-permissions
          {{- with $.Values.volumePermissions.image }}
          image: "{{ coalesce $.Values.global.image.registry .registry }}/{{ .repository }}:{{ .tag }}"
          imagePullPolicy: {{ coalesce $.Values.global.image.pullPolicy .pullPolicy }}
          {{- end }}
          command:
            - sh
            - -c
            - |
              chown {{ $.Values.volumePermissions.uid }}:{{ $.Values.volumePermissions.gid }} -R /synapse/data
          securityContext:
            runAsNonRoot: false
            runAsUser: 0
          resources: {{ $.Values.volumePermissions.resources | toYaml | nindent 12 }}
          volumeMounts:
            - name: media
              mountPath: /synapse/data
    {{- end }}
      containers:
        - name: {{ $name }}
          command:
            - sh
            - -c
            - |
              cat /synapse/secrets/*.yaml | \
                sed -e "s/@@POSTGRES_PASSWORD@@/${POSTGRES_PASSWORD:-}/" \
                    -e "s/@@REDIS_PASSWORD@@/${REDIS_PASSWORD:-}/" \
                       > /synapse/config/conf.d/secrets.yaml

              {{- if (or $config.extraCommands $default.extraCommands) }}

              {{- with $config.extraCommands | default $default.extraCommands }}
              {{ range . }}
              {{ . | nindent 14 }}
              {{- end }}
              {{- end }}
              {{- end }}

              exec python -B -m synapse.app.{{ (not (not $config.generic)) | ternary "generic_worker" $app }} \
                          -c /synapse/config/homeserver.yaml \
                          -c /synapse/config/conf.d/ \
                          -c /synapse/config/{{ $name }}.worker
          env:
          {{- if or $.Values.postgresql.enabled $.Values.externalPostgresql.existingSecret }}
            - name: POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef:
                  {{- if $.Values.postgresql.enabled }}
                  name: {{ $.Values.postgresql.existingSecret | default (include "matrix-synapse.postgresql.fullname" $) }}
                  key: password
                  {{- else }}
                  name: {{ $.Values.externalPostgresql.existingSecret }}
                  key: {{ $.Values.externalPostgresql.existingSecretPasswordKey }}
                  {{- end }}
          {{- end }}
          {{- if or (and $.Values.redis.enabled (default $.Values.redis.usePassword true)) $.Values.externalRedis.existingSecret }}
            - name: REDIS_PASSWORD
              valueFrom:
                secretKeyRef:
                  {{- if $.Values.redis.enabled }}
                  name: {{ $.Values.redis.auth.existingSecret | default (include "matrix-synapse.redis.fullname" $) }}
                  key: redis-password
                  {{- else }}
                  name: {{ $.Values.externalRedis.existingSecret }}
                  key: {{ $.Values.externalRedis.existingSecretPasswordKey }}
                  {{- end -}}
          {{- end }}
          {{- with $config.extraEnv | default $default.extraEnv }}
            {{- . | toYaml | nindent 12 }}
          {{- end }}
          securityContext:
            {{- $config.securityContext | default $default.securityContext | toYaml | nindent 12 }}
          {{- with $.Values.image }}
          image: "{{ coalesce $.Values.global.image.registry .registry }}/{{ .repository }}:{{ .tag | default (printf "v%s" $.Chart.AppVersion) }}"
          imagePullPolicy: {{ coalesce $.Values.global.image.pullPolicy .pullPolicy }}
          {{- end }}
          ports:
            - name: metrics
              containerPort: 9090
              protocol: TCP
          {{- if $config.listeners }}
            - name: listener
              containerPort: 8083
              protocol: TCP
            {{- if has "replication" $config.listeners }}
            - name: replication
              containerPort: 9093
              protocol: TCP
            {{- end }}
            {{- if (or $config.readinessProbe $default.readinessProbe) }}
          readinessProbe:
              {{- $config.readinessProbe | default $default.readinessProbe | toYaml | nindent 12 }}
            {{- end }}
          {{- end }}
          {{- if (or $config.livenessProbe $default.livenessProbe) }}
          livenessProbe:
              {{- $config.livenessProbe | default $default.livenessProbe | toYaml | nindent 12 }}
          {{- end }}
          {{- if (or $config.startupProbe $default.startupProbe) }}
          startupProbe:
              {{- $config.startupProbe | default $default.startupProbe | toYaml | nindent 12 }}
          {{- end }}
          resources:
            {{- $config.resources | default $default.resources | toYaml | nindent 12 }}
          volumeMounts:
            - name: config
              mountPath: /synapse/config/homeserver.yaml
              subPath: homeserver.yaml
            - name: config
              mountPath: /synapse/config/log.yaml
              subPath: log.yaml
            - name: worker-config
              mountPath: /synapse/config/{{ $name }}.worker
              subPath: {{ $name }}.worker
            - name: tmpconf
              mountPath: /synapse/config/conf.d
            - name: secrets
              mountPath: /synapse/secrets
            - name: signingkey
              mountPath: /synapse/keys
          {{- if eq $name "media-repository" }}
            - name: media
              mountPath: /synapse/data
          {{- end }}
          {{- with $config.volumeMounts | default $default.volumeMounts }}
            {{ . | toYaml | nindent 12 }}
          {{- end }}
      {{- with $config.nodeSelector | default $default.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
    {{- with $config.affinity | default $default.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
    {{- end }}
    {{- with $config.tolerations | default $default.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
    {{- end }}
      volumes:
        - name: config
          configMap:
            name: {{ include "matrix-synapse.fullname" $ }}
        - name: worker-config
          configMap:
            name: {{ include "matrix-synapse.workername" (dict "root" $ "worker" "workers") }}
        - name: secrets
          secret:
            secretName: {{ include "matrix-synapse.fullname" $ }}
        - name: signingkey
          secret:
            secretName: {{ $.Values.signingkey.existingSecret | default (include "matrix-synapse.workername" (dict "root" $ "worker" "signingkey")) | quote }}
            items:
              - key: {{ $.Values.signingkey.existingSecretKey | default "signing.key" | quote }}
                path: signing.key
        - name: tmpconf
          emptyDir: {}
        {{- if eq $name "media-repository" }}
        - name: media
          {{- if $.Values.persistence.hostPath }}
          hostPath:
            type: Directory
            path: {{ .Values.persistence.hostPath | quote }}
          {{- else if $.Values.persistence.enabled }}
          persistentVolumeClaim:
            claimName: {{ $.Values.persistence.existingClaim | default (include "matrix-synapse.fullname" $) }}
          {{- else }}
          emptyDir: {}
          {{- end }}
        {{- end }}{{/* end-if media-repository */}}
        {{- with $config.volumes | default $default.volumes }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
{{- end }}
{{- end }}