217 lines
9.1 KiB
YAML
217 lines
9.1 KiB
YAML
{{- $needsVolumePermissions := and .Values.volumePermissions.enabled (or .Values.persistence.enabled .Values.persistence.existingClaim) }}
|
|
{{- $default := .Values.workers.default }}
|
|
{{- range $worker, $config := .Values.workers }}
|
|
{{- if $config.enabled }}
|
|
{{- $name := $worker | replace "_" "-" }}
|
|
{{- $app := $config.app | default $worker }}
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: {{ include "matrix-synapse.workername" (dict "root" $ "worker" $name) }}
|
|
labels:
|
|
{{- include "matrix-synapse.labels" $ | nindent 4 }}
|
|
app.kubernetes.io/component: {{ $name }}
|
|
spec:
|
|
replicas: {{ $config.replicaCount | default $default.replicaCount }}
|
|
{{- with ($config.strategy | default $default.strategy) }}
|
|
strategy:
|
|
{{- toYaml . | nindent 4 }}
|
|
{{- end }}
|
|
selector:
|
|
matchLabels:
|
|
{{- include "matrix-synapse.selectorLabels" $ | nindent 6 }}
|
|
app.kubernetes.io/component: {{ $name }}
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") $ | sha256sum }}
|
|
checksum/worker-config: {{ include (print $.Template.BasePath "/worker/configmap.yaml") $ | sha256sum }}
|
|
checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") $ | sha256sum }}
|
|
{{- with ($config.annotations | default $default.annotations) }}
|
|
{{ . | toYaml | nindent 8 }}
|
|
{{- end }}
|
|
labels:
|
|
{{- include "matrix-synapse.selectorLabels" $ | nindent 8 }}
|
|
app.kubernetes.io/component: {{ $name }}
|
|
{{- with ($config.labels | default $default.labels) }}
|
|
{{ . | toYaml | nindent 8 }}
|
|
{{- end }}
|
|
spec:
|
|
serviceAccountName: {{ include "matrix-synapse.serviceAccountName" $ }}
|
|
{{- include "matrix-synapse.imagePullSecrets" $ | nindent 6 }}
|
|
securityContext:
|
|
{{- $config.podSecurityContext | default $default.podSecurityContext | toYaml | nindent 8 }}
|
|
{{- if and $needsVolumePermissions (eq $name "media-repository") }}
|
|
initContainers:
|
|
- name: volume-permissions
|
|
{{- with $.Values.volumePermissions.image }}
|
|
image: "{{ coalesce $.Values.global.image.registry .registry }}/{{ .repository }}:{{ .tag }}"
|
|
imagePullPolicy: {{ coalesce $.Values.global.image.pullPolicy .pullPolicy }}
|
|
{{- end }}
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
chown {{ $.Values.volumePermissions.uid }}:{{ $.Values.volumePermissions.gid }} -R /synapse/data
|
|
securityContext:
|
|
runAsNonRoot: false
|
|
runAsUser: 0
|
|
resources: {{ $.Values.volumePermissions.resources | toYaml | nindent 12 }}
|
|
volumeMounts:
|
|
- name: media
|
|
mountPath: /synapse/data
|
|
{{- end }}
|
|
containers:
|
|
- name: {{ $name }}
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
cat /synapse/secrets/*.yaml | \
|
|
sed -e "s/@@POSTGRES_PASSWORD@@/${POSTGRES_PASSWORD:-}/" \
|
|
-e "s/@@REDIS_PASSWORD@@/${REDIS_PASSWORD:-}/" \
|
|
> /synapse/config/conf.d/secrets.yaml
|
|
|
|
{{- if (or $config.extraCommands $default.extraCommands) }}
|
|
|
|
{{- with $config.extraCommands | default $default.extraCommands }}
|
|
{{ range . }}
|
|
{{ . | nindent 14 }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
exec python -B -m synapse.app.{{ (not (not $config.generic)) | ternary "generic_worker" $app }} \
|
|
-c /synapse/config/homeserver.yaml \
|
|
-c /synapse/config/conf.d/ \
|
|
-c /synapse/config/{{ $name }}.worker
|
|
env:
|
|
{{- if or $.Values.postgresql.enabled $.Values.externalPostgresql.existingSecret }}
|
|
- name: POSTGRES_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
{{- if $.Values.postgresql.enabled }}
|
|
name: {{ $.Values.postgresql.existingSecret | default (include "matrix-synapse.postgresql.fullname" $) }}
|
|
key: password
|
|
{{- else }}
|
|
name: {{ $.Values.externalPostgresql.existingSecret }}
|
|
key: {{ $.Values.externalPostgresql.existingSecretPasswordKey }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if or (and $.Values.redis.enabled (default $.Values.redis.usePassword true)) $.Values.externalRedis.existingSecret }}
|
|
- name: REDIS_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
{{- if $.Values.redis.enabled }}
|
|
name: {{ $.Values.redis.auth.existingSecret | default (include "matrix-synapse.redis.fullname" $) }}
|
|
key: redis-password
|
|
{{- else }}
|
|
name: {{ $.Values.externalRedis.existingSecret }}
|
|
key: {{ $.Values.externalRedis.existingSecretPasswordKey }}
|
|
{{- end -}}
|
|
{{- end }}
|
|
{{- with $config.extraEnv | default $default.extraEnv }}
|
|
{{- . | toYaml | nindent 12 }}
|
|
{{- end }}
|
|
securityContext:
|
|
{{- $config.securityContext | default $default.securityContext | toYaml | nindent 12 }}
|
|
{{- with $.Values.image }}
|
|
image: "{{ coalesce $.Values.global.image.registry .registry }}/{{ .repository }}:{{ .tag | default (printf "v%s" $.Chart.AppVersion) }}"
|
|
imagePullPolicy: {{ coalesce $.Values.global.image.pullPolicy .pullPolicy }}
|
|
{{- end }}
|
|
ports:
|
|
- name: metrics
|
|
containerPort: 9090
|
|
protocol: TCP
|
|
{{- if $config.listeners }}
|
|
- name: listener
|
|
containerPort: 8083
|
|
protocol: TCP
|
|
{{- if has "replication" $config.listeners }}
|
|
- name: replication
|
|
containerPort: 9093
|
|
protocol: TCP
|
|
{{- end }}
|
|
{{- if (or $config.readinessProbe $default.readinessProbe) }}
|
|
readinessProbe:
|
|
{{- $config.readinessProbe | default $default.readinessProbe | toYaml | nindent 12 }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if (or $config.livenessProbe $default.livenessProbe) }}
|
|
livenessProbe:
|
|
{{- $config.livenessProbe | default $default.livenessProbe | toYaml | nindent 12 }}
|
|
{{- end }}
|
|
{{- if (or $config.startupProbe $default.startupProbe) }}
|
|
startupProbe:
|
|
{{- $config.startupProbe | default $default.startupProbe | toYaml | nindent 12 }}
|
|
{{- end }}
|
|
resources:
|
|
{{- $config.resources | default $default.resources | toYaml | nindent 12 }}
|
|
volumeMounts:
|
|
- name: config
|
|
mountPath: /synapse/config/homeserver.yaml
|
|
subPath: homeserver.yaml
|
|
- name: config
|
|
mountPath: /synapse/config/log.yaml
|
|
subPath: log.yaml
|
|
- name: worker-config
|
|
mountPath: /synapse/config/{{ $name }}.worker
|
|
subPath: {{ $name }}.worker
|
|
- name: tmpconf
|
|
mountPath: /synapse/config/conf.d
|
|
- name: secrets
|
|
mountPath: /synapse/secrets
|
|
- name: signingkey
|
|
mountPath: /synapse/keys
|
|
{{- if eq $name "media-repository" }}
|
|
- name: media
|
|
mountPath: /synapse/data
|
|
{{- end }}
|
|
{{- with $config.volumeMounts | default $default.volumeMounts }}
|
|
{{ . | toYaml | nindent 12 }}
|
|
{{- end }}
|
|
{{- with $config.nodeSelector | default $default.nodeSelector }}
|
|
nodeSelector:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with $config.affinity | default $default.affinity }}
|
|
affinity:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with $config.tolerations | default $default.tolerations }}
|
|
tolerations:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
volumes:
|
|
- name: config
|
|
configMap:
|
|
name: {{ include "matrix-synapse.fullname" $ }}
|
|
- name: worker-config
|
|
configMap:
|
|
name: {{ include "matrix-synapse.workername" (dict "root" $ "worker" "workers") }}
|
|
- name: secrets
|
|
secret:
|
|
secretName: {{ include "matrix-synapse.fullname" $ }}
|
|
- name: signingkey
|
|
secret:
|
|
secretName: {{ $.Values.signingkey.existingSecret | default (include "matrix-synapse.workername" (dict "root" $ "worker" "signingkey")) | quote }}
|
|
items:
|
|
- key: {{ $.Values.signingkey.existingSecretKey | default "signing.key" | quote }}
|
|
path: signing.key
|
|
- name: tmpconf
|
|
emptyDir: {}
|
|
{{- if eq $name "media-repository" }}
|
|
- name: media
|
|
{{- if $.Values.persistence.enabled }}
|
|
persistentVolumeClaim:
|
|
claimName: {{ $.Values.persistence.existingClaim | default (include "matrix-synapse.fullname" $) }}
|
|
{{- else }}
|
|
emptyDir: {}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- with $config.volumes | default $default.volumes }}
|
|
{{ . | toYaml | nindent 8 }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|