Skip to content

Commit 9f5e019

Browse files
gaelgatelementgaelgatelement
committed
fix postgres labels
1 parent 686ff3b commit 9f5e019

File tree

11 files changed

+426
-14
lines changed

11 files changed

+426
-14
lines changed

‎charts/matrix-stack/source/matrixAuthenticationService.json

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,33 @@
5454
"dryRun": {
5555
"type": "boolean",
5656
"description": "Run the migration job in dry-run mode. Do not actually migrate the data."
57+
},
58+
"labels": {
59+
"$ref": "file://common/labels.json"
60+
},
61+
"annotations": {
62+
"$ref": "file://common/workloadAnnotations.json"
63+
},
64+
"extraEnv": {
65+
"$ref": "file://common/extraEnv.json"
66+
},
67+
"containersSecurityContext": {
68+
"$ref": "file://common/containersSecurityContext.json"
69+
},
70+
"nodeSelector": {
71+
"$ref": "file://common/nodeSelector.json"
72+
},
73+
"podSecurityContext": {
74+
"$ref": "file://common/podSecurityContext.json"
75+
},
76+
"resources": {
77+
"$ref": "file://common/resources.json"
78+
},
79+
"serviceAccount": {
80+
"$ref": "file://common/serviceAccount.json"
81+
},
82+
"tolerations": {
83+
"$ref": "file://common/tolerations.json"
5784
}
5885
}
5986
},

‎charts/matrix-stack/source/matrixAuthenticationService.yaml.j2

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ privateKeys:
3030
{{ sub_schema_values.serviceAccount() }}
3131
{{ sub_schema_values.nodeSelector() }}
3232
{{ sub_schema_values.tolerations() }}
33+
{{ sub_schema_values.hostAliases() }}
3334
{{ sub_schema_values.topologySpreadConstraints() }}
3435
{{ sub_schema_values.podSecurityContext(user_id=10005, group_id=10005) }}
3536
{{ sub_schema_values.containersSecurityContext() }}
@@ -50,6 +51,14 @@ syn2mas:
5051

5152
# Syn2Mas relies on the debug image to copy mas-cli to the matrix-tools container
5253
{{- sub_schema_values.image(registry='ghcr.io', repository='element-hq/matrix-authentication-service', tag='0.16.0-debug') | indent(2) }}
54+
{{- sub_schema_values.labels() | indent(2) -}}
55+
{{- sub_schema_values.workloadAnnotations() | indent(2) -}}
56+
{{- sub_schema_values.containersSecurityContext() | indent(2) -}}
57+
{{- sub_schema_values.nodeSelector() | indent(2) -}}
58+
{{- sub_schema_values.podSecurityContext(user_id='10005', group_id='10005') | indent(2) -}}
59+
{{- sub_schema_values.resources(requests_memory='50Mi', requests_cpu='50m', limits_memory='350Mi') | indent(2) -}}
60+
{{- sub_schema_values.serviceAccount() | indent(2) -}}
61+
{{- sub_schema_values.tolerations() | indent(2) }}
5362

5463
## Runs the syn2mas process in dryRun mode.
5564
## Force the authentication to happen with legacy authentication.

‎charts/matrix-stack/templates/ess-library/_labels.tpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ app.kubernetes.io/part-of: matrix-stack
3939
{{- with required "element-io.ess-library.postgres-label requires context" .context -}}
4040
{{- $essPassword := required "element-io.ess-library.postgres-label context missing essPassword" .essPassword -}}
4141
{{- $postgresProperty := required "elment-io.ess-library.postgres-label context missing postgresProperty" .postgresProperty -}}
42-
k8s.element.io/postgres-password-hash: {{ if $postgresProperty -}}
42+
k8s.element.io/postgres-password-{{ $essPassword | lower }}-hash: {{ if $postgresProperty -}}
4343
{{- if $postgresProperty.password.value -}}
4444
{{- $postgresProperty.password.value | sha1sum -}}
4545
{{- else -}}

‎charts/matrix-stack/templates/matrix-authentication-service/syn2mas_job.yaml

Lines changed: 12 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ SPDX-License-Identifier: AGPL-3.0-only
1010
{{- $isHook := (not .syn2mas.dryRun) -}}
1111
{{- $synapseContext := (mustMergeOverwrite ($.Values.synapse | deepCopy) (dict "processType" "main" "isHook" $isHook)) -}}
1212
{{- $masContext := (mustMergeOverwrite ($.Values.matrixAuthenticationService | deepCopy) (dict "isHook" $isHook)) -}}
13-
{{- with $masContext -}}
13+
{{- with (mustMergeOverwrite ($.Values.matrixAuthenticationService.syn2mas | deepCopy) (dict "isHook" $isHook)) -}}
1414
apiVersion: batch/v1
1515
kind: Job
1616
metadata:
@@ -20,17 +20,22 @@ metadata:
2020
{{- end }}
2121
labels:
2222
{{- include "element-io.matrix-authentication-service-syn2mas.labels" (dict "root" $ "context" .) | nindent 4 }}
23-
k8s.element.io/matrix-authentication-service-config-hash: {{ include "element-io.matrix-authentication-service.configmap-data" (dict "root" $ "context" .) | sha1sum }}
24-
k8s.element.io/matrix-authentication-service-secret-hash: {{ include "element-io.matrix-authentication-service.secret-data" (dict "root" $ "context" .) | sha1sum }}
23+
k8s.element.io/matrix-authentication-service-config-hash: {{ include "element-io.matrix-authentication-service.configmap-data" (dict "root" $ "context" $masContext) | sha1sum }}
24+
k8s.element.io/matrix-authentication-service-secret-hash: {{ include "element-io.matrix-authentication-service.secret-data" (dict "root" $ "context" $masContext) | sha1sum }}
2525
k8s.element.io/synapse-config-hash: {{ include "element-io.synapse.configmap-data" (dict "root" $ "context" $synapseContext) | sha1sum }}
2626
k8s.element.io/synapse-secret-hash: {{ include "element-io.synapse.secret-data" (dict "root" $ "context" $synapseContext) | sha1sum }}
2727
{{ include "element-io.ess-library.postgres-label" (dict "root" $ "context" (dict
2828
"essPassword" "matrixAuthenticationService"
29-
"postgresProperty" .postgres
29+
"postgresProperty" $masContext.postgres
30+
)
31+
) }}
32+
{{ include "element-io.ess-library.postgres-label" (dict "root" $ "context" (dict
33+
"essPassword" "synapse"
34+
"postgresProperty" $synapseContext.postgres
3035
)
3136
) }}
3237
annotations:
33-
{{- if .syn2mas.dryRun }}
38+
{{- if .dryRun }}
3439
"helm.sh/hook": post-install,post-upgrade
3540
{{- else }}
3641
"helm.sh/hook": pre-install,pre-upgrade
@@ -64,7 +69,7 @@ spec:
6469
{{- include "element-io.ess-library.pods.commonSpec" (dict "root" $ "context" (dict "componentValues" . "instanceSuffix" "matrix-authentication-service-syn2mas" "deployment" false "usesMatrixTools" true "mountServiceAccountToken" true)) | nindent 6 }}
6570
initContainers:
6671
- name: copy-mas-cli
67-
{{- with .syn2mas.image -}}
72+
{{- with .image -}}
6873
{{- if .digest }}
6974
image: "{{ .registry }}/{{ .repository }}@{{ .digest }}"
7075
imagePullPolicy: {{ .pullPolicy | default "IfNotPresent" }}
@@ -240,7 +245,7 @@ spec:
240245
{{- end }}
241246
containers:
242247
- name: syn2mas-migrate
243-
{{- if .syn2mas.dryRun }}
248+
{{- if .dryRun }}
244249
args: ["syn2mas", "migrate", "--config", "/conf/config.yaml", "--synapse-config", "/conf/homeserver.yaml", "--dry-run"]
245250
{{- with .image -}}
246251
{{- if .digest }}

‎charts/matrix-stack/templates/matrix-authentication-service/syn2mas_role.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ SPDX-License-Identifier: AGPL-3.0-only
55
*/ -}}
66
{{- with .Values.matrixAuthenticationService -}}
77
{{- if and .enabled .syn2mas.enabled -}}
8+
{{- with .syn2mas -}}
89
apiVersion: rbac.authorization.k8s.io/v1
910
kind: Role
1011
metadata:
@@ -40,3 +41,4 @@ rules:
4041
verbs: ["get", "update"]
4142
{{- end -}}
4243
{{- end -}}
44+
{{- end -}}

‎charts/matrix-stack/templates/matrix-authentication-service/syn2mas_rolebinding.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ SPDX-License-Identifier: AGPL-3.0-only
66

77
{{- with .Values.matrixAuthenticationService -}}
88
{{- if and .enabled .syn2mas.enabled -}}
9+
{{- with .syn2mas -}}
910
apiVersion: rbac.authorization.k8s.io/v1
1011
kind: RoleBinding
1112
metadata:
@@ -32,3 +33,4 @@ subjects:
3233
namespace: {{ $.Release.Namespace }}
3334
{{- end -}}
3435
{{- end -}}
36+
{{- end -}}

‎charts/matrix-stack/templates/matrix-authentication-service/syn2mas_serviceaccount.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ SPDX-License-Identifier: AGPL-3.0-only
55
*/ -}}
66
{{- with .Values.matrixAuthenticationService -}}
77
{{- if and .enabled .syn2mas.enabled $.Values.synapse.enabled -}}
8+
{{- with .syn2mas -}}
89
{{- include "element-io.ess-library.serviceAccount" (dict "root" $ "context" (dict "componentValues" . "nameSuffix" "matrix-authentication-service-syn2mas" "extraAnnotations" (dict "helm.sh/hook" "pre-install,pre-upgrade" "helm.sh/hook-weight" "0"))) }}
910
{{- end }}
1011
{{- end }}
12+
{{- end }}

‎charts/matrix-stack/values.schema.json

Lines changed: 234 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3060,6 +3060,240 @@
30603060
"dryRun": {
30613061
"type": "boolean",
30623062
"description": "Run the migration job in dry-run mode. Do not actually migrate the data."
3063+
},
3064+
"labels": {
3065+
"type": "object",
3066+
"additionalProperties": {
3067+
"type": [
3068+
"string",
3069+
"null"
3070+
]
3071+
}
3072+
},
3073+
"annotations": {
3074+
"type": "object",
3075+
"additionalProperties": {
3076+
"type": "string"
3077+
}
3078+
},
3079+
"extraEnv": {
3080+
"type": "array",
3081+
"items": {
3082+
"type": "object",
3083+
"required": [
3084+
"name",
3085+
"value"
3086+
],
3087+
"properties": {
3088+
"name": {
3089+
"type": "string"
3090+
},
3091+
"value": {
3092+
"type": "string"
3093+
}
3094+
},
3095+
"additionalProperties": false
3096+
}
3097+
},
3098+
"containersSecurityContext": {
3099+
"properties": {
3100+
"allowPrivilegeEscalation": {
3101+
"type": "boolean"
3102+
},
3103+
"capabilities": {
3104+
"properties": {
3105+
"add": {
3106+
"items": {
3107+
"type": "string"
3108+
},
3109+
"type": "array"
3110+
},
3111+
"drop": {
3112+
"items": {
3113+
"type": "string"
3114+
},
3115+
"type": "array"
3116+
}
3117+
},
3118+
"type": "object",
3119+
"additionalProperties": false
3120+
},
3121+
"readOnlyRootFilesystem": {
3122+
"type": "boolean"
3123+
},
3124+
"seccompProfile": {
3125+
"properties": {
3126+
"localhostProfile": {
3127+
"type": "string"
3128+
},
3129+
"type": {
3130+
"enum": [
3131+
"RuntimeDefault",
3132+
"Unconfined",
3133+
"Localhost"
3134+
],
3135+
"type": "string"
3136+
}
3137+
},
3138+
"type": "object",
3139+
"additionalProperties": false
3140+
}
3141+
},
3142+
"type": "object",
3143+
"additionalProperties": false
3144+
},
3145+
"nodeSelector": {
3146+
"type": "object",
3147+
"additionalProperties": {
3148+
"type": "string"
3149+
}
3150+
},
3151+
"podSecurityContext": {
3152+
"properties": {
3153+
"fsGroup": {
3154+
"format": "int64",
3155+
"type": "integer"
3156+
},
3157+
"fsGroupChangePolicy": {
3158+
"type": "string"
3159+
},
3160+
"runAsGroup": {
3161+
"format": "int64",
3162+
"type": "integer"
3163+
},
3164+
"runAsNonRoot": {
3165+
"type": "boolean"
3166+
},
3167+
"runAsUser": {
3168+
"format": "int64",
3169+
"type": "integer"
3170+
},
3171+
"seLinuxOptions": {
3172+
"properties": {
3173+
"level": {
3174+
"type": "string"
3175+
},
3176+
"role": {
3177+
"type": "string"
3178+
},
3179+
"type": {
3180+
"type": "string"
3181+
},
3182+
"user": {
3183+
"type": "string"
3184+
}
3185+
},
3186+
"type": "object",
3187+
"additionalProperties": false
3188+
},
3189+
"seccompProfile": {
3190+
"properties": {
3191+
"localhostProfile": {
3192+
"type": "string"
3193+
},
3194+
"type": {
3195+
"enum": [
3196+
"RuntimeDefault",
3197+
"Unconfined",
3198+
"Localhost"
3199+
],
3200+
"type": "string"
3201+
}
3202+
},
3203+
"type": "object",
3204+
"additionalProperties": false
3205+
},
3206+
"supplementalGroups": {
3207+
"items": {
3208+
"format": "int64",
3209+
"type": "integer"
3210+
},
3211+
"type": "array"
3212+
}
3213+
},
3214+
"type": "object",
3215+
"additionalProperties": false
3216+
},
3217+
"resources": {
3218+
"properties": {
3219+
"limits": {
3220+
"additionalProperties": {
3221+
"anyOf": [
3222+
{
3223+
"type": "integer"
3224+
},
3225+
{
3226+
"type": "string"
3227+
}
3228+
],
3229+
"pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$"
3230+
},
3231+
"type": "object"
3232+
},
3233+
"requests": {
3234+
"additionalProperties": {
3235+
"anyOf": [
3236+
{
3237+
"type": "integer"
3238+
},
3239+
{
3240+
"type": "string"
3241+
}
3242+
],
3243+
"pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$"
3244+
},
3245+
"type": "object"
3246+
}
3247+
},
3248+
"type": "object",
3249+
"additionalProperties": false
3250+
},
3251+
"serviceAccount": {
3252+
"type": "object",
3253+
"properties": {
3254+
"create": {
3255+
"type": "boolean"
3256+
},
3257+
"name": {
3258+
"type": "string"
3259+
},
3260+
"annotations": {
3261+
"type": "object",
3262+
"additionalProperties": {
3263+
"type": "string"
3264+
}
3265+
}
3266+
},
3267+
"additionalProperties": false
3268+
},
3269+
"tolerations": {
3270+
"type": "array",
3271+
"items": {
3272+
"properties": {
3273+
"effect": {
3274+
"type": "string",
3275+
"enum": [
3276+
"NoSchedule",
3277+
"PreferNoSchedule",
3278+
"NoExecute"
3279+
]
3280+
},
3281+
"key": {
3282+
"type": "string"
3283+
},
3284+
"operator": {
3285+
"type": "string"
3286+
},
3287+
"tolerationSeconds": {
3288+
"type": "number"
3289+
},
3290+
"value": {
3291+
"type": "string"
3292+
}
3293+
},
3294+
"type": "object",
3295+
"additionalProperties": false
3296+
}
30633297
}
30643298
},
30653299
"additionalProperties": false

0 commit comments

Comments
 (0)