feat: add matrix synapse

2026-04-22 17:19:58 -05:00
parent 152f505392
commit 6e5435df6d
5 changed files with 187 additions and 210 deletions
--- a/clusters/cl01tl/helm/matrix-synapse/templates/_helpers.tpl
+++ b/clusters/cl01tl/helm/matrix-synapse/templates/_helpers.tpl
@@ -12,3 +12,10 @@ Selector labels
 app.kubernetes.io/instance: {{ .Release.Name }}
 app.kubernetes.io/part-of: {{ .Release.Name }}
 {{- end }}
+
+{{/*
+NFS names
+*/}}
+{{- define "custom.serviceAccountName" -}}
+matrix-synapse
+{{- end -}}
--- a/clusters/cl01tl/helm/matrix-synapse/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/matrix-synapse/templates/external-secret.yaml
@@ -1,159 +1,40 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: matrix-synapse-config-secret
+  name: matrix-synapse-signing-key
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: matrix-synapse-config-secret
+    app.kubernetes.io/name: matrix-synapse-signing-key
    {{- include "custom.labels" . | nindent 4 }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: oidc.yaml
-      remoteRef:
-        key: /cl01tl/matrix-synapse/config
-        property: oidc.yaml
-    - secretKey: config.yaml
-      remoteRef:
-        key: /cl01tl/matrix-synapse/config
-        property: config.yaml
-
---
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: matrix-synapse-signingkey
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: matrix-synapse-signingkey
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
+    name: openbao
  data:
    - secretKey: signing.key
      remoteRef:
-        key: /cl01tl/matrix-synapse/config
+        key: /cl01tl/matrix-synapse/key
        property: signing-key

 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: matrix-hookshot-config-secret
+  name: matrix-synapse-valkey-config
  namespace: {{ .Release.Namespace }}
  labels:
-    app.kubernetes.io/name: matrix-hookshot-config-secret
+    app.kubernetes.io/name: matrix-synapse-valkey-config
    {{- include "custom.labels" . | nindent 4 }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: config.yml
-      remoteRef:
-        key: /cl01tl/matrix-synapse/hookshot
-        property: config
-    - secretKey: registration.yml
-      remoteRef:
-        key: /cl01tl/matrix-synapse/hookshot
-        property: registration
-    - secretKey: hookshot-registration.yaml
-      remoteRef:
-        key: /cl01tl/matrix-synapse/hookshot
-        property: registration
-    - secretKey: passkey.pem
-      remoteRef:
-        key: /cl01tl/matrix-synapse/hookshot
-        property: passkey
-
---
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: mautrix-discord-config-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ .Release.Name }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: config.yaml
-      remoteRef:
-        key: /cl01tl/matrix-synapse/mautrix-discord
-        property: config
-    - secretKey: mautrix-discord-registration.yaml
-      remoteRef:
-        key: /cl01tl/matrix-synapse/mautrix-discord
-        property: registration
-
---
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: mautrix-whatsapp-config-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: mautrix-whatsapp-config-secret
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: config.yaml
-      remoteRef:
-        key: /cl01tl/matrix-synapse/mautrix-whatsapp
-        property: config
-    - secretKey: mautrix-whatsapp-registration.yaml
-      remoteRef:
-        key: /cl01tl/matrix-synapse/mautrix-whatsapp
-        property: registration
-
---
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: double-puppet-registration-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: double-puppet-registration-secret
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: double-puppet-registration.yaml
-      remoteRef:
-        key: /cl01tl/matrix-synapse/double-puppet
-        property: registration
-
---
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: matrix-synapse-valkey-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: matrix-synapse-valkey-secret
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
+    name: openbao
  data:
    - secretKey: default
      remoteRef:
-        key: /cl01tl/matrix-synapse/redis
+        key: /cl01tl/matrix-synapse/valkey
        property: password
    - secretKey: password
      remoteRef:
-        key: /cl01tl/matrix-synapse/redis
+        key: /cl01tl/matrix-synapse/valkey
        property: password
--- a/clusters/cl01tl/helm/matrix-synapse/templates/secret-provider-class.yaml
+++ b/clusters/cl01tl/helm/matrix-synapse/templates/secret-provider-class.yaml
@@ -0,0 +1,114 @@
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: matrix-synapse-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: matrix-synapse-config
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  provider: openbao
+  parameters:
+    baoAddress: "http://openbao-internal.openbao:8200"
+    roleName: matrix-synapse
+    objects: |
+      - objectName: config.yaml
+        fileName: config.yaml
+        secretPath: secret/data/cl01tl/matrix-synapse/config
+        secretKey: config.yaml
+      - objectName: oidc.yaml
+        fileName: oidc.yaml
+        secretPath: secret/data/cl01tl/matrix-synapse/config
+        secretKey: oidc.yaml
+      - objectName: hookshot-registration.yaml
+        fileName: hookshot-registration.yaml
+        secretPath: secret/data/cl01tl/matrix-synapse/hookshot
+        secretKey: hookshot-registration.yaml
+      - objectName: mautrix-discord-registration.yaml
+        fileName: mautrix-discord-registration.yaml
+        secretPath: secret/data/cl01tl/matrix-synapse/mautrix-discord
+        secretKey: mautrix-discord-registration.yaml
+      - objectName: mautrix-whatsapp-registration.yaml
+        fileName: mautrix-whatsapp-registration.yaml
+        secretPath: secret/data/cl01tl/matrix-synapse/mautrix-whatsapp
+        secretKey: mautrix-whatsapp-registration.yaml
+      - objectName: double-puppet-registration.yaml
+        fileName: double-puppet-registration.yaml
+        secretPath: secret/data/cl01tl/matrix-synapse/double-puppet
+        secretKey: double-puppet-registration.yaml
+
+---
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: matrix-hookshot-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: matrix-hookshot-config
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  provider: openbao
+  parameters:
+    baoAddress: "http://openbao-internal.openbao:8200"
+    roleName: matrix-synapse
+    objects: |
+      - objectName: config.yml
+        fileName: config.yml
+        secretPath: secret/data/cl01tl/matrix-synapse/hookshot
+        secretKey: config.yml
+      - objectName: registration.yml
+        fileName: registration.yml
+        secretPath: secret/data/cl01tl/matrix-synapse/hookshot
+        secretKey: hookshot-registration.yaml
+      - objectName: passkey.pem
+        fileName: passkey.pem
+        secretPath: secret/data/cl01tl/matrix-synapse/hookshot
+        secretKey: passkey.pem
+
+---
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: mautrix-discord-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: mautrix-discord-config
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  provider: openbao
+  parameters:
+    baoAddress: "http://openbao-internal.openbao:8200"
+    roleName: matrix-synapse
+    objects: |
+      - objectName: config.yaml
+        fileName: config.yaml
+        secretPath: secret/data/cl01tl/matrix-synapse/mautrix-discord
+        secretKey: config.yaml
+      - objectName: mautrix-discord-registration.yaml
+        fileName: mautrix-discord-registration.yaml
+        secretPath: secret/data/cl01tl/matrix-synapse/mautrix-discord
+        secretKey: mautrix-discord-registration.yaml
+
+---
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: mautrix-whatsapp-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: mautrix-whatsapp-config
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  provider: openbao
+  parameters:
+    baoAddress: "http://openbao-internal.openbao:8200"
+    roleName: matrix-synapse
+    objects: |
+      - objectName: config.yaml
+        fileName: config.yaml
+        secretPath: secret/data/cl01tl/matrix-synapse/mautrix-whatsapp
+        secretKey: config.yaml
+      - objectName: mautrix-whatsapp-registration.yaml
+        fileName: mautrix-whatsapp-registration.yaml
+        secretPath: secret/data/cl01tl/matrix-synapse/mautrix-whatsapp
+        secretKey: mautrix-whatsapp-registration.yaml
--- a/clusters/cl01tl/helm/matrix-synapse/templates/service-account.yaml
+++ b/clusters/cl01tl/helm/matrix-synapse/templates/service-account.yaml
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "custom.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ include "custom.serviceAccountName" . }}
+    {{- include "custom.labels" . | nindent 4 }}
--- a/clusters/cl01tl/helm/matrix-synapse/values.yaml
+++ b/clusters/cl01tl/helm/matrix-synapse/values.yaml
@@ -8,7 +8,7 @@ matrix-synapse:
  signingkey:
    job:
      enabled: false
-    existingSecret: matrix-synapse-signingkey
+    existingSecret: matrix-synapse-signing-key
    existingSecretKey: signing.key
  config:
    reportStats: false
@@ -37,45 +37,16 @@ matrix-synapse:
    strategy:
      type: Recreate
    extraVolumes:
-      - name: matrix-synapse-config-secret
-        secret:
-          secretName: matrix-synapse-config-secret
-      - name: matrix-hookshot-config-secret
-        secret:
-          secretName: matrix-hookshot-config-secret
-      - name: mautrix-discord-config-secret
-        secret:
-          secretName: mautrix-discord-config-secret
-      - name: mautrix-whatsapp-config-secret
-        secret:
-          secretName: mautrix-whatsapp-config-secret
-      - name: double-puppet-registration-secret
-        secret:
-          secretName: double-puppet-registration-secret
+      - name: config
+        csi:
+          driver: secrets-store.csi.k8s.io
+          readOnly: true
+          volumeAttributes:
+            secretProviderClass: matrix-synapse-config
    extraVolumeMounts:
-      - name: matrix-synapse-config-secret
-        mountPath: /synapse/config/conf.d/oidc.yaml
-        subPath: oidc.yaml
-        readOnly: true
-      - name: matrix-synapse-config-secret
-        mountPath: /synapse/config/conf.d/config.yaml
-        subPath: config.yaml
-        readOnly: true
-      - name: matrix-hookshot-config-secret
-        mountPath: /synapse/config/conf.d/hookshot-registration.yaml
-        subPath: hookshot-registration.yaml
-        readOnly: true
-      - name: mautrix-discord-config-secret
-        mountPath: /synapse/config/conf.d/mautrix-discord-registration.yaml
-        subPath: mautrix-discord-registration.yaml
-        readOnly: true
-      - name: mautrix-whatsapp-config-secret
-        mountPath: /synapse/config/conf.d/mautrix-whatsapp-registration.yaml
-        subPath: mautrix-whatsapp-registration.yaml
-        readOnly: true
-      - name: double-puppet-registration-secret
-        mountPath: /synapse/config/conf.d/double-puppet-registration.yaml
-        subPath: double-puppet-registration.yaml
+      - name: config
+        mountPath: /synapse/config/conf.d
+        mountPropagation: None
        readOnly: true
    resources:
      requests:
@@ -120,7 +91,7 @@ matrix-synapse:
  externalRedis:
    host: matrix-synapse-valkey
    port: 6379
-    existingSecret: matrix-synapse-valkey-secret
+    existingSecret: matrix-synapse-valkey-config
    existingSecretPasswordKey: password
  persistence:
    enabled: true
@@ -186,9 +157,13 @@ matrix-hookshot:
          path: /metrics
  persistence:
    config:
-      enabled: true
-      type: secret
-      name: matrix-hookshot-config-secret
+      type: custom
+      volumeSpec:
+        csi:
+          driver: secrets-store.csi.k8s.io
+          readOnly: true
+          volumeAttributes:
+            secretProviderClass: matrix-hookshot-config
      advancedMounts:
        main:
          main:
@@ -197,9 +172,13 @@ matrix-hookshot:
              mountPropagation: None
              subPath: config.yml
    registration:
-      enabled: true
-      type: secret
-      name: matrix-hookshot-config-secret
+      type: custom
+      volumeSpec:
+        csi:
+          driver: secrets-store.csi.k8s.io
+          readOnly: true
+          volumeAttributes:
+            secretProviderClass: matrix-hookshot-config
      advancedMounts:
        main:
          main:
@@ -208,9 +187,13 @@ matrix-hookshot:
              mountPropagation: None
              subPath: registration.yml
    passkey:
-      enabled: true
-      type: secret
-      name: matrix-hookshot-config-secret
+      type: custom
+      volumeSpec:
+        csi:
+          driver: secrets-store.csi.k8s.io
+          readOnly: true
+          volumeAttributes:
+            secretProviderClass: matrix-hookshot-config
      advancedMounts:
        main:
          main:
@@ -270,27 +253,19 @@ mautrix-discord:
          targetPort: 29334
  persistence:
    config:
-      enabled: true
-      type: secret
-      name: mautrix-discord-config-secret
+      type: custom
+      volumeSpec:
+        csi:
+          driver: secrets-store.csi.k8s.io
+          readOnly: true
+          volumeAttributes:
+            secretProviderClass: mautrix-discord-config
      advancedMounts:
        main:
          init-copy-config:
-            - path: /tmp/config.yaml
+            - path: /tmp
              readOnly: true
              mountPropagation: None
-              subPath: config.yaml
-    registration:
-      enabled: true
-      type: secret
-      name: mautrix-discord-config-secret
-      advancedMounts:
-        main:
-          init-copy-config:
-            - path: /tmp/mautrix-discord-registration.yaml
-              readOnly: true
-              mountPropagation: None
-              subPath: mautrix-discord-registration.yaml
    data:
      forceRename: mautrix-discord
      storageClass: ceph-block
@@ -346,27 +321,19 @@ mautrix-whatsapp:
          targetPort: 29318
  persistence:
    config:
-      enabled: true
-      type: secret
-      name: mautrix-whatsapp-config-secret
+      type: custom
+      volumeSpec:
+        csi:
+          driver: secrets-store.csi.k8s.io
+          readOnly: true
+          volumeAttributes:
+            secretProviderClass: mautrix-whatsapp-config
      advancedMounts:
        main:
          init-copy-config:
-            - path: /tmp/config.yaml
+            - path: /tmp
              readOnly: true
              mountPropagation: None
-              subPath: config.yaml
-    registration:
-      enabled: true
-      type: secret
-      name: mautrix-whatsapp-config-secret
-      advancedMounts:
-        main:
-          init-copy-config:
-            - path: /tmp/mautrix-whatsapp-registration.yaml
-              readOnly: true
-              mountPropagation: None
-              subPath: mautrix-whatsapp-registration.yaml
    data:
      forceRename: mautrix-whatsapp
      storageClass: ceph-block
@@ -414,7 +381,7 @@ valkey-matrix-synapse:
  valkey:
    auth:
      enabled: true
-      usersExistingSecret: matrix-synapse-valkey-secret
+      usersExistingSecret: matrix-synapse-valkey-config
      aclUsers:
        default:
          permissions: "~* &* +@all"