feat: add matrix synapse

clusters/cl01tl/helm/matrix-synapse/templates/_helpers.tpl

@@ -12,3 +12,10 @@ Selector labels
 app.kubernetes.io/instance: {{ .Release.Name }}
 app.kubernetes.io/part-of: {{ .Release.Name }}
 {{- end }}
+
+{{/*
+NFS names
+*/}}
+{{- define "custom.serviceAccountName" -}}
+matrix-synapse
+{{- end -}}

clusters/cl01tl/helm/matrix-synapse/templates/external-secret.yaml

@@ -1,159 +1,40 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: matrix-synapse-config-secret
+  name: matrix-synapse-signing-key
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: matrix-synapse-config-secret
+    app.kubernetes.io/name: matrix-synapse-signing-key
     {{- include "custom.labels" . | nindent 4 }}
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: oidc.yaml
-      remoteRef:
-        key: /cl01tl/matrix-synapse/config
-        property: oidc.yaml
-    - secretKey: config.yaml
-      remoteRef:
-        key: /cl01tl/matrix-synapse/config
-        property: config.yaml
-
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: matrix-synapse-signingkey
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: matrix-synapse-signingkey
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: signing.key
       remoteRef:
-        key: /cl01tl/matrix-synapse/config
+        key: /cl01tl/matrix-synapse/key
         property: signing-key
 
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: matrix-hookshot-config-secret
+  name: matrix-synapse-valkey-config
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: matrix-hookshot-config-secret
+    app.kubernetes.io/name: matrix-synapse-valkey-config
     {{- include "custom.labels" . | nindent 4 }}
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: config.yml
-      remoteRef:
-        key: /cl01tl/matrix-synapse/hookshot
-        property: config
-    - secretKey: registration.yml
-      remoteRef:
-        key: /cl01tl/matrix-synapse/hookshot
-        property: registration
-    - secretKey: hookshot-registration.yaml
-      remoteRef:
-        key: /cl01tl/matrix-synapse/hookshot
-        property: registration
-    - secretKey: passkey.pem
-      remoteRef:
-        key: /cl01tl/matrix-synapse/hookshot
-        property: passkey
-
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: mautrix-discord-config-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ .Release.Name }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: config.yaml
-      remoteRef:
-        key: /cl01tl/matrix-synapse/mautrix-discord
-        property: config
-    - secretKey: mautrix-discord-registration.yaml
-      remoteRef:
-        key: /cl01tl/matrix-synapse/mautrix-discord
-        property: registration
-
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: mautrix-whatsapp-config-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: mautrix-whatsapp-config-secret
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: config.yaml
-      remoteRef:
-        key: /cl01tl/matrix-synapse/mautrix-whatsapp
-        property: config
-    - secretKey: mautrix-whatsapp-registration.yaml
-      remoteRef:
-        key: /cl01tl/matrix-synapse/mautrix-whatsapp
-        property: registration
-
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: double-puppet-registration-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: double-puppet-registration-secret
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: double-puppet-registration.yaml
-      remoteRef:
-        key: /cl01tl/matrix-synapse/double-puppet
-        property: registration
-
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: matrix-synapse-valkey-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: matrix-synapse-valkey-secret
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: default
       remoteRef:
-        key: /cl01tl/matrix-synapse/redis
+        key: /cl01tl/matrix-synapse/valkey
         property: password
     - secretKey: password
       remoteRef:
-        key: /cl01tl/matrix-synapse/redis
+        key: /cl01tl/matrix-synapse/valkey
         property: password

clusters/cl01tl/helm/matrix-synapse/templates/secret-provider-class.yaml

@@ -0,0 +1,114 @@
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: matrix-synapse-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: matrix-synapse-config
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  provider: openbao
+  parameters:
+    baoAddress: "http://openbao-internal.openbao:8200"
+    roleName: matrix-synapse
+    objects: |
+      - objectName: config.yaml
+        fileName: config.yaml
+        secretPath: secret/data/cl01tl/matrix-synapse/config
+        secretKey: config.yaml
+      - objectName: oidc.yaml
+        fileName: oidc.yaml
+        secretPath: secret/data/cl01tl/matrix-synapse/config
+        secretKey: oidc.yaml
+      - objectName: hookshot-registration.yaml
+        fileName: hookshot-registration.yaml
+        secretPath: secret/data/cl01tl/matrix-synapse/hookshot
+        secretKey: hookshot-registration.yaml
+      - objectName: mautrix-discord-registration.yaml
+        fileName: mautrix-discord-registration.yaml
+        secretPath: secret/data/cl01tl/matrix-synapse/mautrix-discord
+        secretKey: mautrix-discord-registration.yaml
+      - objectName: mautrix-whatsapp-registration.yaml
+        fileName: mautrix-whatsapp-registration.yaml
+        secretPath: secret/data/cl01tl/matrix-synapse/mautrix-whatsapp
+        secretKey: mautrix-whatsapp-registration.yaml
+      - objectName: double-puppet-registration.yaml
+        fileName: double-puppet-registration.yaml
+        secretPath: secret/data/cl01tl/matrix-synapse/double-puppet
+        secretKey: double-puppet-registration.yaml
+
+---
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: matrix-hookshot-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: matrix-hookshot-config
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  provider: openbao
+  parameters:
+    baoAddress: "http://openbao-internal.openbao:8200"
+    roleName: matrix-synapse
+    objects: |
+      - objectName: config.yml
+        fileName: config.yml
+        secretPath: secret/data/cl01tl/matrix-synapse/hookshot
+        secretKey: config.yml
+      - objectName: registration.yml
+        fileName: registration.yml
+        secretPath: secret/data/cl01tl/matrix-synapse/hookshot
+        secretKey: hookshot-registration.yaml
+      - objectName: passkey.pem
+        fileName: passkey.pem
+        secretPath: secret/data/cl01tl/matrix-synapse/hookshot
+        secretKey: passkey.pem
+
+---
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: mautrix-discord-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: mautrix-discord-config
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  provider: openbao
+  parameters:
+    baoAddress: "http://openbao-internal.openbao:8200"
+    roleName: matrix-synapse
+    objects: |
+      - objectName: config.yaml
+        fileName: config.yaml
+        secretPath: secret/data/cl01tl/matrix-synapse/mautrix-discord
+        secretKey: config.yaml
+      - objectName: mautrix-discord-registration.yaml
+        fileName: mautrix-discord-registration.yaml
+        secretPath: secret/data/cl01tl/matrix-synapse/mautrix-discord
+        secretKey: mautrix-discord-registration.yaml
+
+---
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: mautrix-whatsapp-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: mautrix-whatsapp-config
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  provider: openbao
+  parameters:
+    baoAddress: "http://openbao-internal.openbao:8200"
+    roleName: matrix-synapse
+    objects: |
+      - objectName: config.yaml
+        fileName: config.yaml
+        secretPath: secret/data/cl01tl/matrix-synapse/mautrix-whatsapp
+        secretKey: config.yaml
+      - objectName: mautrix-whatsapp-registration.yaml
+        fileName: mautrix-whatsapp-registration.yaml
+        secretPath: secret/data/cl01tl/matrix-synapse/mautrix-whatsapp
+        secretKey: mautrix-whatsapp-registration.yaml

clusters/cl01tl/helm/matrix-synapse/templates/service-account.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "custom.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ include "custom.serviceAccountName" . }}
+    {{- include "custom.labels" . | nindent 4 }}