titan-iac/services/comms/mas-deployment.yaml

# services/comms/mas-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: matrix-authentication-service
  labels:
    app: matrix-authentication-service
spec:
  replicas: 1
  selector:
    matchLabels:
      app: matrix-authentication-service
  template:
    metadata:
      annotations:
        checksum/config: v5-adminapi-7
      labels:
        app: matrix-authentication-service
    spec:
      enableServiceLinks: false
      serviceAccountName: comms-vault
      nodeSelector:
        hardware: rpi5
      affinity:
        nodeAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 50
              preference:
                matchExpressions:
                  - key: hardware
                    operator: In
                    values: ["rpi5","rpi4"]
      initContainers:
        - name: render-config
          image: alpine:3.20
          command: ["/bin/sh","-c"]
          args:
            - |
              set -euo pipefail
              . /vault/scripts/comms_vault_env.sh
              umask 077
              DB_PASS_ESCAPED="$(printf '%s' "${MAS_DB_PASSWORD}" | sed 's/[\\/&]/\\&/g')"
              MATRIX_SECRET_ESCAPED="$(printf '%s' "${MATRIX_SHARED_SECRET}" | sed 's/[\\/&]/\\&/g')"
              KC_SECRET_ESCAPED="$(printf '%s' "${KEYCLOAK_CLIENT_SECRET}" | sed 's/[\\/&]/\\&/g')"

              sed \
                -e "s/@@MAS_DB_PASSWORD@@/${DB_PASS_ESCAPED}/g" \
                -e "s/@@MATRIX_SHARED_SECRET@@/${MATRIX_SECRET_ESCAPED}/g" \
                -e "s/@@KEYCLOAK_CLIENT_SECRET@@/${KC_SECRET_ESCAPED}/g" \
                /etc/mas/config.yaml > /rendered/config.yaml
              chmod 0644 /rendered/config.yaml
          volumeMounts:
            - name: config
              mountPath: /etc/mas/config.yaml
              subPath: config.yaml
              readOnly: true
            - name: rendered
              mountPath: /rendered
              readOnly: false
            - name: vault-secrets
              mountPath: /vault/secrets
              readOnly: true
            - name: vault-scripts
              mountPath: /vault/scripts
              readOnly: true
      containers:
        - name: mas
          image: ghcr.io/element-hq/matrix-authentication-service:1.8.0
          args: ["server","--config","/rendered/config.yaml"]
          ports:
            - name: http
              containerPort: 8080
              protocol: TCP
            - name: internal
              containerPort: 8081
              protocol: TCP
          volumeMounts:
            - name: rendered
              mountPath: /rendered
              readOnly: true
            - name: vault-secrets
              mountPath: /etc/mas/secrets/encryption
              subPath: mas-secrets-runtime__encryption
              readOnly: true
            - name: vault-secrets
              mountPath: /etc/mas/secrets/matrix_shared_secret
              subPath: mas-secrets-runtime__matrix_shared_secret
              readOnly: true
            - name: vault-secrets
              mountPath: /etc/mas/secrets/keycloak_client_secret
              subPath: mas-secrets-runtime__keycloak_client_secret
              readOnly: true
            - name: vault-secrets
              mountPath: /etc/mas/keys/rsa_key
              subPath: mas-secrets-runtime__rsa_key
              readOnly: true
            - name: vault-secrets
              mountPath: /etc/mas/admin-client/client_secret
              subPath: mas-admin-client-runtime__client_secret
              readOnly: true
          resources:
            requests:
              cpu: 200m
              memory: 256Mi
            limits:
              cpu: "2"
              memory: 1Gi
      volumes:
        - name: config
          configMap:
            name: matrix-authentication-service-config
            items:
              - key: config.yaml
                path: config.yaml
        - name: rendered
          emptyDir: {}
        - name: vault-secrets
          csi:
            driver: secrets-store.csi.k8s.io
            readOnly: true
            volumeAttributes:
              secretProviderClass: comms-vault
        - name: vault-scripts
          configMap:
            name: comms-vault-env
            defaultMode: 0555
---
apiVersion: v1
kind: Service
metadata:
  name: matrix-authentication-service
spec:
  selector:
    app: matrix-authentication-service
  ports:
    - name: http
      port: 8080
      targetPort: http
      protocol: TCP
    - name: internal
      port: 8081
      targetPort: internal
      protocol: TCP