130 lines
4.1 KiB
YAML
130 lines
4.1 KiB
YAML
# services/communication/mas-syn2mas-check-job.yaml
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: mas-syn2mas-check-v2
|
|
namespace: communication
|
|
spec:
|
|
backoffLimit: 0
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: mas-syn2mas-check-v2
|
|
spec:
|
|
enableServiceLinks: false
|
|
restartPolicy: Never
|
|
nodeSelector:
|
|
hardware: rpi5
|
|
affinity:
|
|
nodeAffinity:
|
|
preferredDuringSchedulingIgnoredDuringExecution:
|
|
- weight: 50
|
|
preference:
|
|
matchExpressions:
|
|
- key: hardware
|
|
operator: In
|
|
values: ["rpi5","rpi4"]
|
|
initContainers:
|
|
- name: render-mas-config
|
|
image: alpine:3.20
|
|
command: ["/bin/sh","-c"]
|
|
args:
|
|
- |
|
|
set -euo pipefail
|
|
umask 077
|
|
DB_PASS_ESCAPED="$(printf '%s' "${MAS_DB_PASSWORD}" | sed 's/[\\/&]/\\&/g')"
|
|
MATRIX_SECRET_ESCAPED="$(printf '%s' "${MATRIX_SHARED_SECRET}" | sed 's/[\\/&]/\\&/g')"
|
|
KC_SECRET_ESCAPED="$(printf '%s' "${KEYCLOAK_CLIENT_SECRET}" | sed 's/[\\/&]/\\&/g')"
|
|
|
|
sed \
|
|
-e "s/@@MAS_DB_PASSWORD@@/${DB_PASS_ESCAPED}/g" \
|
|
-e "s/@@MATRIX_SHARED_SECRET@@/${MATRIX_SECRET_ESCAPED}/g" \
|
|
-e "s/@@KEYCLOAK_CLIENT_SECRET@@/${KC_SECRET_ESCAPED}/g" \
|
|
/etc/mas/config.yaml > /rendered/config.yaml
|
|
chmod 0644 /rendered/config.yaml
|
|
env:
|
|
- name: MAS_DB_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: mas-db
|
|
key: password
|
|
- name: MATRIX_SHARED_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: mas-secrets-runtime
|
|
key: matrix_shared_secret
|
|
- name: KEYCLOAK_CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: mas-secrets-runtime
|
|
key: keycloak_client_secret
|
|
volumeMounts:
|
|
- name: mas-config
|
|
mountPath: /etc/mas/config.yaml
|
|
subPath: config.yaml
|
|
readOnly: true
|
|
- name: rendered
|
|
mountPath: /rendered
|
|
readOnly: false
|
|
containers:
|
|
- name: syn2mas-check
|
|
image: ghcr.io/element-hq/matrix-authentication-service:1.8.0
|
|
args:
|
|
- syn2mas
|
|
- check
|
|
- --config
|
|
- /rendered/config.yaml
|
|
- --synapse-config
|
|
- /synapse-config/homeserver.yaml
|
|
- --synapse-config
|
|
- /synapse-secret/config.yaml
|
|
- --synapse-database-uri
|
|
- "postgresql:"
|
|
env:
|
|
- name: PGHOST
|
|
value: postgres-service.postgres.svc.cluster.local
|
|
- name: PGPORT
|
|
value: "5432"
|
|
- name: PGDATABASE
|
|
value: synapse
|
|
- name: PGUSER
|
|
value: synapse
|
|
- name: PGPASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: synapse-db
|
|
key: POSTGRES_PASSWORD
|
|
- name: PGSSLMODE
|
|
value: prefer
|
|
volumeMounts:
|
|
- name: rendered
|
|
mountPath: /rendered
|
|
readOnly: true
|
|
- name: synapse-config
|
|
mountPath: /synapse-config
|
|
readOnly: true
|
|
- name: synapse-secret
|
|
mountPath: /synapse-secret
|
|
readOnly: true
|
|
volumes:
|
|
- name: mas-config
|
|
configMap:
|
|
name: matrix-authentication-service-config
|
|
items:
|
|
- key: config.yaml
|
|
path: config.yaml
|
|
- name: rendered
|
|
emptyDir: {}
|
|
- name: synapse-config
|
|
configMap:
|
|
name: othrys-synapse-matrix-synapse
|
|
items:
|
|
- key: homeserver.yaml
|
|
path: homeserver.yaml
|
|
- name: synapse-secret
|
|
secret:
|
|
secretName: othrys-synapse-matrix-synapse
|
|
items:
|
|
- key: config.yaml
|
|
path: config.yaml
|