139 lines
4.1 KiB
YAML
139 lines
4.1 KiB
YAML
# services/communication/mas-deployment.yaml
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: matrix-authentication-service
|
|
namespace: communication
|
|
labels:
|
|
app: matrix-authentication-service
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: matrix-authentication-service
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
checksum/config: v4-bind-1
|
|
labels:
|
|
app: matrix-authentication-service
|
|
spec:
|
|
enableServiceLinks: false
|
|
nodeSelector:
|
|
hardware: rpi5
|
|
affinity:
|
|
nodeAffinity:
|
|
preferredDuringSchedulingIgnoredDuringExecution:
|
|
- weight: 50
|
|
preference:
|
|
matchExpressions:
|
|
- key: hardware
|
|
operator: In
|
|
values: ["rpi5","rpi4"]
|
|
initContainers:
|
|
- name: render-config
|
|
image: alpine:3.20
|
|
command: ["/bin/sh","-c"]
|
|
args:
|
|
- |
|
|
set -euo pipefail
|
|
umask 077
|
|
DB_PASS_ESCAPED="$(printf '%s' "${MAS_DB_PASSWORD}" | sed 's/[\\/&]/\\&/g')"
|
|
MATRIX_SECRET_ESCAPED="$(printf '%s' "${MATRIX_SHARED_SECRET}" | sed 's/[\\/&]/\\&/g')"
|
|
KC_SECRET_ESCAPED="$(printf '%s' "${KEYCLOAK_CLIENT_SECRET}" | sed 's/[\\/&]/\\&/g')"
|
|
|
|
sed \
|
|
-e "s/@@MAS_DB_PASSWORD@@/${DB_PASS_ESCAPED}/g" \
|
|
-e "s/@@MATRIX_SHARED_SECRET@@/${MATRIX_SECRET_ESCAPED}/g" \
|
|
-e "s/@@KEYCLOAK_CLIENT_SECRET@@/${KC_SECRET_ESCAPED}/g" \
|
|
/etc/mas/config.yaml > /rendered/config.yaml
|
|
chmod 0644 /rendered/config.yaml
|
|
env:
|
|
- name: MAS_DB_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: mas-db
|
|
key: password
|
|
- name: MATRIX_SHARED_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: mas-secrets-runtime
|
|
key: matrix_shared_secret
|
|
- name: KEYCLOAK_CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: mas-secrets-runtime
|
|
key: keycloak_client_secret
|
|
volumeMounts:
|
|
- name: config
|
|
mountPath: /etc/mas/config.yaml
|
|
subPath: config.yaml
|
|
readOnly: true
|
|
- name: rendered
|
|
mountPath: /rendered
|
|
readOnly: false
|
|
containers:
|
|
- name: mas
|
|
image: ghcr.io/element-hq/matrix-authentication-service:0.20.0
|
|
args: ["server","--config","/rendered/config.yaml"]
|
|
ports:
|
|
- name: http
|
|
containerPort: 8080
|
|
protocol: TCP
|
|
volumeMounts:
|
|
- name: rendered
|
|
mountPath: /rendered
|
|
readOnly: true
|
|
- name: secrets
|
|
mountPath: /etc/mas/secrets
|
|
readOnly: true
|
|
- name: keys
|
|
mountPath: /etc/mas/keys
|
|
readOnly: true
|
|
resources:
|
|
requests:
|
|
cpu: 200m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: "2"
|
|
memory: 1Gi
|
|
volumes:
|
|
- name: config
|
|
configMap:
|
|
name: matrix-authentication-service-config
|
|
items:
|
|
- key: config.yaml
|
|
path: config.yaml
|
|
- name: rendered
|
|
emptyDir: {}
|
|
- name: secrets
|
|
secret:
|
|
secretName: mas-secrets-runtime
|
|
items:
|
|
- key: encryption
|
|
path: encryption
|
|
- key: matrix_shared_secret
|
|
path: matrix_shared_secret
|
|
- key: keycloak_client_secret
|
|
path: keycloak_client_secret
|
|
- name: keys
|
|
secret:
|
|
secretName: mas-secrets-runtime
|
|
items:
|
|
- key: rsa_key
|
|
path: rsa_key
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: matrix-authentication-service
|
|
namespace: communication
|
|
spec:
|
|
selector:
|
|
app: matrix-authentication-service
|
|
ports:
|
|
- name: http
|
|
port: 8080
|
|
targetPort: http
|
|
protocol: TCP
|