bstein/titan-iac
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
titan-iac/services/comms/mas-deployment.yaml

179 lines
7.9 KiB
YAML
Raw Blame History

# services/comms/mas-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: matrix-authentication-service
labels:
app: matrix-authentication-service
spec:
replicas: 1
selector:
matchLabels:
app: matrix-authentication-service
template:
metadata:
annotations:
checksum/config: v5-adminapi-7
vault.hashicorp.com/agent-inject: "true"
vault.hashicorp.com/agent-init-first: "true"
vault.hashicorp.com/role: "comms"
vault.hashicorp.com/agent-inject-secret-turn-secret: "kv/data/atlas/comms/turn-shared-secret"
vault.hashicorp.com/agent-inject-template-turn-secret: |
{{- with secret "kv/data/atlas/comms/turn-shared-secret" -}}{{ .Data.data.TURN_STATIC_AUTH_SECRET }}{{- end -}}
vault.hashicorp.com/agent-inject-secret-livekit-primary: "kv/data/atlas/comms/livekit-api"
vault.hashicorp.com/agent-inject-template-livekit-primary: |
{{- with secret "kv/data/atlas/comms/livekit-api" -}}{{ .Data.data.primary }}{{- end -}}
vault.hashicorp.com/agent-inject-secret-bot-pass: "kv/data/atlas/comms/atlasbot-credentials-runtime"
vault.hashicorp.com/agent-inject-template-bot-pass: |
{{- with secret "kv/data/atlas/comms/atlasbot-credentials-runtime" -}}{{ index .Data.data "bot-password" }}{{- end -}}
vault.hashicorp.com/agent-inject-secret-seeder-pass: "kv/data/atlas/comms/atlasbot-credentials-runtime"
vault.hashicorp.com/agent-inject-template-seeder-pass: |
{{- with secret "kv/data/atlas/comms/atlasbot-credentials-runtime" -}}{{ index .Data.data "seeder-password" }}{{- end -}}
vault.hashicorp.com/agent-inject-secret-chat-matrix: "kv/data/atlas/shared/chat-ai-keys-runtime"
vault.hashicorp.com/agent-inject-template-chat-matrix: |
{{- with secret "kv/data/atlas/shared/chat-ai-keys-runtime" -}}{{ .Data.data.matrix }}{{- end -}}
vault.hashicorp.com/agent-inject-secret-chat-homepage: "kv/data/atlas/shared/chat-ai-keys-runtime"
vault.hashicorp.com/agent-inject-template-chat-homepage: |
{{- with secret "kv/data/atlas/shared/chat-ai-keys-runtime" -}}{{ .Data.data.homepage }}{{- end -}}
vault.hashicorp.com/agent-inject-secret-mas-admin-secret: "kv/data/atlas/comms/mas-admin-client-runtime"
vault.hashicorp.com/agent-inject-template-mas-admin-secret: |
{{- with secret "kv/data/atlas/comms/mas-admin-client-runtime" -}}{{ .Data.data.client_secret }}{{- end -}}
vault.hashicorp.com/agent-inject-secret-synapse-db-pass: "kv/data/atlas/comms/synapse-db"
vault.hashicorp.com/agent-inject-template-synapse-db-pass: |
{{- with secret "kv/data/atlas/comms/synapse-db" -}}{{ .Data.data.POSTGRES_PASSWORD }}{{- end -}}
vault.hashicorp.com/agent-inject-secret-mas-db-pass: "kv/data/atlas/comms/mas-db"
vault.hashicorp.com/agent-inject-template-mas-db-pass: |
{{- with secret "kv/data/atlas/comms/mas-db" -}}{{ .Data.data.password }}{{- end -}}
vault.hashicorp.com/agent-inject-secret-mas-matrix-shared: "kv/data/atlas/comms/mas-secrets-runtime"
vault.hashicorp.com/agent-inject-template-mas-matrix-shared: |
{{- with secret "kv/data/atlas/comms/mas-secrets-runtime" -}}{{ .Data.data.matrix_shared_secret }}{{- end -}}
vault.hashicorp.com/agent-inject-secret-mas-kc-secret: "kv/data/atlas/comms/mas-secrets-runtime"
vault.hashicorp.com/agent-inject-template-mas-kc-secret: |
{{- with secret "kv/data/atlas/comms/mas-secrets-runtime" -}}{{ .Data.data.keycloak_client_secret }}{{- end -}}
vault.hashicorp.com/agent-inject-secret-mas-encryption: "kv/data/atlas/comms/mas-secrets-runtime"
vault.hashicorp.com/agent-inject-template-mas-encryption: |
{{- with secret "kv/data/atlas/comms/mas-secrets-runtime" -}}{{ .Data.data.encryption }}{{- end -}}
vault.hashicorp.com/agent-inject-secret-mas-rsa-key: "kv/data/atlas/comms/mas-secrets-runtime"
vault.hashicorp.com/agent-inject-template-mas-rsa-key: |
{{- with secret "kv/data/atlas/comms/mas-secrets-runtime" -}}{{ .Data.data.rsa_key }}{{- end -}}
labels:
app: matrix-authentication-service
spec:
enableServiceLinks: false
serviceAccountName: comms-vault
nodeSelector:
hardware: rpi5
affinity:
nodeAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
- weight: 50
preference:
matchExpressions:
- key: hardware
operator: In
values: ["rpi5","rpi4"]
initContainers:
- name: render-config
image: alpine:3.20
command: ["/bin/sh","-c"]
args:
- |
set -euo pipefail
. /vault/scripts/comms_vault_env.sh
umask 077
DB_PASS_ESCAPED="$(printf '%s' "${MAS_DB_PASSWORD}" | sed 's/[\\/&]/\\&/g')"
MATRIX_SECRET_ESCAPED="$(printf '%s' "${MATRIX_SHARED_SECRET}" | sed 's/[\\/&]/\\&/g')"
KC_SECRET_ESCAPED="$(printf '%s' "${KEYCLOAK_CLIENT_SECRET}" | sed 's/[\\/&]/\\&/g')"
sed \
-e "s/@@MAS_DB_PASSWORD@@/${DB_PASS_ESCAPED}/g" \
-e "s/@@MATRIX_SHARED_SECRET@@/${MATRIX_SECRET_ESCAPED}/g" \
-e "s/@@KEYCLOAK_CLIENT_SECRET@@/${KC_SECRET_ESCAPED}/g" \
/etc/mas/config.yaml > /rendered/config.yaml
chmod 0644 /rendered/config.yaml
volumeMounts:
- name: config
mountPath: /etc/mas/config.yaml
subPath: config.yaml
readOnly: true
- name: rendered
mountPath: /rendered
readOnly: false
- name: vault-scripts
mountPath: /vault/scripts
readOnly: true
containers:
- name: mas
image: ghcr.io/element-hq/matrix-authentication-service:1.8.0
args: ["server","--config","/rendered/config.yaml"]
ports:
- name: http
containerPort: 8080
protocol: TCP
- name: internal
containerPort: 8081
protocol: TCP
volumeMounts:
- name: rendered
mountPath: /rendered
readOnly: true
- name: vault-secrets
mountPath: /etc/mas/secrets/encryption
subPath: mas-encryption
readOnly: true
- name: vault-secrets
mountPath: /etc/mas/secrets/matrix_shared_secret
subPath: mas-matrix-shared
readOnly: true
- name: vault-secrets
mountPath: /etc/mas/secrets/keycloak_client_secret
subPath: mas-kc-secret
readOnly: true
- name: vault-secrets
mountPath: /etc/mas/keys/rsa_key
subPath: mas-rsa-key
readOnly: true
- name: vault-secrets
mountPath: /etc/mas/admin-client/client_secret
subPath: mas-admin-secret
readOnly: true
resources:
requests:
cpu: 200m
memory: 256Mi
limits:
cpu: "2"
memory: 1Gi
volumes:
- name: config
configMap:
name: matrix-authentication-service-config
items:
- key: config.yaml
path: config.yaml
- name: rendered
emptyDir: {}
- name: vault-secrets
emptyDir: {}
- name: vault-scripts
configMap:
name: comms-vault-env
defaultMode: 0555
---
apiVersion: v1
kind: Service
metadata:
name: matrix-authentication-service
spec:
selector:
app: matrix-authentication-service
ports:
- name: http
port: 8080
targetPort: http
protocol: TCP
- name: internal
port: 8081
targetPort: internal
protocol: TCP
Reference in New Issue View Git Blame Copy Permalink