Skip to content

Tweak CI values files#621

Merged
benbz merged 3 commits intomainfrom
bbz/tweak-ci-values-files
Jul 16, 2025
Merged

Tweak CI values files#621
benbz merged 3 commits intomainfrom
bbz/tweak-ci-values-files

Conversation

@benbz
Copy link
Copy Markdown
Member

@benbz benbz commented Jul 16, 2025

  • Introduce charts/matrix-stack/ci/example-default-enabled-components-checkov-values.yaml so that we've something that covers deploymentMarkers explicitly
  • Remove deploymentMarkers from {synapse,matrix-authentication-service}-minimal-values.yaml as removing them doesn't require additional values to be set
    • At which point it also disappears from the corresponding checkov values file
  • Remove deploymentMarkers from the Synapse based PyTests
    • The syn2mas test covers starting with legacy auth
    • The MAS PyTest does have deploymentMarkers available

@benbz benbz requested a review from a team as a code owner July 16, 2025 07:53
@github-actions
Copy link
Copy Markdown

github-actions Bot commented Jul 16, 2025 •
edited
Loading

dyff of changes in rendered templates of CI manifests

Full contents of manifests and dyffs are available in https://github.com/element-hq/ess-helm/actions/runs/16314148579/artifacts/3543190565

example-default-enabled-components-checkov-values.yaml (added) 
ConfigMap/ess-ci/release-name-element-web-nginx added
ConfigMap/ess-ci/release-name-element-web added
ConfigMap/ess-ci/release-name-haproxy added
ConfigMap/ess-ci/release-name-matrix-authentication-service added
ConfigMap/ess-ci/release-name-postgres added
ConfigMap/ess-ci/release-name-synapse-haproxy added
ConfigMap/ess-ci/release-name-synapse-hook added
ConfigMap/ess-ci/release-name-synapse added
ConfigMap/ess-ci/release-name-well-known-haproxy added
Deployment/ess-ci/release-name-element-web added
Deployment/ess-ci/release-name-haproxy added
Deployment/ess-ci/release-name-matrix-authentication-service added
Ingress/ess-ci/release-name-element-web added
Ingress/ess-ci/release-name-matrix-authentication-service added
Ingress/ess-ci/release-name-synapse added
Ingress/ess-ci/release-name-well-known added
Job/ess-ci/release-name-deployment-markers-post added
Job/ess-ci/release-name-deployment-markers-pre added
Job/ess-ci/release-name-init-secrets added
Job/ess-ci/release-name-synapse-check-config added
PersistentVolumeClaim/ess-ci/release-name-postgres-data added
PersistentVolumeClaim/ess-ci/release-name-synapse-media added
Role/ess-ci/release-name-deployment-markers-post added
Role/ess-ci/release-name-deployment-markers-pre added
Role/ess-ci/release-name-init-secrets added
RoleBinding/ess-ci/release-name-deployment-markers-post added
RoleBinding/ess-ci/release-name-deployment-markers-pre added
RoleBinding/ess-ci/release-name-init-secrets added
Secret/ess-ci/release-name-matrix-authentication-service added
Secret/ess-ci/release-name-synapse-hook added
Secret/ess-ci/release-name-synapse added
Service/ess-ci/release-name-element-web added
Service/ess-ci/release-name-haproxy added
Service/ess-ci/release-name-matrix-authentication-service added
Service/ess-ci/release-name-postgres added
Service/ess-ci/release-name-synapse-main added
Service/ess-ci/release-name-synapse added
Service/ess-ci/release-name-well-known added
ServiceAccount/ess-ci/release-name-deployment-markers-post added
ServiceAccount/ess-ci/release-name-deployment-markers-pre added
ServiceAccount/ess-ci/release-name-element-web added
ServiceAccount/ess-ci/release-name-haproxy added
ServiceAccount/ess-ci/release-name-init-secrets added
ServiceAccount/ess-ci/release-name-matrix-authentication-service added
ServiceAccount/ess-ci/release-name-postgres added
ServiceAccount/ess-ci/release-name-synapse-check-config added
ServiceAccount/ess-ci/release-name-synapse added
ServiceMonitor/ess-ci/release-name-haproxy added
ServiceMonitor/ess-ci/release-name-matrix-authentication-service added
ServiceMonitor/ess-ci/release-name-postgres added
ServiceMonitor/ess-ci/release-name-synapse added
StatefulSet/ess-ci/release-name-postgres added
StatefulSet/ess-ci/release-name-synapse-main added
pytest-matrix-rtc-synapse-wellknown-values.yaml 
@@ Job/ess-ci/release-name-deployment-markers-post @@
- ---
- # Source: matrix-stack/templates/deployment-markers/job.yaml
- apiVersion: batch/v1
- kind: Job
- metadata:
-   name: release-name-deployment-markers-post
-   namespace: ess-ci
-   annotations:
-     "helm.sh/hook": post-install,post-upgrade
-     "helm.sh/hook-weight": "-20"
-     has-no-service-monitor: "true"
-   labels:
-     helm.sh/chart: "matrix-stack-25.7.1-dev"
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/part-of: matrix-stack
-     app.kubernetes.io/component: matrix-tools
-     app.kubernetes.io/name: deployment-markers-post
-     app.kubernetes.io/instance: release-name-deployment-markers-post
-     app.kubernetes.io/version: "0.5.4"
- spec:
-   backoffLimit: 6
-   completionMode: NonIndexed
-   completions: 1
-   manualSelector: false
-   parallelism: 1
-   podReplacementPolicy: TerminatingOrFailed
-   template:
-     metadata:
-       annotations:
-         has-no-service-monitor: "true"
-       labels:
-         app.kubernetes.io/managed-by: Helm
-         app.kubernetes.io/part-of: matrix-stack
-         app.kubernetes.io/component: matrix-tools
-         app.kubernetes.io/name: deployment-markers-post
-         app.kubernetes.io/instance: release-name-deployment-markers-post
-         app.kubernetes.io/version: "0.5.4"
-     spec:
-       restartPolicy: OnFailure
-       automountServiceAccountToken: true
-       serviceAccountName: release-name-deployment-markers-post
-       securityContext:
-         fsGroup: 10010
-         runAsGroup: 0
-         runAsNonRoot: true
-         runAsUser: 10010
-         seccompProfile:
-           type: RuntimeDefault
-         supplementalGroups: []
-       containers:
-         - name: deployment-markers
-           image: "ghcr.io/element-hq/ess-helm/matrix-tools:0.5.4"
-           imagePullPolicy: Always
-           securityContext:
-             allowPrivilegeEscalation: false
-             capabilities:
-               drop:
-                 - ALL
-             readOnlyRootFilesystem: true
-           resources:
-             limits:
-               memory: 200Mi
-             requests:
-               cpu: 50m
-               memory: 50Mi
-           env:
-             - name: NAMESPACE
-               value: ess-ci
-           command:
-             - "/matrix-tools"
-             - "deployment-markers"
-             - "-step"
-             - "post"
-             - "-markers"
-             - "release-name-markers:MATRIX_STACK_MSC3861:legacy_auth:legacy_auth"
-             - "-labels"
-             - "app.kubernetes.io/managed-by=Helm,app.kubernetes.io/part-of=matrix-stack,app.kubernetes.io/component=matrix-tools,app.kubernetes.io/name=deployment-markers,app.kubernetes.io/instance=release-name-deployment-markers,app.kubernetes.io/version=0.5.4"


@@ Job/ess-ci/release-name-deployment-markers-pre @@
- ---
- # Source: matrix-stack/templates/deployment-markers/job.yaml
- apiVersion: batch/v1
- kind: Job
- metadata:
-   name: release-name-deployment-markers-pre
-   namespace: ess-ci
-   annotations:
-     "helm.sh/hook": pre-install,pre-upgrade
-     "helm.sh/hook-weight": "-20"
-     has-no-service-monitor: "true"
-   labels:
-     helm.sh/chart: "matrix-stack-25.7.1-dev"
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/part-of: matrix-stack
-     app.kubernetes.io/component: matrix-tools
-     app.kubernetes.io/name: deployment-markers-pre
-     app.kubernetes.io/instance: release-name-deployment-markers-pre
-     app.kubernetes.io/version: "0.5.4"
- spec:
-   backoffLimit: 6
-   completionMode: NonIndexed
-   completions: 1
-   manualSelector: false
-   parallelism: 1
-   podReplacementPolicy: TerminatingOrFailed
-   template:
-     metadata:
-       annotations:
-         has-no-service-monitor: "true"
-       labels:
-         app.kubernetes.io/managed-by: Helm
-         app.kubernetes.io/part-of: matrix-stack
-         app.kubernetes.io/component: matrix-tools
-         app.kubernetes.io/name: deployment-markers-pre
-         app.kubernetes.io/instance: release-name-deployment-markers-pre
-         app.kubernetes.io/version: "0.5.4"
-     spec:
-       restartPolicy: OnFailure
-       automountServiceAccountToken: true
-       serviceAccountName: release-name-deployment-markers-pre
-       securityContext:
-         fsGroup: 10010
-         runAsGroup: 0
-         runAsNonRoot: true
-         runAsUser: 10010
-         seccompProfile:
-           type: RuntimeDefault
-         supplementalGroups: []
-       containers:
-         - name: deployment-markers
-           image: "ghcr.io/element-hq/ess-helm/matrix-tools:0.5.4"
-           imagePullPolicy: Always
-           securityContext:
-             allowPrivilegeEscalation: false
-             capabilities:
-               drop:
-                 - ALL
-             readOnlyRootFilesystem: true
-           resources:
-             limits:
-               memory: 200Mi
-             requests:
-               cpu: 50m
-               memory: 50Mi
-           env:
-             - name: NAMESPACE
-               value: ess-ci
-           command:
-             - "/matrix-tools"
-             - "deployment-markers"
-             - "-step"
-             - "pre"
-             - "-markers"
-             - "release-name-markers:MATRIX_STACK_MSC3861:legacy_auth:legacy_auth"
-             - "-labels"
-             - "app.kubernetes.io/managed-by=Helm,app.kubernetes.io/part-of=matrix-stack,app.kubernetes.io/component=matrix-tools,app.kubernetes.io/name=deployment-markers,app.kubernetes.io/instance=release-name-deployment-markers,app.kubernetes.io/version=0.5.4"


@@ Role/ess-ci/release-name-deployment-markers-post @@
- ---
- # Source: matrix-stack/templates/deployment-markers/role.yaml
- apiVersion: rbac.authorization.k8s.io/v1
- kind: Role
- metadata:
-   name: release-name-deployment-markers-post
-   namespace: ess-ci
-   labels:
-     helm.sh/chart: "matrix-stack-25.7.1-dev"
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/part-of: matrix-stack
-     app.kubernetes.io/component: matrix-tools
-     app.kubernetes.io/name: deployment-markers-post
-     app.kubernetes.io/instance: release-name-deployment-markers-post
-     app.kubernetes.io/version: "0.5.4"
-   annotations:
-     "helm.sh/hook": post-install,post-upgrade
-     "helm.sh/hook-weight": "-20"
- rules:
-   - apiGroups: [""]
-     resources: ["configmaps"]
-     verbs: ["create"]
-   - apiGroups: [""]
-     resources: ["configmaps"]
-     resourceNames: ["release-name-markers"]
-     verbs: ["get", "update"]


@@ Role/ess-ci/release-name-deployment-markers-pre @@
- ---
- # Source: matrix-stack/templates/deployment-markers/role.yaml
- apiVersion: rbac.authorization.k8s.io/v1
- kind: Role
- metadata:
-   name: release-name-deployment-markers-pre
-   namespace: ess-ci
-   labels:
-     helm.sh/chart: "matrix-stack-25.7.1-dev"
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/part-of: matrix-stack
-     app.kubernetes.io/component: matrix-tools
-     app.kubernetes.io/name: deployment-markers-pre
-     app.kubernetes.io/instance: release-name-deployment-markers-pre
-     app.kubernetes.io/version: "0.5.4"
-   annotations:
-     "helm.sh/hook": pre-install,pre-upgrade
-     "helm.sh/hook-weight": "-20"
- rules:
-   - apiGroups: [""]
-     resources: ["configmaps"]
-     verbs: ["create"]
-   - apiGroups: [""]
-     resources: ["configmaps"]
-     resourceNames: ["release-name-markers"]
-     verbs: ["get", "update"]


@@ RoleBinding/ess-ci/release-name-deployment-markers-post @@
- ---
- # Source: matrix-stack/templates/deployment-markers/rolebinding.yaml
- apiVersion: rbac.authorization.k8s.io/v1
- kind: RoleBinding
- metadata:
-   name: release-name-deployment-markers-post
-   namespace: ess-ci
-   labels:
-     helm.sh/chart: "matrix-stack-25.7.1-dev"
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/part-of: matrix-stack
-     app.kubernetes.io/component: matrix-tools
-     app.kubernetes.io/name: deployment-markers-post
-     app.kubernetes.io/instance: release-name-deployment-markers-post
-     app.kubernetes.io/version: "0.5.4"
-   annotations:
-     "helm.sh/hook": post-install,post-upgrade
-     "helm.sh/hook-weight": "-20"
- roleRef:
-   apiGroup: rbac.authorization.k8s.io
-   kind: Role
-   name: release-name-deployment-markers-post
- subjects:
-   - kind: ServiceAccount
-     name: release-name-deployment-markers-post
-     namespace: ess-ci


@@ RoleBinding/ess-ci/release-name-deployment-markers-pre @@
- ---
- # Source: matrix-stack/templates/deployment-markers/rolebinding.yaml
- apiVersion: rbac.authorization.k8s.io/v1
- kind: RoleBinding
- metadata:
-   name: release-name-deployment-markers-pre
-   namespace: ess-ci
-   labels:
-     helm.sh/chart: "matrix-stack-25.7.1-dev"
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/part-of: matrix-stack
-     app.kubernetes.io/component: matrix-tools
-     app.kubernetes.io/name: deployment-markers-pre
-     app.kubernetes.io/instance: release-name-deployment-markers-pre
-     app.kubernetes.io/version: "0.5.4"
-   annotations:
-     "helm.sh/hook": pre-install,pre-upgrade
-     "helm.sh/hook-weight": "-20"
- roleRef:
-   apiGroup: rbac.authorization.k8s.io
-   kind: Role
-   name: release-name-deployment-markers-pre
- subjects:
-   - kind: ServiceAccount
-     name: release-name-deployment-markers-pre
-     namespace: ess-ci


@@ ServiceAccount/ess-ci/release-name-deployment-markers-post @@
- ---
- # Source: matrix-stack/templates/deployment-markers/serviceaccount.yaml
- apiVersion: v1
- kind: ServiceAccount
- metadata:
-   annotations:
-     helm.sh/hook: post-install,post-upgrade
-     helm.sh/hook-weight: "-20"
-   labels:
-     helm.sh/chart: "matrix-stack-25.7.1-dev"
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/part-of: matrix-stack
-     app.kubernetes.io/component: matrix-tools
-     app.kubernetes.io/name: deployment-markers-post
-     app.kubernetes.io/instance: release-name-deployment-markers-post
-     app.kubernetes.io/version: "0.5.4"
-   name: release-name-deployment-markers-post
-   namespace: ess-ci
- automountServiceAccountToken: false


@@ ServiceAccount/ess-ci/release-name-deployment-markers-pre @@
- ---
- # Source: matrix-stack/templates/deployment-markers/serviceaccount.yaml
- apiVersion: v1
- kind: ServiceAccount
- metadata:
-   annotations:
-     helm.sh/hook: pre-install,pre-upgrade
-     helm.sh/hook-weight: "-20"
-   labels:
-     helm.sh/chart: "matrix-stack-25.7.1-dev"
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/part-of: matrix-stack
-     app.kubernetes.io/component: matrix-tools
-     app.kubernetes.io/name: deployment-markers-pre
-     app.kubernetes.io/instance: release-name-deployment-markers-pre
-     app.kubernetes.io/version: "0.5.4"
-   name: release-name-deployment-markers-pre
-   namespace: ess-ci
- automountServiceAccountToken: false
pytest-synapse-values.yaml 
@@ Job/ess-ci/release-name-deployment-markers-post @@
- ---
- # Source: matrix-stack/templates/deployment-markers/job.yaml
- apiVersion: batch/v1
- kind: Job
- metadata:
-   name: release-name-deployment-markers-post
-   namespace: ess-ci
-   annotations:
-     "helm.sh/hook": post-install,post-upgrade
-     "helm.sh/hook-weight": "-20"
-     has-no-service-monitor: "true"
-   labels:
-     helm.sh/chart: "matrix-stack-25.7.1-dev"
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/part-of: matrix-stack
-     app.kubernetes.io/component: matrix-tools
-     app.kubernetes.io/name: deployment-markers-post
-     app.kubernetes.io/instance: release-name-deployment-markers-post
-     app.kubernetes.io/version: "0.5.4"
- spec:
-   backoffLimit: 6
-   completionMode: NonIndexed
-   completions: 1
-   manualSelector: false
-   parallelism: 1
-   podReplacementPolicy: TerminatingOrFailed
-   template:
-     metadata:
-       annotations:
-         has-no-service-monitor: "true"
-       labels:
-         app.kubernetes.io/managed-by: Helm
-         app.kubernetes.io/part-of: matrix-stack
-         app.kubernetes.io/component: matrix-tools
-         app.kubernetes.io/name: deployment-markers-post
-         app.kubernetes.io/instance: release-name-deployment-markers-post
-         app.kubernetes.io/version: "0.5.4"
-     spec:
-       restartPolicy: OnFailure
-       automountServiceAccountToken: true
-       serviceAccountName: release-name-deployment-markers-post
-       securityContext:
-         fsGroup: 10010
-         runAsGroup: 0
-         runAsNonRoot: true
-         runAsUser: 10010
-         seccompProfile:
-           type: RuntimeDefault
-         supplementalGroups: []
-       containers:
-         - name: deployment-markers
-           image: "ghcr.io/element-hq/ess-helm/matrix-tools:0.5.4"
-           imagePullPolicy: Always
-           securityContext:
-             allowPrivilegeEscalation: false
-             capabilities:
-               drop:
-                 - ALL
-             readOnlyRootFilesystem: true
-           resources:
-             limits:
-               memory: 200Mi
-             requests:
-               cpu: 50m
-               memory: 50Mi
-           env:
-             - name: NAMESPACE
-               value: ess-ci
-           command:
-             - "/matrix-tools"
-             - "deployment-markers"
-             - "-step"
-             - "post"
-             - "-markers"
-             - "release-name-markers:MATRIX_STACK_MSC3861:legacy_auth:legacy_auth"
-             - "-labels"
-             - "app.kubernetes.io/managed-by=Helm,app.kubernetes.io/part-of=matrix-stack,app.kubernetes.io/component=matrix-tools,app.kubernetes.io/name=deployment-markers,app.kubernetes.io/instance=release-name-deployment-markers,app.kubernetes.io/version=0.5.4"


@@ Job/ess-ci/release-name-deployment-markers-pre @@
- ---
- # Source: matrix-stack/templates/deployment-markers/job.yaml
- apiVersion: batch/v1
- kind: Job
- metadata:
-   name: release-name-deployment-markers-pre
-   namespace: ess-ci
-   annotations:
-     "helm.sh/hook": pre-install,pre-upgrade
-     "helm.sh/hook-weight": "-20"
-     has-no-service-monitor: "true"
-   labels:
-     helm.sh/chart: "matrix-stack-25.7.1-dev"
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/part-of: matrix-stack
-     app.kubernetes.io/component: matrix-tools
-     app.kubernetes.io/name: deployment-markers-pre
-     app.kubernetes.io/instance: release-name-deployment-markers-pre
-     app.kubernetes.io/version: "0.5.4"
- spec:
-   backoffLimit: 6
-   completionMode: NonIndexed
-   completions: 1
-   manualSelector: false
-   parallelism: 1
-   podReplacementPolicy: TerminatingOrFailed
-   template:
-     metadata:
-       annotations:
-         has-no-service-monitor: "true"
-       labels:
-         app.kubernetes.io/managed-by: Helm
-         app.kubernetes.io/part-of: matrix-stack
-         app.kubernetes.io/component: matrix-tools
-         app.kubernetes.io/name: deployment-markers-pre
-         app.kubernetes.io/instance: release-name-deployment-markers-pre
-         app.kubernetes.io/version: "0.5.4"
-     spec:
-       restartPolicy: OnFailure
-       automountServiceAccountToken: true
-       serviceAccountName: release-name-deployment-markers-pre
-       securityContext:
-         fsGroup: 10010
-         runAsGroup: 0
-         runAsNonRoot: true
-         runAsUser: 10010
-         seccompProfile:
-           type: RuntimeDefault
-         supplementalGroups: []
-       containers:
-         - name: deployment-markers
-           image: "ghcr.io/element-hq/ess-helm/matrix-tools:0.5.4"
-           imagePullPolicy: Always
-           securityContext:
-             allowPrivilegeEscalation: false
-             capabilities:
-               drop:
-                 - ALL
-             readOnlyRootFilesystem: true
-           resources:
-             limits:
-               memory: 200Mi
-             requests:
-               cpu: 50m
-               memory: 50Mi
-           env:
-             - name: NAMESPACE
-               value: ess-ci
-           command:
-             - "/matrix-tools"
-             - "deployment-markers"
-             - "-step"
-             - "pre"
-             - "-markers"
-             - "release-name-markers:MATRIX_STACK_MSC3861:legacy_auth:legacy_auth"
-             - "-labels"
-             - "app.kubernetes.io/managed-by=Helm,app.kubernetes.io/part-of=matrix-stack,app.kubernetes.io/component=matrix-tools,app.kubernetes.io/name=deployment-markers,app.kubernetes.io/instance=release-name-deployment-markers,app.kubernetes.io/version=0.5.4"


@@ Role/ess-ci/release-name-deployment-markers-post @@
- ---
- # Source: matrix-stack/templates/deployment-markers/role.yaml
- apiVersion: rbac.authorization.k8s.io/v1
- kind: Role
- metadata:
-   name: release-name-deployment-markers-post
-   namespace: ess-ci
-   labels:
-     helm.sh/chart: "matrix-stack-25.7.1-dev"
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/part-of: matrix-stack
-     app.kubernetes.io/component: matrix-tools
-     app.kubernetes.io/name: deployment-markers-post
-     app.kubernetes.io/instance: release-name-deployment-markers-post
-     app.kubernetes.io/version: "0.5.4"
-   annotations:
-     "helm.sh/hook": post-install,post-upgrade
-     "helm.sh/hook-weight": "-20"
- rules:
-   - apiGroups: [""]
-     resources: ["configmaps"]
-     verbs: ["create"]
-   - apiGroups: [""]
-     resources: ["configmaps"]
-     resourceNames: ["release-name-markers"]
-     verbs: ["get", "update"]


@@ Role/ess-ci/release-name-deployment-markers-pre @@
- ---
- # Source: matrix-stack/templates/deployment-markers/role.yaml
- apiVersion: rbac.authorization.k8s.io/v1
- kind: Role
- metadata:
-   name: release-name-deployment-markers-pre
-   namespace: ess-ci
-   labels:
-     helm.sh/chart: "matrix-stack-25.7.1-dev"
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/part-of: matrix-stack
-     app.kubernetes.io/component: matrix-tools
-     app.kubernetes.io/name: deployment-markers-pre
-     app.kubernetes.io/instance: release-name-deployment-markers-pre
-     app.kubernetes.io/version: "0.5.4"
-   annotations:
-     "helm.sh/hook": pre-install,pre-upgrade
-     "helm.sh/hook-weight": "-20"
- rules:
-   - apiGroups: [""]
-     resources: ["configmaps"]
-     verbs: ["create"]
-   - apiGroups: [""]
-     resources: ["configmaps"]
-     resourceNames: ["release-name-markers"]
-     verbs: ["get", "update"]


@@ RoleBinding/ess-ci/release-name-deployment-markers-post @@
- ---
- # Source: matrix-stack/templates/deployment-markers/rolebinding.yaml
- apiVersion: rbac.authorization.k8s.io/v1
- kind: RoleBinding
- metadata:
-   name: release-name-deployment-markers-post
-   namespace: ess-ci
-   labels:
-     helm.sh/chart: "matrix-stack-25.7.1-dev"
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/part-of: matrix-stack
-     app.kubernetes.io/component: matrix-tools
-     app.kubernetes.io/name: deployment-markers-post
-     app.kubernetes.io/instance: release-name-deployment-markers-post
-     app.kubernetes.io/version: "0.5.4"
-   annotations:
-     "helm.sh/hook": post-install,post-upgrade
-     "helm.sh/hook-weight": "-20"
- roleRef:
-   apiGroup: rbac.authorization.k8s.io
-   kind: Role
-   name: release-name-deployment-markers-post
- subjects:
-   - kind: ServiceAccount
-     name: release-name-deployment-markers-post
-     namespace: ess-ci


@@ RoleBinding/ess-ci/release-name-deployment-markers-pre @@
- ---
- # Source: matrix-stack/templates/deployment-markers/rolebinding.yaml
- apiVersion: rbac.authorization.k8s.io/v1
- kind: RoleBinding
- metadata:
-   name: release-name-deployment-markers-pre
-   namespace: ess-ci
-   labels:
-     helm.sh/chart: "matrix-stack-25.7.1-dev"
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/part-of: matrix-stack
-     app.kubernetes.io/component: matrix-tools
-     app.kubernetes.io/name: deployment-markers-pre
-     app.kubernetes.io/instance: release-name-deployment-markers-pre
-     app.kubernetes.io/version: "0.5.4"
-   annotations:
-     "helm.sh/hook": pre-install,pre-upgrade
-     "helm.sh/hook-weight": "-20"
- roleRef:
-   apiGroup: rbac.authorization.k8s.io
-   kind: Role
-   name: release-name-deployment-markers-pre
- subjects:
-   - kind: ServiceAccount
-     name: release-name-deployment-markers-pre
-     namespace: ess-ci


@@ ServiceAccount/ess-ci/release-name-deployment-markers-post @@
- ---
- # Source: matrix-stack/templates/deployment-markers/serviceaccount.yaml
- apiVersion: v1
- kind: ServiceAccount
- metadata:
-   annotations:
-     helm.sh/hook: post-install,post-upgrade
-     helm.sh/hook-weight: "-20"
-   labels:
-     helm.sh/chart: "matrix-stack-25.7.1-dev"
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/part-of: matrix-stack
-     app.kubernetes.io/component: matrix-tools
-     app.kubernetes.io/name: deployment-markers-post
-     app.kubernetes.io/instance: release-name-deployment-markers-post
-     app.kubernetes.io/version: "0.5.4"
-   name: release-name-deployment-markers-post
-   namespace: ess-ci
- automountServiceAccountToken: false


@@ ServiceAccount/ess-ci/release-name-deployment-markers-pre @@
- ---
- # Source: matrix-stack/templates/deployment-markers/serviceaccount.yaml
- apiVersion: v1
- kind: ServiceAccount
- metadata:
-   annotations:
-     helm.sh/hook: pre-install,pre-upgrade
-     helm.sh/hook-weight: "-20"
-   labels:
-     helm.sh/chart: "matrix-stack-25.7.1-dev"
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/part-of: matrix-stack
-     app.kubernetes.io/component: matrix-tools
-     app.kubernetes.io/name: deployment-markers-pre
-     app.kubernetes.io/instance: release-name-deployment-markers-pre
-     app.kubernetes.io/version: "0.5.4"
-   name: release-name-deployment-markers-pre
-   namespace: ess-ci
- automountServiceAccountToken: false
synapse-checkov-with-workers-values.yaml 
@@ Job/ess-ci/release-name-deployment-markers-post @@
- ---
- # Source: matrix-stack/templates/deployment-markers/job.yaml
- apiVersion: batch/v1
- kind: Job
- metadata:
-   name: release-name-deployment-markers-post
-   namespace: ess-ci
-   annotations:
-     "helm.sh/hook": post-install,post-upgrade
-     "helm.sh/hook-weight": "-20"
-     checkov.io/skip1: CKV_K8S_11=We deliberately don't set CPU limits. Pod is BestEffort not Guaranteed
-     checkov.io/skip2: CKV_K8S_43=No digests
-     checkov.io/skip3: CKV2_K8S_6=No network policy yet
-     checkov.io/skip4: CKV_K8S_38=The job needs a service account
-   labels:
-     helm.sh/chart: "matrix-stack-25.7.1-dev"
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/part-of: matrix-stack
-     app.kubernetes.io/component: matrix-tools
-     app.kubernetes.io/name: deployment-markers-post
-     app.kubernetes.io/instance: release-name-deployment-markers-post
-     app.kubernetes.io/version: "0.5.4"
- spec:
-   backoffLimit: 6
-   completionMode: NonIndexed
-   completions: 1
-   manualSelector: false
-   parallelism: 1
-   podReplacementPolicy: TerminatingOrFailed
-   template:
-     metadata:
-       annotations:
-         checkov.io/skip1: CKV_K8S_11=We deliberately don't set CPU limits. Pod is BestEffort not Guaranteed
-         checkov.io/skip2: CKV_K8S_43=No digests
-         checkov.io/skip3: CKV2_K8S_6=No network policy yet
-         checkov.io/skip4: CKV_K8S_38=The job needs a service account
-       labels:
-         app.kubernetes.io/managed-by: Helm
-         app.kubernetes.io/part-of: matrix-stack
-         app.kubernetes.io/component: matrix-tools
-         app.kubernetes.io/name: deployment-markers-post
-         app.kubernetes.io/instance: release-name-deployment-markers-post
-         app.kubernetes.io/version: "0.5.4"
-     spec:
-       restartPolicy: OnFailure
-       automountServiceAccountToken: true
-       serviceAccountName: release-name-deployment-markers-post
-       securityContext:
-         fsGroup: 10010
-         runAsGroup: 10010
-         runAsNonRoot: true
-         runAsUser: 10010
-         seccompProfile:
-           type: RuntimeDefault
-         supplementalGroups: []
-       containers:
-         - name: deployment-markers
-           image: "ghcr.io/element-hq/ess-helm/matrix-tools:0.5.4"
-           imagePullPolicy: Always
-           securityContext:
-             allowPrivilegeEscalation: false
-             capabilities:
-               drop:
-                 - ALL
-             readOnlyRootFilesystem: true
-           resources:
-             limits:
-               memory: 200Mi
-             requests:
-               cpu: 50m
-               memory: 50Mi
-           env:
-             - name: NAMESPACE
-               value: ess-ci
-           command:
-             - "/matrix-tools"
-             - "deployment-markers"
-             - "-step"
-             - "post"
-             - "-markers"
-             - "release-name-markers:MATRIX_STACK_MSC3861:legacy_auth:legacy_auth"
-             - "-labels"
-             - "app.kubernetes.io/managed-by=Helm,app.kubernetes.io/part-of=matrix-stack,app.kubernetes.io/component=matrix-tools,app.kubernetes.io/name=deployment-markers,app.kubernetes.io/instance=release-name-deployment-markers,app.kubernetes.io/version=0.5.4"


@@ Job/ess-ci/release-name-deployment-markers-pre @@
- ---
- # Source: matrix-stack/templates/deployment-markers/job.yaml
- apiVersion: batch/v1
- kind: Job
- metadata:
-   name: release-name-deployment-markers-pre
-   namespace: ess-ci
-   annotations:
-     "helm.sh/hook": pre-install,pre-upgrade
-     "helm.sh/hook-weight": "-20"
-     checkov.io/skip1: CKV_K8S_11=We deliberately don't set CPU limits. Pod is BestEffort not Guaranteed
-     checkov.io/skip2: CKV_K8S_43=No digests
-     checkov.io/skip3: CKV2_K8S_6=No network policy yet
-     checkov.io/skip4: CKV_K8S_38=The job needs a service account
-   labels:
-     helm.sh/chart: "matrix-stack-25.7.1-dev"
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/part-of: matrix-stack
-     app.kubernetes.io/component: matrix-tools
-     app.kubernetes.io/name: deployment-markers-pre
-     app.kubernetes.io/instance: release-name-deployment-markers-pre
-     app.kubernetes.io/version: "0.5.4"
- spec:
-   backoffLimit: 6
-   completionMode: NonIndexed
-   completions: 1
-   manualSelector: false
-   parallelism: 1
-   podReplacementPolicy: TerminatingOrFailed
-   template:
-     metadata:
-       annotations:
-         checkov.io/skip1: CKV_K8S_11=We deliberately don't set CPU limits. Pod is BestEffort not Guaranteed
-         checkov.io/skip2: CKV_K8S_43=No digests
-         checkov.io/skip3: CKV2_K8S_6=No network policy yet
-         checkov.io/skip4: CKV_K8S_38=The job needs a service account
-       labels:
-         app.kubernetes.io/managed-by: Helm
-         app.kubernetes.io/part-of: matrix-stack
-         app.kubernetes.io/component: matrix-tools
-         app.kubernetes.io/name: deployment-markers-pre
-         app.kubernetes.io/instance: release-name-deployment-markers-pre
-         app.kubernetes.io/version: "0.5.4"
-     spec:
-       restartPolicy: OnFailure
-       automountServiceAccountToken: true
-       serviceAccountName: release-name-deployment-markers-pre
-       securityContext:
-         fsGroup: 10010
-         runAsGroup: 10010
-         runAsNonRoot: true
-         runAsUser: 10010
-         seccompProfile:
-           type: RuntimeDefault
-         supplementalGroups: []
-       containers:
-         - name: deployment-markers
-           image: "ghcr.io/element-hq/ess-helm/matrix-tools:0.5.4"
-           imagePullPolicy: Always
-           securityContext:
-             allowPrivilegeEscalation: false
-             capabilities:
-               drop:
-                 - ALL
-             readOnlyRootFilesystem: true
-           resources:
-             limits:
-               memory: 200Mi
-             requests:
-               cpu: 50m
-               memory: 50Mi
-           env:
-             - name: NAMESPACE
-               value: ess-ci
-           command:
-             - "/matrix-tools"
-             - "deployment-markers"
-             - "-step"
-             - "pre"
-             - "-markers"
-             - "release-name-markers:MATRIX_STACK_MSC3861:legacy_auth:legacy_auth"
-             - "-labels"
-             - "app.kubernetes.io/managed-by=Helm,app.kubernetes.io/part-of=matrix-stack,app.kubernetes.io/component=matrix-tools,app.kubernetes.io/name=deployment-markers,app.kubernetes.io/instance=release-name-deployment-markers,app.kubernetes.io/version=0.5.4"


@@ Role/ess-ci/release-name-deployment-markers-post @@
- ---
- # Source: matrix-stack/templates/deployment-markers/role.yaml
- apiVersion: rbac.authorization.k8s.io/v1
- kind: Role
- metadata:
-   name: release-name-deployment-markers-post
-   namespace: ess-ci
-   labels:
-     helm.sh/chart: "matrix-stack-25.7.1-dev"
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/part-of: matrix-stack
-     app.kubernetes.io/component: matrix-tools
-     app.kubernetes.io/name: deployment-markers-post
-     app.kubernetes.io/instance: release-name-deployment-markers-post
-     app.kubernetes.io/version: "0.5.4"
-   annotations:
-     "helm.sh/hook": post-install,post-upgrade
-     "helm.sh/hook-weight": "-20"
- rules:
-   - apiGroups: [""]
-     resources: ["configmaps"]
-     verbs: ["create"]
-   - apiGroups: [""]
-     resources: ["configmaps"]
-     resourceNames: ["release-name-markers"]
-     verbs: ["get", "update"]


@@ Role/ess-ci/release-name-deployment-markers-pre @@
- ---
- # Source: matrix-stack/templates/deployment-markers/role.yaml
- apiVersion: rbac.authorization.k8s.io/v1
- kind: Role
- metadata:
-   name: release-name-deployment-markers-pre
-   namespace: ess-ci
-   labels:
-     helm.sh/chart: "matrix-stack-25.7.1-dev"
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/part-of: matrix-stack
-     app.kubernetes.io/component: matrix-tools
-     app.kubernetes.io/name: deployment-markers-pre
-     app.kubernetes.io/instance: release-name-deployment-markers-pre
-     app.kubernetes.io/version: "0.5.4"
-   annotations:
-     "helm.sh/hook": pre-install,pre-upgrade
-     "helm.sh/hook-weight": "-20"
- rules:
-   - apiGroups: [""]
-     resources: ["configmaps"]
-     verbs: ["create"]
-   - apiGroups: [""]
-     resources: ["configmaps"]
-     resourceNames: ["release-name-markers"]
-     verbs: ["get", "update"]


@@ RoleBinding/ess-ci/release-name-deployment-markers-post @@
- ---
- # Source: matrix-stack/templates/deployment-markers/rolebinding.yaml
- apiVersion: rbac.authorization.k8s.io/v1
- kind: RoleBinding
- metadata:
-   name: release-name-deployment-markers-post
-   namespace: ess-ci
-   labels:
-     helm.sh/chart: "matrix-stack-25.7.1-dev"
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/part-of: matrix-stack
-     app.kubernetes.io/component: matrix-tools
-     app.kubernetes.io/name: deployment-markers-post
-     app.kubernetes.io/instance: release-name-deployment-markers-post
-     app.kubernetes.io/version: "0.5.4"
-   annotations:
-     "helm.sh/hook": post-install,post-upgrade
-     "helm.sh/hook-weight": "-20"
- roleRef:
-   apiGroup: rbac.authorization.k8s.io
-   kind: Role
-   name: release-name-deployment-markers-post
- subjects:
-   - kind: ServiceAccount
-     name: release-name-deployment-markers-post
-     namespace: ess-ci


@@ RoleBinding/ess-ci/release-name-deployment-markers-pre @@
- ---
- # Source: matrix-stack/templates/deployment-markers/rolebinding.yaml
- apiVersion: rbac.authorization.k8s.io/v1
- kind: RoleBinding
- metadata:
-   name: release-name-deployment-markers-pre
-   namespace: ess-ci
-   labels:
-     helm.sh/chart: "matrix-stack-25.7.1-dev"
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/part-of: matrix-stack
-     app.kubernetes.io/component: matrix-tools
-     app.kubernetes.io/name: deployment-markers-pre
-     app.kubernetes.io/instance: release-name-deployment-markers-pre
-     app.kubernetes.io/version: "0.5.4"
-   annotations:
-     "helm.sh/hook": pre-install,pre-upgrade
-     "helm.sh/hook-weight": "-20"
- roleRef:
-   apiGroup: rbac.authorization.k8s.io
-   kind: Role
-   name: release-name-deployment-markers-pre
- subjects:
-   - kind: ServiceAccount
-     name: release-name-deployment-markers-pre
-     namespace: ess-ci


@@ ServiceAccount/ess-ci/release-name-deployment-markers-post @@
- ---
- # Source: matrix-stack/templates/deployment-markers/serviceaccount.yaml
- apiVersion: v1
- kind: ServiceAccount
- metadata:
-   annotations:
-     helm.sh/hook: post-install,post-upgrade
-     helm.sh/hook-weight: "-20"
-   labels:
-     helm.sh/chart: "matrix-stack-25.7.1-dev"
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/part-of: matrix-stack
-     app.kubernetes.io/component: matrix-tools
-     app.kubernetes.io/name: deployment-markers-post
-     app.kubernetes.io/instance: release-name-deployment-markers-post
-     app.kubernetes.io/version: "0.5.4"
-   name: release-name-deployment-markers-post
-   namespace: ess-ci
- automountServiceAccountToken: false


@@ ServiceAccount/ess-ci/release-name-deployment-markers-pre @@
- ---
- # Source: matrix-stack/templates/deployment-markers/serviceaccount.yaml
- apiVersion: v1
- kind: ServiceAccount
- metadata:
-   annotations:
-     helm.sh/hook: pre-install,pre-upgrade
-     helm.sh/hook-weight: "-20"
-   labels:
-     helm.sh/chart: "matrix-stack-25.7.1-dev"
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/part-of: matrix-stack
-     app.kubernetes.io/component: matrix-tools
-     app.kubernetes.io/name: deployment-markers-pre
-     app.kubernetes.io/instance: release-name-deployment-markers-pre
-     app.kubernetes.io/version: "0.5.4"
-   name: release-name-deployment-markers-pre
-   namespace: ess-ci
- automountServiceAccountToken: false
synapse-minimal-values.yaml 
@@ Job/ess-ci/release-name-deployment-markers-post @@
- ---
- # Source: matrix-stack/templates/deployment-markers/job.yaml
- apiVersion: batch/v1
- kind: Job
- metadata:
-   name: release-name-deployment-markers-post
-   namespace: ess-ci
-   annotations:
-     "helm.sh/hook": post-install,post-upgrade
-     "helm.sh/hook-weight": "-20"
-   labels:
-     helm.sh/chart: "matrix-stack-25.7.1-dev"
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/part-of: matrix-stack
-     app.kubernetes.io/component: matrix-tools
-     app.kubernetes.io/name: deployment-markers-post
-     app.kubernetes.io/instance: release-name-deployment-markers-post
-     app.kubernetes.io/version: "0.5.4"
- spec:
-   backoffLimit: 6
-   completionMode: NonIndexed
-   completions: 1
-   manualSelector: false
-   parallelism: 1
-   podReplacementPolicy: TerminatingOrFailed
-   template:
-     metadata:
-       annotations:
-       labels:
-         app.kubernetes.io/managed-by: Helm
-         app.kubernetes.io/part-of: matrix-stack
-         app.kubernetes.io/component: matrix-tools
-         app.kubernetes.io/name: deployment-markers-post
-         app.kubernetes.io/instance: release-name-deployment-markers-post
-         app.kubernetes.io/version: "0.5.4"
-     spec:
-       restartPolicy: OnFailure
-       automountServiceAccountToken: true
-       serviceAccountName: release-name-deployment-markers-post
-       securityContext:
-         fsGroup: 10010
-         runAsGroup: 10010
-         runAsNonRoot: true
-         runAsUser: 10010
-         seccompProfile:
-           type: RuntimeDefault
-         supplementalGroups: []
-       containers:
-         - name: deployment-markers
-           image: "ghcr.io/element-hq/ess-helm/matrix-tools:0.5.4"
-           imagePullPolicy: Always
-           securityContext:
-             allowPrivilegeEscalation: false
-             capabilities:
-               drop:
-                 - ALL
-             readOnlyRootFilesystem: true
-           resources:
-             limits:
-               memory: 200Mi
-             requests:
-               cpu: 50m
-               memory: 50Mi
-           env:
-             - name: NAMESPACE
-               value: ess-ci
-           command:
-             - "/matrix-tools"
-             - "deployment-markers"
-             - "-step"
-             - "post"
-             - "-markers"
-             - "release-name-markers:MATRIX_STACK_MSC3861:legacy_auth:legacy_auth"
-             - "-labels"
-             - "app.kubernetes.io/managed-by=Helm,app.kubernetes.io/part-of=matrix-stack,app.kubernetes.io/component=matrix-tools,app.kubernetes.io/name=deployment-markers,app.kubernetes.io/instance=release-name-deployment-markers,app.kubernetes.io/version=0.5.4"


@@ Job/ess-ci/release-name-deployment-markers-pre @@
- ---
- # Source: matrix-stack/templates/deployment-markers/job.yaml
- apiVersion: batch/v1
- kind: Job
- metadata:
-   name: release-name-deployment-markers-pre
-   namespace: ess-ci
-   annotations:
-     "helm.sh/hook": pre-install,pre-upgrade
-     "helm.sh/hook-weight": "-20"
-   labels:
-     helm.sh/chart: "matrix-stack-25.7.1-dev"
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/part-of: matrix-stack
-     app.kubernetes.io/component: matrix-tools
-     app.kubernetes.io/name: deployment-markers-pre
-     app.kubernetes.io/instance: release-name-deployment-markers-pre
-     app.kubernetes.io/version: "0.5.4"
- spec:
-   backoffLimit: 6
-   completionMode: NonIndexed
-   completions: 1
-   manualSelector: false
-   parallelism: 1
-   podReplacementPolicy: TerminatingOrFailed
-   template:
-     metadata:
-       annotations:
-       labels:
-         app.kubernetes.io/managed-by: Helm
-         app.kubernetes.io/part-of: matrix-stack
-         app.kubernetes.io/component: matrix-tools
-         app.kubernetes.io/name: deployment-markers-pre
-         app.kubernetes.io/instance: release-name-deployment-markers-pre
-         app.kubernetes.io/version: "0.5.4"
-     spec:
-       restartPolicy: OnFailure
-       automountServiceAccountToken: true
-       serviceAccountName: release-name-deployment-markers-pre
-       securityContext:
-         fsGroup: 10010
-         runAsGroup: 10010
-         runAsNonRoot: true
-         runAsUser: 10010
-         seccompProfile:
-           type: RuntimeDefault
-         supplementalGroups: []
-       containers:
-         - name: deployment-markers
-           image: "ghcr.io/element-hq/ess-helm/matrix-tools:0.5.4"
-           imagePullPolicy: Always
-           securityContext:
-             allowPrivilegeEscalation: false
-             capabilities:
-               drop:
-                 - ALL
-             readOnlyRootFilesystem: true
-           resources:
-             limits:
-               memory: 200Mi
-             requests:
-               cpu: 50m
-               memory: 50Mi
-           env:
-             - name: NAMESPACE
-               value: ess-ci
-           command:
-             - "/matrix-tools"
-             - "deployment-markers"
-             - "-step"
-             - "pre"
-             - "-markers"
-             - "release-name-markers:MATRIX_STACK_MSC3861:legacy_auth:legacy_auth"
-             - "-labels"
-             - "app.kubernetes.io/managed-by=Helm,app.kubernetes.io/part-of=matrix-stack,app.kubernetes.io/component=matrix-tools,app.kubernetes.io/name=deployment-markers,app.kubernetes.io/instance=release-name-deployment-markers,app.kubernetes.io/version=0.5.4"


@@ Role/ess-ci/release-name-deployment-markers-post @@
- ---
- # Source: matrix-stack/templates/deployment-markers/role.yaml
- apiVersion: rbac.authorization.k8s.io/v1
- kind: Role
- metadata:
-   name: release-name-deployment-markers-post
-   namespace: ess-ci
-   labels:
-     helm.sh/chart: "matrix-stack-25.7.1-dev"
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/part-of: matrix-stack
-     app.kubernetes.io/component: matrix-tools
-     app.kubernetes.io/name: deployment-markers-post
-     app.kubernetes.io/instance: release-name-deployment-markers-post
-     app.kubernetes.io/version: "0.5.4"
-   annotations:
-     "helm.sh/hook": post-install,post-upgrade
-     "helm.sh/hook-weight": "-20"
- rules:
-   - apiGroups: [""]
-     resources: ["configmaps"]
-     verbs: ["create"]
-   - apiGroups: [""]
-     resources: ["configmaps"]
-     resourceNames: ["release-name-markers"]
-     verbs: ["get", "update"]


@@ Role/ess-ci/release-name-deployment-markers-pre @@
- ---
- # Source: matrix-stack/templates/deployment-markers/role.yaml
- apiVersion: rbac.authorization.k8s.io/v1
- kind: Role
- metadata:
-   name: release-name-deployment-markers-pre
-   namespace: ess-ci
-   labels:
-     helm.sh/chart: "matrix-stack-25.7.1-dev"
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/part-of: matrix-stack
-     app.kubernetes.io/component: matrix-tools
-     app.kubernetes.io/name: deployment-markers-pre
-     app.kubernetes.io/instance: release-name-deployment-markers-pre
-     app.kubernetes.io/version: "0.5.4"
-   annotations:
-     "helm.sh/hook": pre-install,pre-upgrade
-     "helm.sh/hook-weight": "-20"
- rules:
-   - apiGroups: [""]
-     resources: ["configmaps"]
-     verbs: ["create"]
-   - apiGroups: [""]
-     resources: ["configmaps"]
-     resourceNames: ["release-name-markers"]
-     verbs: ["get", "update"]


@@ RoleBinding/ess-ci/release-name-deployment-markers-post @@
- ---
- # Source: matrix-stack/templates/deployment-markers/rolebinding.yaml
- apiVersion: rbac.authorization.k8s.io/v1
- kind: RoleBinding
- metadata:
-   name: release-name-deployment-markers-post
-   namespace: ess-ci
-   labels:
-     helm.sh/chart: "matrix-stack-25.7.1-dev"
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/part-of: matrix-stack
-     app.kubernetes.io/component: matrix-tools
-     app.kubernetes.io/name: deployment-markers-post
-     app.kubernetes.io/instance: release-name-deployment-markers-post
-     app.kubernetes.io/version: "0.5.4"
-   annotations:
-     "helm.sh/hook": post-install,post-upgrade
-     "helm.sh/hook-weight": "-20"
- roleRef:
-   apiGroup: rbac.authorization.k8s.io
-   kind: Role
-   name: release-name-deployment-markers-post
- subjects:
-   - kind: ServiceAccount
-     name: release-name-deployment-markers-post
-     namespace: ess-ci


@@ RoleBinding/ess-ci/release-name-deployment-markers-pre @@
- ---
- # Source: matrix-stack/templates/deployment-markers/rolebinding.yaml
- apiVersion: rbac.authorization.k8s.io/v1
- kind: RoleBinding
- metadata:
-   name: release-name-deployment-markers-pre
-   namespace: ess-ci
-   labels:
-     helm.sh/chart: "matrix-stack-25.7.1-dev"
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/part-of: matrix-stack
-     app.kubernetes.io/component: matrix-tools
-     app.kubernetes.io/name: deployment-markers-pre
-     app.kubernetes.io/instance: release-name-deployment-markers-pre
-     app.kubernetes.io/version: "0.5.4"
-   annotations:
-     "helm.sh/hook": pre-install,pre-upgrade
-     "helm.sh/hook-weight": "-20"
- roleRef:
-   apiGroup: rbac.authorization.k8s.io
-   kind: Role
-   name: release-name-deployment-markers-pre
- subjects:
-   - kind: ServiceAccount
-     name: release-name-deployment-markers-pre
-     namespace: ess-ci


@@ ServiceAccount/ess-ci/release-name-deployment-markers-post @@
- ---
- # Source: matrix-stack/templates/deployment-markers/serviceaccount.yaml
- apiVersion: v1
- kind: ServiceAccount
- metadata:
-   annotations:
-     helm.sh/hook: post-install,post-upgrade
-     helm.sh/hook-weight: "-20"
-   labels:
-     helm.sh/chart: "matrix-stack-25.7.1-dev"
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/part-of: matrix-stack
-     app.kubernetes.io/component: matrix-tools
-     app.kubernetes.io/name: deployment-markers-post
-     app.kubernetes.io/instance: release-name-deployment-markers-post
-     app.kubernetes.io/version: "0.5.4"
-   name: release-name-deployment-markers-post
-   namespace: ess-ci
- automountServiceAccountToken: false


@@ ServiceAccount/ess-ci/release-name-deployment-markers-pre @@
- ---
- # Source: matrix-stack/templates/deployment-markers/serviceaccount.yaml
- apiVersion: v1
- kind: ServiceAccount
- metadata:
-   annotations:
-     helm.sh/hook: pre-install,pre-upgrade
-     helm.sh/hook-weight: "-20"
-   labels:
-     helm.sh/chart: "matrix-stack-25.7.1-dev"
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/part-of: matrix-stack
-     app.kubernetes.io/component: matrix-tools
-     app.kubernetes.io/name: deployment-markers-pre
-     app.kubernetes.io/instance: release-name-deployment-markers-pre
-     app.kubernetes.io/version: "0.5.4"
-   name: release-name-deployment-markers-pre
-   namespace: ess-ci
- automountServiceAccountToken: false

@benbz benbz force-pushed the bbz/tweak-ci-values-files branch from 6c53a45 to 803ad34 Compare July 16, 2025 08:03
@benbz
Copy link
Copy Markdown
Member Author

benbz commented Jul 16, 2025

No dyff changes to matrix-authentication-service-checkov-values.yaml and matrix-authentication-service-minimal-values.yaml as currently the deployment marker manifests are only deployed if the in-chart Synapse is deployed. This may need to be revisited

@benbz benbz force-pushed the bbz/tweak-ci-values-files branch from 803ad34 to 90810f5 Compare July 16, 2025 08:14
@benbz benbz merged commit 7b9d790 into main Jul 16, 2025
67 checks passed
@benbz benbz deleted the bbz/tweak-ci-values-files branch July 16, 2025 08:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gaelgatelement gaelgatelement gaelgatelement approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@benbz @gaelgatelement
⚡