2.19.7

Dockerfile.operator

@@ -28,3 +28,5 @@ LABEL git_commit=$GIT_COMMIT
 
 COPY --from=build-tmp   /element.io /element.io
 RUN chmod -R 0755 /element.io
+
+USER 32000

Dockerfile.updater

@@ -19,3 +19,5 @@ COPY roles/generic_apply  /element.io/roles/generic_apply/
 COPY playbooks/elementdeployment.yml playbooks/any.yml /element.io/playbooks/
 
 RUN chmod -R 0755 /element.io
+
+USER 32001

config/rbac/role.yaml

@@ -4,4 +4,3 @@
 
 
 # Stub file for operator-sdk create api --group matrix --version v1alpha1 --kind <Kind> to work
-

conversion/Dockerfile.operator

@@ -20,3 +20,5 @@ WORKDIR /
 COPY --from=buildstage  /app/conversion-webhook /
 EXPOSE 8443
 ENTRYPOINT ["/conversion-webhook"]
+
+USER 30000

conversion/Dockerfile.updater

@@ -21,3 +21,5 @@ COPY --from=buildstage  /app/conversion-webhook /
 
 EXPOSE 8443
 ENTRYPOINT ["/conversion-webhook"]
+
+USER 30001

helm/ess-stack/Chart.yaml

@@ -0,0 +1,11 @@
+# Copyright 2024 New Vector Ltd
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+
+apiVersion: v2
+name: ess-stack
+description: A Helm chart to deploy ESS stack
+type: application
+version: 2.19.7
+appVersion: 2.19.7

helm/ess-stack/templates/_helpers.tpl

@@ -0,0 +1,14 @@
+# Copyright 2024 New Vector Ltd
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+
+{{/*
+Template the configuration of an ems image store from Helm values/secrets
+*/}}
+{{- define "ess.secrets.credentials.ems-image-store" }}
+{{- with .Values.emsImageStore }}
+{{- printf "{\"auths\":{\"registry.element.io\":{\"auth\":\"%s\"}, \"gitlab-registry.matrix.org/ems-image-store\":{\"auth\":\"%s\"}}}" (printf "%s:%s" .username .password | b64enc) (printf "%s:%s" .username .password | b64enc) | b64enc }}
+{{- end }}
+{{- end }}
+

helm/ess-stack/templates/elementdeployment.yaml

@@ -0,0 +1,21 @@
+# Copyright 2024 New Vector Ltd
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+
+apiVersion: matrix.element.io/v1alpha2
+kind: ElementDeployment
+metadata:
+  name: {{ .Release.Name }}
+  annotations:
+    k8s.element.io/secretshash: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
+spec:
+  components:
+{{ range $component, $properties := $.Values.components }}
+    {{ $component }}:
+      secretName: {{ (index $.Values.secrets $component).existingSecret | default (printf "%s-secret" ($component | lower) )  }}
+      {{ tpl (toYaml $properties) $ | nindent 6 }}
+{{ end }}
+  global:
+    secretName: {{ $.Values.secrets.global.existingSecret | default ("global-secret")  }}
+    {{ tpl (toYaml $.Values.global) . | nindent 4 }}

helm/ess-stack/templates/secrets.yaml

@@ -0,0 +1,17 @@
+# Copyright 2024 New Vector Ltd
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+
+{{ range $component, $secret := $.Values.secrets }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ $component | lower  }}-secret
+type: Opaque
+data:
+{{ range $key, $value := $secret.content }}
+  {{ $key }}: {{ $value | b64enc }}
+{{ end }}
+---
+{{ end }}