commit 0b46f78246924d35039c66fbf7899b7ece9ce8c4
parent 9aa4004ffcffe6e867ff73f0209c005e68e35e20
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Fri, 25 Jul 2025 16:19:33 +0200
Update
Diffstat:
2 files changed, 128 insertions(+), 90 deletions(-)
diff --git a/apps/2024_cluster/secrets/connectivity_tester.yaml b/apps/2024_cluster/secrets/connectivity_tester.yaml
@@ -5,7 +5,7 @@ metadata:
namespace: matrix
type: Opaque
stringData:
- config.yaml: ENC[AES256_GCM,data:uGxNLRJq62W7cVnnlvvt6D4UdFXaRJsfoqIHVFbqwfbs7dp+Xi6DDOQ72OQepfCZIotuguBDITdPjFEvr7fW+y6tUMrPIJQTEceD2S39h6fuH2XYmXzpVvke8VLMtbWeX8x6VCUFHNhB166wqW3FbdUSsToFKlpEX/H1YWZ76er6poUJbEmvJXvndjDiRhTcUoghx6hgWI9jb5ar1JecAfcGuPg3XsJEQq6HxWSKAoRLiU8V5GNvgdz4BTRJ2/PY5tjysHYt14Cen3L4rimKasuUnCbU/SIrvS/L2buZSAfI5HXyCIciMn53HvhFyZiKD+NkF1504KjK7I+kVSZnHE3WsADfNX1CqTJ7yj3JvOcrG2BNsm+2S2MY5N/hIDbxKOMeFp72wZPP0lkDyYONjMgWKzHd/TBOWYL+vHK2n+GaQkPXo/bXPF6kyy7rFzQRtw5oM4ObKpB6FJrWiIXqz7S5T0jfHVRR2Cg/eddH5CrqB4rR6orDU2GvomYSWZaNeu/FC2x6+CFhOTN3h+dE7vcEfT/bHJlWPg0A2+swlZE9kJqbpuE+vkCLSNHoR4QSzedGxL8hQWYOYfNiMcwCT7nCFwMePsgLt5RRVz9SXgTeklHD2Zz19jO0fnjoY9tflbbdvh28ztP/oUWrInXFhQ7IhbJQh38L3qCm7ReY2pG3QDy8uhET81q9qlnffOStIG8F+18CNPfyrEb2cVhRc5TeUyrJG8eweQ4uijHtMg==,iv:DKJJQ6j+BbkSkUboXzLYH21g2UvIDHLUPm0lFTLL79w=,tag:uzWwJ98dsfdVv/iy0B0cvw==,type:str]
+ config.yaml: ENC[AES256_GCM,data:9+xUlhm/W1QceUci8tOYmdnYtMhy0elcedXnlCwYOzQ9TpnnmS44FRKlITGqFoUUWmFwA09L7TJn8t0CVbFj1/2OP9btAHmcXhkgrCpmWrSiI6fPFdlFIXI0UTBuJZfC3lC6IB8rNym+1f+5UukARIGKRGBIYtuThYXETrY5lTYTsJ5qovoa8i9HP58T2UVLQc6ZCREElJDnyZC27J5tQ2kavtdYwoxtQUYJxAqHGWW61fw41qSfzW2MRAcrWnZ9D8R/CvC1c5FuqonDkE730kvk1HH/tMC18iMS1lWYtpM1zgaLLnA88vo4Y1UQkF/5N+wgp7NlfCdzaKt0qJ9vNXng82pRF2phjfgTiFjhC7aMCa9tKp12VMJyI41nSw7ytFbJ4wznvaMp1A38Og8DYmT4O7Bky4pFbQ9vXJ4VrHjvUmA0BhCtZRcPlcSdedznOj8LPLSeqfaLIJZ8nWgHElE5Cvrc/mB16qCUDSlkIxRDxGEw1tBcRIjBHO2XcDxDagLqRfxkOZ16a9iCvYq5vCMZp7SqwmJL/mc5cbkaP9+MnSY9lriE6ctBddQNcLW90BmHcf5RuDoNmBRSy1wG78HIHTSwzvpZjfZ4AXMf4mkGhohIBPVu0tCTrYpSdMrV88icIqgXNpKpYmpxYxA5/daMlY9eyx5lzrI+I3ZZ5UaUQZEGNRl0yqZp7q6/HcMD6M2rNIV9K4fmmRLV0hLJ+QOqtSmB587SCBzcxUiEYQ==,iv:uZLfSDlS9dVAjn48smAhix9cXEJMydEaNCKMZ+OvW+c=,tag:wbaGGomRoE+/IHKWtNueXA==,type:str]
sops:
kms: []
gcp_kms: []
@@ -15,14 +15,43 @@ sops:
- recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNakRMOXY3eDF6S28zelFa
- elY1OWwwa2Jsd24xWWU4d29NeGlGRGhMOGgwCkM2Ry9pMWMxZWFxWi9KQUhyNFdq
- ay9HTGhRWU1hTVNaK0hoR1JOd0lhOHMKLS0tIFp4YlpheDloSENIR3JSdXpLVUFM
- akNYc29Lb3lzV2t2OVpkUllmdDUxSncKyKge+Qdxa0pF9C2ebUQU9A6sBCqUAVIO
- p9fwoUuGXNNdh4OY25dqTHwPQV1ehtU/6DX9DiKpiFeuyArHs7slVA==
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxT1FaNGpTTFd3bmJwRUNj
+ VlQxOHh6U2JEWU9yQ2VOK25yMGwycUV2aDBvCmpxVXZPbUZ0UTdNTWtPUnkrZGhC
+ MW1vOWVtZGVxZzRyaG9EWWpPdk5EV0EKLS0tIGp5STZNUUg0bFRHc29KbitKVk42
+ WlkyVk94U1NHeER5T2NEM0w4MmgzM3cKEB5CAlKIELESDvGA9iX8QyIUuDYJ5ekz
+ POqNU/+I6V9t5CdaR2C3uZOTCHcWecUT4CQwibrXHgsGiRW1Aqx1ag==
-----END AGE ENCRYPTED FILE-----
- lastmodified: "2025-07-19T09:05:33Z"
- mac: ENC[AES256_GCM,data:DSw1grQAZzjAr6OpJHsqaZZKoiStdAPwo/2sgtio8gCVt9fMyDRhlgg30YlLnQC9zbhA6QkmZ3qRkDzqcG4oyT108GUoM31XkYTK+E4LAONTO8rjMV1f52Bw3cKH/qYqsOBOs08u4BPWOBfQVzEasK9Lk1bCv3QQ1M+pvFr7E/A=,iv:OEpGlv9U3lGzmCL086RHzUeSbmVYjK+x+GDtY9UTQoY=,tag:SDeCjqguuK+FnyrOOTPLzA==,type:str]
+ lastmodified: "2025-07-25T14:11:31Z"
+ mac: ENC[AES256_GCM,data:Rg/LIpK9muWCpEeMAvpIWeunc56446AE/pch871aIFtI5aSpp6r0GB3xnJJbt5lzCVW7saX+8cMGrGr5DfnwdUVNM8ciXF+wieFULpnt8lixBG31QjTpcrCHQoZNvLPERdk5bvb53cnCgjXq6vZZ7B0WbX6MKCUWIvBMgcbzWIM=,iv:SIAf0GMEpCMMZ0PZXveTOYWFpECKpUn/VcXeFkjQbzY=,tag:H6Lpo6WjCo0PdVcISJgw8A==,type:str]
+ pgp: []
+ encrypted_regex: ^(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: v1
+kind: Secret
+metadata:
+ name: connectivity-tester-config
+ namespace: matrix
+type: Opaque
+stringData:
+ config.yaml: ENC[AES256_GCM,data:esU6pUpxPOORsMIqzDNRszNcYVJ9OxwiBr76ChPDUf2noEX3oK8RfPBZ3uGYWv7VA1e44FKpUJBN5l/JUnd1mtcLqY8f68Z2JGnGYWQzieCpxYZf5e/YJYmQa2s8fn2/Fu0baCfoUUrCKO8nTPpGFzl3bjJC7tIs3h36PpNNYvjyF5tD++DemiXg5pSCF0PhTQbJ7Bm5/JJ854rE2S5jsmEtAviMrrNrl2GFzePG8Ba8zcnor4vXsHUlVU6IVbtFUNptv3Rlu6Aus+304zoLQechS5oCSgYuNl3A+v8dxbzMC+WNGwzMIM1RH4nPsaEK0mbpdN2LrnHybKjr88NzhgAtP2d+0+beVilMHAlmTD7mMJ0pVbVMGAAtV7q+bWQo+nLTPyxaSpNiTbLre7VYXfRergyfTSnKpw6zs4tvKF3A6sl99PpgfRCyydJN04adq7Ca4gQYWaE0HFZ96SfWkbexM3RaVIxCbfTLJLidhZugQ1t1oeFsMVi/IlnB/mUtTBoCrAHFBRkYv5pgnCw4c547S4/xtSc6634C0yCvSzoJtSdVeUTue9SjC4gO4S3kP+x5esP4emvQ0sdpKBkMwv3DuVIlX2izhMOw6dLV0eeAU0XMp1ogpA+UX665kf/g8fyOWftVMeBrVZVbvvSXkbJEylaeXnAciEo7aMa+VnUDj/M0MNj+yPaplpPvKwIT1R2Fn1utm/2juBUb9Q==,iv:lIHWP/z0g2WPtlwGLw5rp6OhX6pNtMTM3VkgfKlvRGw=,tag:EUNFJv6Q6BEfgX/e0QAR/g==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxT1FaNGpTTFd3bmJwRUNj
+ VlQxOHh6U2JEWU9yQ2VOK25yMGwycUV2aDBvCmpxVXZPbUZ0UTdNTWtPUnkrZGhC
+ MW1vOWVtZGVxZzRyaG9EWWpPdk5EV0EKLS0tIGp5STZNUUg0bFRHc29KbitKVk42
+ WlkyVk94U1NHeER5T2NEM0w4MmgzM3cKEB5CAlKIELESDvGA9iX8QyIUuDYJ5ekz
+ POqNU/+I6V9t5CdaR2C3uZOTCHcWecUT4CQwibrXHgsGiRW1Aqx1ag==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-07-25T14:11:31Z"
+ mac: ENC[AES256_GCM,data:Rg/LIpK9muWCpEeMAvpIWeunc56446AE/pch871aIFtI5aSpp6r0GB3xnJJbt5lzCVW7saX+8cMGrGr5DfnwdUVNM8ciXF+wieFULpnt8lixBG31QjTpcrCHQoZNvLPERdk5bvb53cnCgjXq6vZZ7B0WbX6MKCUWIvBMgcbzWIM=,iv:SIAf0GMEpCMMZ0PZXveTOYWFpECKpUn/VcXeFkjQbzY=,tag:H6Lpo6WjCo0PdVcISJgw8A==,type:str]
pgp: []
encrypted_regex: ^(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
version: 3.9.1
diff --git a/apps/base/matrix/connectivity-tester/deployment.yaml b/apps/base/matrix/connectivity-tester/deployment.yaml
@@ -21,62 +21,62 @@ spec:
podAntiAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
- labelSelector:
- matchExpressions:
- - key: app
- operator: In
- values:
- - connectivity-tester
+ matchExpressions:
+ - key: app
+ operator: In
+ values:
+ - connectivity-tester
topologyKey: "kubernetes.io/hostname"
imagePullSecrets:
- name: ghcr-pull
hostNetwork: false
containers:
- name: connection-checker-ui
- image: ghcr.io/mtrnord/matrix-connection-tester-ui:v0.1.0
+ image: ghcr.io/mtrnord/matrix-connection-tester-ui:v0.2.0
imagePullPolicy: Always
lifecycle:
- preStop:
- exec:
- command:
- - sleep
- - "10"
+ preStop:
+ exec:
+ command:
+ - sleep
+ - "10"
resources:
- limits: {}
- requests:
- memory: "344Mi"
- cpu: "252m"
+ limits: {}
+ requests:
+ memory: "344Mi"
+ cpu: "252m"
ports:
- - containerPort: 3000
- name: web
- protocol: TCP
+ - containerPort: 3000
+ name: web
+ protocol: TCP
volumeMounts:
- - name: configs
- mountPath: "/usr/share/nginx/html/config.json"
- subPath: config.json
- readOnly: true
- - mountPath: /tmp
- name: tmp
+ - name: configs
+ mountPath: "/usr/share/nginx/html/config.json"
+ subPath: config.json
+ readOnly: true
+ - mountPath: /tmp
+ name: tmp
livenessProbe:
- httpGet:
- path: /
- port: web
- scheme: HTTP
+ httpGet:
+ path: /
+ port: web
+ scheme: HTTP
readinessProbe:
- httpGet:
- path: /
- port: web
- scheme: HTTP
+ httpGet:
+ path: /
+ port: web
+ scheme: HTTP
startupProbe:
- httpGet:
- path: /
- port: web
+ httpGet:
+ path: /
+ port: web
volumes:
- name: configs
configMap:
- name: connectivity-tester-config
+ name: connectivity-tester-config
- name: tmp
emptyDir:
- sizeLimit: 2048Mi
+ sizeLimit: 2048Mi
---
apiVersion: apps/v1
kind: Deployment
@@ -101,46 +101,55 @@ spec:
podAntiAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
- labelSelector:
- matchExpressions:
- - key: app
- operator: In
- values:
- - connectivity-tester-api
+ matchExpressions:
+ - key: app
+ operator: In
+ values:
+ - connectivity-tester-api
topologyKey: "kubernetes.io/hostname"
imagePullSecrets:
- name: ghcr-pull
hostNetwork: true
containers:
- name: federation-tester-api
- image: ghcr.io/mtrnord/rust-federation-tester:v0.1.0
+ image: ghcr.io/mtrnord/rust-federation-tester:v0.2.0
imagePullPolicy: IfNotPresent
resources:
- limits: {}
- requests:
- memory: "344Mi"
- cpu: "252m"
+ limits: {}
+ requests:
+ memory: "344Mi"
+ cpu: "252m"
+ volumeMounts:
+ - name: api-config
+ mountPath: /app/config.yaml
+ subPath: config.yaml
+ readOnly: true
securityContext:
- runAsUser: 1000
- runAsGroup: 1000
- readOnlyRootFilesystem: true
+ runAsUser: 1000
+ runAsGroup: 1000
+ readOnlyRootFilesystem: true
ports:
- - containerPort: 8080
- name: api
- protocol: TCP
+ - containerPort: 8080
+ name: api
+ protocol: TCP
readinessProbe:
- httpGet:
- path: /healthz
- port: api
- scheme: HTTP
+ httpGet:
+ path: /healthz
+ port: api
+ scheme: HTTP
livenessProbe:
- httpGet:
- path: /healthz
- port: api
- scheme: HTTP
+ httpGet:
+ path: /healthz
+ port: api
+ scheme: HTTP
startupProbe:
- httpGet:
- path: /healthz
- port: api
+ httpGet:
+ path: /healthz
+ port: api
+ volumes:
+ - name: api-config
+ secret:
+ secretName: connectivity-tester-api-config
---
apiVersion: flagger.app/v1beta1
kind: MetricTemplate
@@ -241,18 +250,18 @@ spec:
# max error rate (5xx responses)
# percentage (0-100)
templateRef:
- name: connectivity-tester-error-rate
- namespace: matrix
+ name: connectivity-tester-error-rate
+ namespace: matrix
thresholdRange:
- max: 2
+ max: 2
interval: 1m
- name: latency
templateRef:
- name: connectivity-tester-latency
- namespace: matrix
+ name: connectivity-tester-latency
+ namespace: matrix
# seconds
thresholdRange:
- max: 1
+ max: 1
interval: 30s
sessionAffinity:
cookieName: flagger-cookie
@@ -263,13 +272,13 @@ spec:
url: http://flagger-loadtester.flagger-system/
timeout: 15s
metadata:
- type: bash
- cmd: "curl -s http://connectivity-tester-canary.matrix:3000"
+ type: bash
+ cmd: "curl -s http://connectivity-tester-canary.matrix:3000"
- name: load-test
url: http://flagger-loadtester.flagger-system/
timeout: 10m
metadata:
- cmd: "hey -z 10m -q 10 -c 2 http://connectivity-tester-canary.matrix/?serverName=mtrnord.blog"
+ cmd: "hey -z 10m -q 10 -c 2 http://connectivity-tester-canary.matrix/?serverName=mtrnord.blog"
---
apiVersion: flagger.app/v1beta1
kind: Canary
@@ -322,18 +331,18 @@ spec:
# max error rate (5xx responses)
# percentage (0-100)
templateRef:
- name: connectivity-tester-error-rate
- namespace: matrix
+ name: connectivity-tester-error-rate
+ namespace: matrix
thresholdRange:
- max: 2
+ max: 2
interval: 1m
- name: latency
templateRef:
- name: connectivity-tester-latency
- namespace: matrix
+ name: connectivity-tester-latency
+ namespace: matrix
# seconds
thresholdRange:
- max: 1
+ max: 1
interval: 30s
sessionAffinity:
cookieName: flagger-cookie
@@ -344,10 +353,10 @@ spec:
url: http://flagger-loadtester.flagger-system/
timeout: 15s
metadata:
- type: bash
- cmd: "curl -s http://connectivity-tester-api.matrix-canary:8080/healthz | grep 'OK'"
+ type: bash
+ cmd: "curl -s http://connectivity-tester-api.matrix-canary:8080/healthz | grep 'OK'"
- name: load-test
url: http://flagger-loadtester.flagger-system/
timeout: 10m
metadata:
- cmd: "hey -z 10m -q 10 -c 2 http://connectivity-tester-api-canary.matrix/api/federation-ok?serverName=mtrnord.blog&no_cache=true"
+ cmd: "hey -z 10m -q 10 -c 2 http://connectivity-tester-api-canary.matrix/api/federation-ok?serverName=mtrnord.blog&no_cache=true"
