fix(container): update image ghcr.io/home-operations/charts-mirror/matrix-synapse (3.12.31 ➔ 3.12.33) - #6929
Conversation
drag0n141-bot
Bot
added
renovate/container
type/patch
area/kubernetes
--- HelmRelease: matrix/synapse Deployment: matrix/synapse-matrix-synapse
+++ HelmRelease: matrix/synapse Deployment: matrix/synapse-matrix-synapse
@@ -17,13 +17,13 @@
app.kubernetes.io/name: matrix-synapse
app.kubernetes.io/instance: synapse
app.kubernetes.io/component: synapse
template:
metadata:
annotations:
- checksum/secrets: 7269a95a6bb95f9a800b484f5e146d418b5a5e9142bfc3153873155402d478c8
+ checksum/secrets: 23bcb088e7221c50539dd041d954d1314537b9daa4d77906cf8126367006c2a3
prometheus.io/path: /_synapse/metrics
prometheus.io/port: '9090'
prometheus.io/scrape: 'true'
reloader.stakater.com/auto: 'true'
labels:
app.kubernetes.io/name: matrix-synapse
@@ -56,13 +56,13 @@
key: POSTGRES_PASSWORD
- name: REDIS_PASSWORD
valueFrom:
secretKeyRef:
name: synapse-secret
key: REDIS_PASSWORD
- image: ghcr.io/element-hq/synapse:v1.156.0
+ image: ghcr.io/element-hq/synapse:v1.157.1
imagePullPolicy: IfNotPresent
securityContext: {}
ports:
- name: http
containerPort: 8008
protocol: TCP
--- HelmRelease: matrix/synapse Deployment: matrix/synapse-wellknown-lighttpd
+++ HelmRelease: matrix/synapse Deployment: matrix/synapse-wellknown-lighttpd
@@ -19,12 +19,13 @@
metadata:
labels:
app.kubernetes.io/name: matrix-synapse
app.kubernetes.io/instance: synapse
app.kubernetes.io/component: well-known
spec:
+ serviceAccountName: default
securityContext: {}
containers:
- name: lighttpd
image: ghcr.io/rtsp/docker-lighttpd:1.4.76
imagePullPolicy: Always
securityContext: {} |
--- kubernetes/apps/matrix/synapse/app Kustomization: matrix/synapse OCIRepository: matrix/matrix-synapse
+++ kubernetes/apps/matrix/synapse/app Kustomization: matrix/synapse OCIRepository: matrix/matrix-synapse
@@ -11,9 +11,9 @@
spec:
interval: 15m
layerSelector:
mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
operation: copy
ref:
- tag: 3.12.31
+ tag: 3.12.33
url: oci://ghcr.io/home-operations/charts-mirror/matrix-synapse
--- kubernetes/apps/matrix/synapse/app Kustomization: matrix/synapse ConfigMap: matrix/synapse-mas-configmap
+++ kubernetes/apps/matrix/synapse/app Kustomization: matrix/synapse ConfigMap: matrix/synapse-mas-configmap
@@ -1,19 +1,14 @@
---
apiVersion: v1
data:
mas_config.yaml: |
- experimental_features:
- msc3861:
- enabled: true
- issuer: "https://mas...PLACEHOLDER_SECRET_DOMAIN.."
- client_id: 0000000000000000000SYNAPSE
- client_auth_method: client_secret_basic
- client_secret: "{{ .SYNAPSE_MAS_CLIENT_SECRET }}"
- admin_token: "{{ .SYNAPSE_ADMIN_TOKEN }}"
- introspection_endpoint: "http://mas.matrix.svc.cluster.local:8080/oauth2/introspect"
+ matrix_authentication_service:
+ enabled: true
+ secret: "{{ .SYNAPSE_ADMIN_TOKEN }}"
+ endpoint: "http://mas.matrix.svc.cluster.local:8080"
kind: ConfigMap
metadata:
labels:
app.kubernetes.io/name: synapse
kustomize.toolkit.fluxcd.io/name: synapse
kustomize.toolkit.fluxcd.io/namespace: matrix |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
matrix-synapse chart (ghcr.io/home-operations/charts-mirror/matrix-synapse): 3.12.31 → 3.12.32
This is a mirror of the ananace-charts matrix-synapse Helm chart. The chart bump is a thin wrapper — it corresponds to the underlying Synapse (Matrix homeserver) application bump 1.156.0 → 1.157.0 (confirmed via the ananace/charts commit history: 'matrix-synapse: Update to 1.157.0').
Verdict: Changes required before merge
Breaking changes:
-
Synapse 1.157.0 removes support for the deprecated
experimental_features.msc3861config block (experimental MSC3861 auth delegation), in favor of the stablematrix_authentication_serviceconfig. Per the upgrade notes: 'Support for the deprecated MSC3861 Auth Delegation (experimental_features.msc3861) has been dropped in this version, in favour of the stable Matrix Authentication Service integration.' Administrators are told they 'must remove theexperimental_features.msc3861configuration option.'This repo actively uses the old format in
kubernetes/apps/matrix/synapse/app/resources/mas_config.yaml:experimental_features: msc3861: enabled: true issuer: "https://mas.${SECRET_DOMAIN}" client_id: 0000000000000000000SYNAPSE client_auth_method: client_secret_basic client_secret: "{{ .SYNAPSE_MAS_CLIENT_SECRET }}" admin_token: "{{ .SYNAPSE_ADMIN_TOKEN }}" introspection_endpoint: "http://mas.matrix.svc.cluster.local:8080/oauth2/introspect"
Since Synapse's
experimental_featuresschema is strictly validated, upgrading without migrating this file risks Synapse failing to start (or at minimum losing MAS-backed OIDC login via Pocket ID), which would break authentication for the whole Matrix stack (Element, mautrix-whatsapp/discord bridges rely on the same homeserver).Fix: replace the file's contents with the new stable block, reusing the
SYNAPSE_ADMIN_TOKENsecret (it's already the shared secret configured on the MAS side asmatrix.secretinkubernetes/apps/matrix/mas/app/resources/config.yaml):matrix_authentication_service: enabled: true endpoint: "http://mas.matrix.svc.cluster.local:8080" secret: "{{ .SYNAPSE_ADMIN_TOKEN }}"
The
client_id/client_auth_method/client_secret/introspection_endpointfields are no longer consumed. Once migrated, the now-unusedclients:entry for0000000000000000000SYNAPSEinkubernetes/apps/matrix/mas/app/resources/config.yamlcan also be dropped (per the same upgrade notes: 'you can also remove the client previously used by Synapse in the MAS configuration as it is no longer in use'). MAS itself (kubernetes/apps/matrix/mas, running 1.20.0) already satisfies the >= 0.20.0 requirement for the stable integration, so no MAS version bump is needed — just the config migration.
Sources consulted:
- https://gitlab.com/api/v4/projects/ananace%2Fcharts/repository/commits?path=charts%2Fmatrix-synapse (chart to app version mapping)
- https://github.com/element-hq/synapse/releases/tag/v1.157.0
- https://element-hq.github.io/synapse/latest/upgrade.html
- https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html (matrix_authentication_service schema)
- https://gitlab.com/ananace/charts/-/raw/master/charts/matrix-synapse/Chart.yaml
…trix-synapse (3.12.31 ➔ 3.12.33)
9bddecc to
a254e42
Compare
drag0n141-bot
Bot
changed the title
There was a problem hiding this comment.
matrix-synapse chart (ghcr.io/home-operations/charts-mirror/matrix-synapse): 3.12.31 → 3.12.33
This PR now targets a newer tag than my previous review (which covered 3.12.31 → 3.12.32, i.e. Synapse 1.157.0). The chart has since bumped again to 3.12.33 upstream (confirmed via ananace/charts commit history: matrix-synapse: Update to 1.157.1), so this now corresponds to Synapse 1.157.0 → 1.157.1.
Verdict: Changes required before merge
What's new since my last review (1.157.0 → 1.157.1):
- Synapse v1.157.1 is a single-fix patch release: element-hq/synapse#19987 fixes a regression where a falsy
experimental_featuresblock (null/~/omitted) caused Synapse to crash withAttributeError. Not actionable here —kubernetes/apps/matrix/synapse/app/resources/mas_config.yamlsetsexperimental_featuresto a non-empty mapping, so this codepath was never hit. - No other changes (config schema, templates, values) in this chart bump beyond the
Chart.yamlversion/appVersion fields.
Still outstanding (previously reported, not rehashing details):
- The breaking removal of
experimental_features.msc3861(in favor of the stablematrix_authentication_serviceblock), introduced in Synapse 1.157.0, is still present and unresolved inkubernetes/apps/matrix/synapse/app/resources/mas_config.yaml— verified unchanged in this PR's diff. See my prior review on this PR for the full breaking-change detail and fix. This still needs to be migrated before merging, or Synapse/MAS-backed login will break.
Sources consulted:
There was a problem hiding this comment.
matrix-synapse chart (ghcr.io/home-operations/charts-mirror/matrix-synapse): 3.12.31 → 3.12.33
The chart version is unchanged from my last review (still 3.12.33, corresponding to Synapse 1.157.1). Since then, kubernetes/apps/matrix/synapse/app/resources/mas_config.yaml has been updated to migrate off the removed experimental_features.msc3861 block — this resolves the breaking change flagged in my prior reviews, but the replacement introduces a new, actionable bug.
Verdict: Changes required before merge
Breaking changes:
-
The new
matrix_authentication_serviceblock uses the wrong secret:matrix_authentication_service: enabled: true secret: "{{ .SYNAPSE_MAS_CLIENT_SECRET }}" endpoint: "http://mas.matrix.svc.cluster.local:8080"
Per Synapse's config docs,
matrix_authentication_service.secretmust be "a shared secret that will be used to authenticate requests from and to MAS" — it has to match MAS's ownmatrix.secretfield, which in this repo'skubernetes/apps/matrix/mas/app/resources/config.yamlis set to{{ .SYNAPSE_ADMIN_TOKEN }}.SYNAPSE_MAS_CLIENT_SECRETis a different value entirely — it's the OAuthclient_secretfor the now-deprecatedclients: [{client_id: 0000000000000000000SYNAPSE, ...}]entry in the same MAS config, which per the upgrade notes is no longer consumed once MAS integration is stable. Both secrets are distinct entries in the external secret store (confirmed:SYNAPSE_ADMIN_TOKENandSYNAPSE_MAS_CLIENT_SECRETare referenced nowhere else and are not aliased). Deploying with a mismatched shared secret will cause the Synapse↔MAS internal API authentication to fail, breaking MAS-backed login for the whole Matrix stack (Element, mautrix bridges).Fix: change the
secretfield to reuse the admin token, matching what MAS already expects:matrix_authentication_service: enabled: true secret: "{{ .SYNAPSE_ADMIN_TOKEN }}" endpoint: "http://mas.matrix.svc.cluster.local:8080"
Deprecations:
- Now that the
clients:entry for0000000000000000000SYNAPSEinkubernetes/apps/matrix/mas/app/resources/config.yamlis unused (per the same upgrade notes), it can be dropped along with the now-orphanedSYNAPSE_MAS_CLIENT_SECRETvalue — optional cleanup, not blocking.
Sources consulted:
- https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html (matrix_authentication_service
secret/endpoint/enabledsemantics) - https://element-hq.github.io/synapse/latest/upgrade.html
- Repo files:
kubernetes/apps/matrix/synapse/app/resources/mas_config.yaml,kubernetes/apps/matrix/mas/app/resources/config.yaml,kubernetes/apps/matrix/synapse/app/externalsecret.yaml
There was a problem hiding this comment.
matrix-synapse chart (ghcr.io/home-operations/charts-mirror/matrix-synapse): 3.12.31 → 3.12.33
Chart version is unchanged since my last review (still 3.12.33, corresponding to Synapse 1.157.1) — no new upstream changes to research. This update is the fix for the bug flagged in my previous review.
Verdict: Safe to merge
Resolved since last review:
- The
matrix_authentication_serviceblock inkubernetes/apps/matrix/synapse/app/resources/mas_config.yamlpreviously used the wrong shared secret (SYNAPSE_MAS_CLIENT_SECRET, the old OAuth client secret). It now correctly usesSYNAPSE_ADMIN_TOKEN:Verified againstmatrix_authentication_service: enabled: true secret: "{{ .SYNAPSE_ADMIN_TOKEN }}" endpoint: "http://mas.matrix.svc.cluster.local:8080"
kubernetes/apps/matrix/mas/app/resources/config.yaml, where MAS'smatrix.secretis also set to{{ .SYNAPSE_ADMIN_TOKEN }}— the two now match, so Synapse↔MAS internal API authentication should succeed.
Deprecations (optional, non-blocking):
- The now-unused
clients:entry forclient_id: 0000000000000000000SYNAPSE(and the orphanedSYNAPSE_MAS_CLIENT_SECRETvalue it references) still exists inkubernetes/apps/matrix/mas/app/resources/config.yaml. It's no longer consumed by Synapse but doesn't block this merge — cleanup can happen separately.
Sources consulted:
- Repo files:
kubernetes/apps/matrix/synapse/app/resources/mas_config.yaml,kubernetes/apps/matrix/mas/app/resources/config.yaml
1 participant
This PR contains the following updates:
3.12.31→3.12.33Configuration
📅 Schedule: (in timezone Europe/Berlin)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate.