Skip to content

Matrix Authentication Service - underride support #745

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 2 commits into from
Sep 19, 2025
Merged

Matrix Authentication Service - underride support #745

merged 2 commits into from
Sep 19, 2025

Conversation

benbz
Copy link
Member

@benbz benbz commented Sep 18, 2025

Fixes #615. Replaces #637

For MAS

  • Removes experimental.access_token_ttl as EX's need of it is gone
  • Move policy to an underrides file so that it can be varied by chart users

@benbz benbz requested a review from a team as a code owner September 18, 2025 15:50
@benbz benbz mentioned this pull request Sep 18, 2025
Closed
@github-actions GitHub Actions
Copy link

dyff of changes in rendered templates of CI manifests

Full contents of manifests and dyffs are available in https://github.com/element-hq/ess-helm/actions/runs/17834206047/artifacts/4047371713

example-default-enabled-components-checkov-values.yaml 
@@ ConfigMap/ess-ci/release-name-matrix-authentication-service - data @@
- mas-config.yaml: |
-   http:
-     public_base: "https://mas.ess.localhost"
-     listeners:
-     - name: web
-       binds:
-       - host: 0.0.0.0
-         port: 8080
-       resources:
-       - name: human
-       - name: discovery
-       - name: oauth
-       - name: compat
-       - name: assets
-       - name: graphql
-         # This lets us use the GraphQL API with an OAuth 2.0 access token,
-         # which we currently use in the ansible modules and in synapse-admin
-         undocumented_oauth2_access: true
-       - name: adminapi
-     - name: internal
-       binds:
-       - host: 0.0.0.0
-         port: 8081
-       resources:
-       - name: health
-       - name: prometheus
-       - name: connection-info
-   
-   
-   database:
-     uri: "postgresql://matrixauthenticationservice_user:${POSTGRES_PASSWORD}@release-name-postgres.ess-ci.svc.cluster.local.:5432/matrixauthenticationservice?sslmode=prefer&application_name=matrix-authentication-service"
-   
-   
-   telemetry:
-     metrics:
-       exporter: prometheus
-   matrix:
-     homeserver: "ess.localhost"
-     secret_file: /secrets/release-name-generated/MAS_SYNAPSE_SHARED_SECRET
-     endpoint: "http://release-name-synapse-main.ess-ci.svc.cluster.local.:8008"
-     kind: synapse_modern
-   
-   policy:
-     data:
-       admin_clients: []
-       admin_users: []
-       client_registration:
-         allow_host_mismatch: false
-         allow_insecure_uris: false
-   
-   secrets:
-     encryption_file: /secrets/release-name-generated/MAS_ENCRYPTION_SECRET
-     keys:
-     - kid: rsa
-       key_file: /secrets/release-name-generated/MAS_RSA_PRIVATE_KEY
-     - kid: prime256v1
-       key_file: /secrets/release-name-generated/MAS_ECDSA_PRIME256V1_PRIVATE_KEY
-   
-   
-   experimental:
-     access_token_ttl: 86400  # 1 day, up from 5 mins, until EX can better handle refresh tokens
+   mas-config-underrides.yaml: |
+     
+     policy:
+       data:
+         admin_clients: []
+         admin_users: []
+         client_registration:
+           allow_host_mismatch: false
+           allow_insecure_uris: false
+     
+   mas-config-overrides.yaml: |
+     http:
+       public_base: "https://mas.ess.localhost"
+       listeners:
+       - name: web
+         binds:
+         - host: 0.0.0.0
+           port: 8080
+         resources:
+         - name: human
+         - name: discovery
+         - name: oauth
+         - name: compat
+         - name: assets
+         - name: graphql
+           # This lets us use the GraphQL API with an OAuth 2.0 access token,
+           # which we currently use in the ansible modules and in synapse-admin
+           undocumented_oauth2_access: true
+         - name: adminapi
+       - name: internal
+         binds:
+         - host: 0.0.0.0
+           port: 8081
+         resources:
+         - name: health
+         - name: prometheus
+         - name: connection-info
+     
+     
+     database:
+       uri: "postgresql://matrixauthenticationservice_user:${POSTGRES_PASSWORD}@release-name-postgres.ess-ci.svc.cluster.local.:5432/matrixauthenticationservice?sslmode=prefer&application_name=matrix-authentication-service"
+     
+     
+     telemetry:
+       metrics:
+         exporter: prometheus
+     matrix:
+       homeserver: "ess.localhost"
+       secret_file: /secrets/release-name-generated/MAS_SYNAPSE_SHARED_SECRET
+       endpoint: "http://release-name-synapse-main.ess-ci.svc.cluster.local.:8008"
+       kind: synapse_modern
+     
+     secrets:
+       encryption_file: /secrets/release-name-generated/MAS_ENCRYPTION_SECRET
+       keys:
+       - kid: rsa
+         key_file: /secrets/release-name-generated/MAS_RSA_PRIVATE_KEY
+       - kid: prime256v1
+         key_file: /secrets/release-name-generated/MAS_ECDSA_PRIME256V1_PRIVATE_KEY



@@ Deployment/ess-ci/release-name-matrix-authentication-service - metadata.labels.k8s.element.io/matrix-authentication-service-config-hash @@
- 65e6de91e84e11bf417a8815e27632cee831ed1e
+ c3cc23162977e6af11e97eec9cfe5d145add1ace

@@ Deployment/ess-ci/release-name-matrix-authentication-service - spec.template.metadata.labels.k8s.element.io/matrix-authentication-service-config-hash @@
- 65e6de91e84e11bf417a8815e27632cee831ed1e
+ c3cc23162977e6af11e97eec9cfe5d145add1ace

@@ Deployment/ess-ci/release-name-matrix-authentication-service - spec.template.spec.initContainers.render-config.command @@
- - /config-templates/mas-config.yaml
+   - /config-templates/mas-config-underrides.yaml
+   - /config-templates/mas-config-overrides.yaml
example-default-enabled-components-values.yaml 
@@ ConfigMap/ess-ci/release-name-matrix-authentication-service - data @@
- mas-config.yaml: |
-   http:
-     public_base: "https://mas.ess.localhost"
-     listeners:
-     - name: web
-       binds:
-       - host: 0.0.0.0
-         port: 8080
-       resources:
-       - name: human
-       - name: discovery
-       - name: oauth
-       - name: compat
-       - name: assets
-       - name: graphql
-         # This lets us use the GraphQL API with an OAuth 2.0 access token,
-         # which we currently use in the ansible modules and in synapse-admin
-         undocumented_oauth2_access: true
-       - name: adminapi
-     - name: internal
-       binds:
-       - host: 0.0.0.0
-         port: 8081
-       resources:
-       - name: health
-       - name: prometheus
-       - name: connection-info
-   
-   
-   database:
-     uri: "postgresql://matrixauthenticationservice_user:${POSTGRES_PASSWORD}@release-name-postgres.ess-ci.svc.cluster.local.:5432/matrixauthenticationservice?sslmode=prefer&application_name=matrix-authentication-service"
-   
-   
-   telemetry:
-     metrics:
-       exporter: prometheus
-   matrix:
-     homeserver: "ess.localhost"
-     secret_file: /secrets/release-name-generated/MAS_SYNAPSE_SHARED_SECRET
-     endpoint: "http://release-name-synapse-main.ess-ci.svc.cluster.local.:8008"
-     kind: synapse_modern
-   
-   policy:
-     data:
-       admin_clients: []
-       admin_users: []
-       client_registration:
-         allow_host_mismatch: false
-         allow_insecure_uris: false
-   
-   secrets:
-     encryption_file: /secrets/release-name-generated/MAS_ENCRYPTION_SECRET
-     keys:
-     - kid: rsa
-       key_file: /secrets/release-name-generated/MAS_RSA_PRIVATE_KEY
-     - kid: prime256v1
-       key_file: /secrets/release-name-generated/MAS_ECDSA_PRIME256V1_PRIVATE_KEY
-   
-   
-   experimental:
-     access_token_ttl: 86400  # 1 day, up from 5 mins, until EX can better handle refresh tokens
+   mas-config-underrides.yaml: |
+     
+     policy:
+       data:
+         admin_clients: []
+         admin_users: []
+         client_registration:
+           allow_host_mismatch: false
+           allow_insecure_uris: false
+     
+   mas-config-overrides.yaml: |
+     http:
+       public_base: "https://mas.ess.localhost"
+       listeners:
+       - name: web
+         binds:
+         - host: 0.0.0.0
+           port: 8080
+         resources:
+         - name: human
+         - name: discovery
+         - name: oauth
+         - name: compat
+         - name: assets
+         - name: graphql
+           # This lets us use the GraphQL API with an OAuth 2.0 access token,
+           # which we currently use in the ansible modules and in synapse-admin
+           undocumented_oauth2_access: true
+         - name: adminapi
+       - name: internal
+         binds:
+         - host: 0.0.0.0
+           port: 8081
+         resources:
+         - name: health
+         - name: prometheus
+         - name: connection-info
+     
+     
+     database:
+       uri: "postgresql://matrixauthenticationservice_user:${POSTGRES_PASSWORD}@release-name-postgres.ess-ci.svc.cluster.local.:5432/matrixauthenticationservice?sslmode=prefer&application_name=matrix-authentication-service"
+     
+     
+     telemetry:
+       metrics:
+         exporter: prometheus
+     matrix:
+       homeserver: "ess.localhost"
+       secret_file: /secrets/release-name-generated/MAS_SYNAPSE_SHARED_SECRET
+       endpoint: "http://release-name-synapse-main.ess-ci.svc.cluster.local.:8008"
+       kind: synapse_modern
+     
+     secrets:
+       encryption_file: /secrets/release-name-generated/MAS_ENCRYPTION_SECRET
+       keys:
+       - kid: rsa
+         key_file: /secrets/release-name-generated/MAS_RSA_PRIVATE_KEY
+       - kid: prime256v1
+         key_file: /secrets/release-name-generated/MAS_ECDSA_PRIME256V1_PRIVATE_KEY



@@ Deployment/ess-ci/release-name-matrix-authentication-service - metadata.labels.k8s.element.io/matrix-authentication-service-config-hash @@
- 65e6de91e84e11bf417a8815e27632cee831ed1e
+ c3cc23162977e6af11e97eec9cfe5d145add1ace

@@ Deployment/ess-ci/release-name-matrix-authentication-service - spec.template.metadata.labels.k8s.element.io/matrix-authentication-service-config-hash @@
- 65e6de91e84e11bf417a8815e27632cee831ed1e
+ c3cc23162977e6af11e97eec9cfe5d145add1ace

@@ Deployment/ess-ci/release-name-matrix-authentication-service - spec.template.spec.initContainers.render-config.command @@
- - /config-templates/mas-config.yaml
+   - /config-templates/mas-config-underrides.yaml
+   - /config-templates/mas-config-overrides.yaml
matrix-authentication-service-checkov-values.yaml 
@@ ConfigMap/ess-ci/release-name-matrix-authentication-service - data @@
- mas-config.yaml: |
-   http:
-     public_base: "https://mas.ess.localhost"
-     listeners:
-     - name: web
-       binds:
-       - host: 0.0.0.0
-         port: 8080
-       resources:
-       - name: human
-       - name: discovery
-       - name: oauth
-       - name: compat
-       - name: assets
-       - name: graphql
-         # This lets us use the GraphQL API with an OAuth 2.0 access token,
-         # which we currently use in the ansible modules and in synapse-admin
-         undocumented_oauth2_access: true
-       - name: adminapi
-     - name: internal
-       binds:
-       - host: 0.0.0.0
-         port: 8081
-       resources:
-       - name: health
-       - name: prometheus
-       - name: connection-info
-   
-   
-   database:
-     uri: "postgresql://matrixauthenticationservice_user:${POSTGRES_PASSWORD}@release-name-postgres.ess-ci.svc.cluster.local.:5432/matrixauthenticationservice?sslmode=prefer&application_name=matrix-authentication-service"
-   
-   
-   telemetry:
-     metrics:
-       exporter: prometheus
-   
-   policy:
-     data:
-       admin_clients: []
-       admin_users: []
-       client_registration:
-         allow_host_mismatch: false
-         allow_insecure_uris: false
-   
-   secrets:
-     encryption_file: /secrets/release-name-generated/MAS_ENCRYPTION_SECRET
-     keys:
-     - kid: rsa
-       key_file: /secrets/release-name-generated/MAS_RSA_PRIVATE_KEY
-     - kid: prime256v1
-       key_file: /secrets/release-name-generated/MAS_ECDSA_PRIME256V1_PRIVATE_KEY
-   
-   
-   experimental:
-     access_token_ttl: 86400  # 1 day, up from 5 mins, until EX can better handle refresh tokens
+   mas-config-underrides.yaml: |
+     
+     policy:
+       data:
+         admin_clients: []
+         admin_users: []
+         client_registration:
+           allow_host_mismatch: false
+           allow_insecure_uris: false
+     
+   mas-config-overrides.yaml: |
+     http:
+       public_base: "https://mas.ess.localhost"
+       listeners:
+       - name: web
+         binds:
+         - host: 0.0.0.0
+           port: 8080
+         resources:
+         - name: human
+         - name: discovery
+         - name: oauth
+         - name: compat
+         - name: assets
+         - name: graphql
+           # This lets us use the GraphQL API with an OAuth 2.0 access token,
+           # which we currently use in the ansible modules and in synapse-admin
+           undocumented_oauth2_access: true
+         - name: adminapi
+       - name: internal
+         binds:
+         - host: 0.0.0.0
+           port: 8081
+         resources:
+         - name: health
+         - name: prometheus
+         - name: connection-info
+     
+     
+     database:
+       uri: "postgresql://matrixauthenticationservice_user:${POSTGRES_PASSWORD}@release-name-postgres.ess-ci.svc.cluster.local.:5432/matrixauthenticationservice?sslmode=prefer&application_name=matrix-authentication-service"
+     
+     
+     telemetry:
+       metrics:
+         exporter: prometheus
+     
+     secrets:
+       encryption_file: /secrets/release-name-generated/MAS_ENCRYPTION_SECRET
+       keys:
+       - kid: rsa
+         key_file: /secrets/release-name-generated/MAS_RSA_PRIVATE_KEY
+       - kid: prime256v1
+         key_file: /secrets/release-name-generated/MAS_ECDSA_PRIME256V1_PRIVATE_KEY



@@ Deployment/ess-ci/release-name-matrix-authentication-service - metadata.labels.k8s.element.io/matrix-authentication-service-config-hash @@
- 4393997d14b465fd2fd68c4c763cada601e11bc0
+ 63cc5b158f10c9945443b567ccbce0be67967ba6

@@ Deployment/ess-ci/release-name-matrix-authentication-service - spec.template.metadata.labels.k8s.element.io/matrix-authentication-service-config-hash @@
- 4393997d14b465fd2fd68c4c763cada601e11bc0
+ 63cc5b158f10c9945443b567ccbce0be67967ba6

@@ Deployment/ess-ci/release-name-matrix-authentication-service - spec.template.spec.initContainers.render-config.command @@
- - /config-templates/mas-config.yaml
+   - /config-templates/mas-config-underrides.yaml
+   - /config-templates/mas-config-overrides.yaml
matrix-authentication-service-external-synapse-values.yaml 
@@ ConfigMap/ess-ci/release-name-matrix-authentication-service - data @@
- mas-config.yaml: |
-   http:
-     public_base: "https://mas.ess.localhost"
-     listeners:
-     - name: web
-       binds:
-       - host: 0.0.0.0
-         port: 8080
-       resources:
-       - name: human
-       - name: discovery
-       - name: oauth
-       - name: compat
-       - name: assets
-       - name: graphql
-         # This lets us use the GraphQL API with an OAuth 2.0 access token,
-         # which we currently use in the ansible modules and in synapse-admin
-         undocumented_oauth2_access: true
-       - name: adminapi
-     - name: internal
-       binds:
-       - host: 0.0.0.0
-         port: 8081
-       resources:
-       - name: health
-       - name: prometheus
-       - name: connection-info
-   
-   
-   database:
-     uri: "postgresql://matrixauthenticationservice_user:${POSTGRES_PASSWORD}@release-name-postgres.ess-ci.svc.cluster.local.:5432/matrixauthenticationservice?sslmode=prefer&application_name=matrix-authentication-service"
-   
-   
-   telemetry:
-     metrics:
-       exporter: prometheus
-   
-   policy:
-     data:
-       admin_clients: []
-       admin_users: []
-       client_registration:
-         allow_host_mismatch: false
-         allow_insecure_uris: false
-   
-   secrets:
-     encryption_file: /secrets/release-name-generated/MAS_ENCRYPTION_SECRET
-     keys:
-     - kid: rsa
-       key_file: /secrets/release-name-generated/MAS_RSA_PRIVATE_KEY
-     - kid: prime256v1
-       key_file: /secrets/release-name-generated/MAS_ECDSA_PRIME256V1_PRIVATE_KEY
-   
-   
-   experimental:
-     access_token_ttl: 86400  # 1 day, up from 5 mins, until EX can better handle refresh tokens
+   mas-config-underrides.yaml: |
+     
+     policy:
+       data:
+         admin_clients: []
+         admin_users: []
+         client_registration:
+           allow_host_mismatch: false
+           allow_insecure_uris: false
+     
+   mas-config-overrides.yaml: |
+     http:
+       public_base: "https://mas.ess.localhost"
+       listeners:
+       - name: web
+         binds:
+         - host: 0.0.0.0
+           port: 8080
+         resources:
+         - name: human
+         - name: discovery
+         - name: oauth
+         - name: compat
+         - name: assets
+         - name: graphql
+           # This lets us use the GraphQL API with an OAuth 2.0 access token,
+           # which we currently use in the ansible modules and in synapse-admin
+           undocumented_oauth2_access: true
+         - name: adminapi
+       - name: internal
+         binds:
+         - host: 0.0.0.0
+           port: 8081
+         resources:
+         - name: health
+         - name: prometheus
+         - name: connection-info
+     
+     
+     database:
+       uri: "postgresql://matrixauthenticationservice_user:${POSTGRES_PASSWORD}@release-name-postgres.ess-ci.svc.cluster.local.:5432/matrixauthenticationservice?sslmode=prefer&application_name=matrix-authentication-service"
+     
+     
+     telemetry:
+       metrics:
+         exporter: prometheus
+     
+     secrets:
+       encryption_file: /secrets/release-name-generated/MAS_ENCRYPTION_SECRET
+       keys:
+       - kid: rsa
+         key_file: /secrets/release-name-generated/MAS_RSA_PRIVATE_KEY
+       - kid: prime256v1
+         key_file: /secrets/release-name-generated/MAS_ECDSA_PRIME256V1_PRIVATE_KEY



@@ Deployment/ess-ci/release-name-matrix-authentication-service - metadata.labels.k8s.element.io/matrix-authentication-service-config-hash @@
- 4393997d14b465fd2fd68c4c763cada601e11bc0
+ 63cc5b158f10c9945443b567ccbce0be67967ba6

@@ Deployment/ess-ci/release-name-matrix-authentication-service - spec.template.metadata.labels.k8s.element.io/matrix-authentication-service-config-hash @@
- 4393997d14b465fd2fd68c4c763cada601e11bc0
+ 63cc5b158f10c9945443b567ccbce0be67967ba6

@@ Deployment/ess-ci/release-name-matrix-authentication-service - spec.template.spec.initContainers.render-config.command @@
- - /config-templates/mas-config.yaml
+   - /config-templates/mas-config-underrides.yaml
+   - /config-templates/mas-config-overrides.yaml
matrix-authentication-service-minimal-values.yaml 
@@ ConfigMap/ess-ci/release-name-matrix-authentication-service - data @@
- mas-config.yaml: |
-   http:
-     public_base: "https://mas.ess.localhost"
-     listeners:
-     - name: web
-       binds:
-       - host: 0.0.0.0
-         port: 8080
-       resources:
-       - name: human
-       - name: discovery
-       - name: oauth
-       - name: compat
-       - name: assets
-       - name: graphql
-         # This lets us use the GraphQL API with an OAuth 2.0 access token,
-         # which we currently use in the ansible modules and in synapse-admin
-         undocumented_oauth2_access: true
-       - name: adminapi
-     - name: internal
-       binds:
-       - host: 0.0.0.0
-         port: 8081
-       resources:
-       - name: health
-       - name: prometheus
-       - name: connection-info
-   
-   
-   database:
-     uri: "postgresql://matrixauthenticationservice_user:${POSTGRES_PASSWORD}@release-name-postgres.ess-ci.svc.cluster.local.:5432/matrixauthenticationservice?sslmode=prefer&application_name=matrix-authentication-service"
-   
-   
-   telemetry:
-     metrics:
-       exporter: prometheus
-   
-   policy:
-     data:
-       admin_clients: []
-       admin_users: []
-       client_registration:
-         allow_host_mismatch: false
-         allow_insecure_uris: false
-   
-   secrets:
-     encryption_file: /secrets/release-name-generated/MAS_ENCRYPTION_SECRET
-     keys:
-     - kid: rsa
-       key_file: /secrets/release-name-generated/MAS_RSA_PRIVATE_KEY
-     - kid: prime256v1
-       key_file: /secrets/release-name-generated/MAS_ECDSA_PRIME256V1_PRIVATE_KEY
-   
-   
-   experimental:
-     access_token_ttl: 86400  # 1 day, up from 5 mins, until EX can better handle refresh tokens
+   mas-config-underrides.yaml: |
+     
+     policy:
+       data:
+         admin_clients: []
+         admin_users: []
+         client_registration:
+           allow_host_mismatch: false
+           allow_insecure_uris: false
+     
+   mas-config-overrides.yaml: |
+     http:
+       public_base: "https://mas.ess.localhost"
+       listeners:
+       - name: web
+         binds:
+         - host: 0.0.0.0
+           port: 8080
+         resources:
+         - name: human
+         - name: discovery
+         - name: oauth
+         - name: compat
+         - name: assets
+         - name: graphql
+           # This lets us use the GraphQL API with an OAuth 2.0 access token,
+           # which we currently use in the ansible modules and in synapse-admin
+           undocumented_oauth2_access: true
+         - name: adminapi
+       - name: internal
+         binds:
+         - host: 0.0.0.0
+           port: 8081
+         resources:
+         - name: health
+         - name: prometheus
+         - name: connection-info
+     
+     
+     database:
+       uri: "postgresql://matrixauthenticationservice_user:${POSTGRES_PASSWORD}@release-name-postgres.ess-ci.svc.cluster.local.:5432/matrixauthenticationservice?sslmode=prefer&application_name=matrix-authentication-service"
+     
+     
+     telemetry:
+       metrics:
+         exporter: prometheus
+     
+     secrets:
+       encryption_file: /secrets/release-name-generated/MAS_ENCRYPTION_SECRET
+       keys:
+       - kid: rsa
+         key_file: /secrets/release-name-generated/MAS_RSA_PRIVATE_KEY
+       - kid: prime256v1
+         key_file: /secrets/release-name-generated/MAS_ECDSA_PRIME256V1_PRIVATE_KEY



@@ Deployment/ess-ci/release-name-matrix-authentication-service - metadata.labels.k8s.element.io/matrix-authentication-service-config-hash @@
- 4393997d14b465fd2fd68c4c763cada601e11bc0
+ 63cc5b158f10c9945443b567ccbce0be67967ba6

@@ Deployment/ess-ci/release-name-matrix-authentication-service - spec.template.metadata.labels.k8s.element.io/matrix-authentication-service-config-hash @@
- 4393997d14b465fd2fd68c4c763cada601e11bc0
+ 63cc5b158f10c9945443b567ccbce0be67967ba6

@@ Deployment/ess-ci/release-name-matrix-authentication-service - spec.template.spec.initContainers.render-config.command @@
- - /config-templates/mas-config.yaml
+   - /config-templates/mas-config-underrides.yaml
+   - /config-templates/mas-config-overrides.yaml
matrix-authentication-service-postgres-secrets-externally-values.yaml 
@@ ConfigMap/ess-ci/release-name-matrix-authentication-service - data @@
- mas-config.yaml: |
-   http:
-     public_base: "https://mas.ess.localhost"
-     listeners:
-     - name: web
-       binds:
-       - host: 0.0.0.0
-         port: 8080
-       resources:
-       - name: human
-       - name: discovery
-       - name: oauth
-       - name: compat
-       - name: assets
-       - name: graphql
-         # This lets us use the GraphQL API with an OAuth 2.0 access token,
-         # which we currently use in the ansible modules and in synapse-admin
-         undocumented_oauth2_access: true
-       - name: adminapi
-     - name: internal
-       binds:
-       - host: 0.0.0.0
-         port: 8081
-       resources:
-       - name: health
-       - name: prometheus
-       - name: connection-info
-   
-   
-   database:
-     uri: "postgresql://matrixauthenticationservice_user:${POSTGRES_PASSWORD}@release-name-postgres.ess-ci.svc.cluster.local.:5432/matrixauthenticationservice?sslmode=prefer&application_name=matrix-authentication-service"
-   
-   
-   telemetry:
-     metrics:
-       exporter: prometheus
-   
-   policy:
-     data:
-       admin_clients: []
-       admin_users: []
-       client_registration:
-         allow_host_mismatch: false
-         allow_insecure_uris: false
-   
-   secrets:
-     encryption_file: /secrets/release-name-mas-external/encryption
-     keys:
-     - kid: rsa
-       key_file: /secrets/release-name-mas-external/keysRSA
-     - kid: prime256v1
-       key_file: /secrets/release-name-mas-external/keysEcdsaPrime256v1
-   
-     - kid: secp256k1
-       key_file: /secrets/release-name-mas-external/keysEcdsaSecp256k1
-   
-     - kid: secp384r1
-       key_file: /secrets/release-name-mas-external/keysEcdsaSecp384r1
-   experimental:
-     access_token_ttl: 86400  # 1 day, up from 5 mins, until EX can better handle refresh tokens
+   mas-config-underrides.yaml: |
+     
+     policy:
+       data:
+         admin_clients: []
+         admin_users: []
+         client_registration:
+           allow_host_mismatch: false
+           allow_insecure_uris: false
+     
+   mas-config-overrides.yaml: |
+     http:
+       public_base: "https://mas.ess.localhost"
+       listeners:
+       - name: web
+         binds:
+         - host: 0.0.0.0
+           port: 8080
+         resources:
+         - name: human
+         - name: discovery
+         - name: oauth
+         - name: compat
+         - name: assets
+         - name: graphql
+           # This lets us use the GraphQL API with an OAuth 2.0 access token,
+           # which we currently use in the ansible modules and in synapse-admin
+           undocumented_oauth2_access: true
+         - name: adminapi
+       - name: internal
+         binds:
+         - host: 0.0.0.0
+           port: 8081
+         resources:
+         - name: health
+         - name: prometheus
+         - name: connection-info
+     
+     
+     database:
+       uri: "postgresql://matrixauthenticationservice_user:${POSTGRES_PASSWORD}@release-name-postgres.ess-ci.svc.cluster.local.:5432/matrixauthenticationservice?sslmode=prefer&application_name=matrix-authentication-service"
+     
+     
+     telemetry:
+       metrics:
+         exporter: prometheus
+     
+     secrets:
+       encryption_file: /secrets/release-name-mas-external/encryption
+       keys:
+       - kid: rsa
+         key_file: /secrets/release-name-mas-external/keysRSA
+       - kid: prime256v1
+         key_file: /secrets/release-name-mas-external/keysEcdsaPrime256v1
+     
+       - kid: secp256k1
+         key_file: /secrets/release-name-mas-external/keysEcdsaSecp256k1
+     
+       - kid: secp384r1
+         key_file: /secrets/release-name-mas-external/keysEcdsaSecp384r1



@@ Deployment/ess-ci/release-name-matrix-authentication-service - metadata.labels.k8s.element.io/matrix-authentication-service-config-hash @@
- a9146fccbdaea4f1583bd658f3b4fa379bbb35c7
+ da37c88b86e88d1242ee6135dd20cbd96d0d2936

@@ Deployment/ess-ci/release-name-matrix-authentication-service - spec.template.metadata.labels.k8s.element.io/matrix-authentication-service-config-hash @@
- a9146fccbdaea4f1583bd658f3b4fa379bbb35c7
+ da37c88b86e88d1242ee6135dd20cbd96d0d2936

@@ Deployment/ess-ci/release-name-matrix-authentication-service - spec.template.spec.initContainers.render-config.command @@
- - /config-templates/mas-config.yaml
+   - /config-templates/mas-config-underrides.yaml
+   - /config-templates/mas-config-overrides.yaml
matrix-authentication-service-postgres-secrets-in-helm-values.yaml 
@@ ConfigMap/ess-ci/release-name-matrix-authentication-service - data @@
- mas-config.yaml: |
-   http:
-     public_base: "https://mas.ess.localhost"
-     listeners:
-     - name: web
-       binds:
-       - host: 0.0.0.0
-         port: 8080
-       resources:
-       - name: human
-       - name: discovery
-       - name: oauth
-       - name: compat
-       - name: assets
-       - name: graphql
-         # This lets us use the GraphQL API with an OAuth 2.0 access token,
-         # which we currently use in the ansible modules and in synapse-admin
-         undocumented_oauth2_access: true
-       - name: adminapi
-     - name: internal
-       binds:
-       - host: 0.0.0.0
-         port: 8081
-       resources:
-       - name: health
-       - name: prometheus
-       - name: connection-info
-   
-   
-   database:
-     uri: "postgresql://matrixauthenticationservice_user:${POSTGRES_PASSWORD}@release-name-postgres.ess-ci.svc.cluster.local.:5432/matrixauthenticationservice?sslmode=prefer&application_name=matrix-authentication-service"
-   
-   
-   telemetry:
-     metrics:
-       exporter: prometheus
-   
-   policy:
-     data:
-       admin_clients: []
-       admin_users: []
-       client_registration:
-         allow_host_mismatch: false
-         allow_insecure_uris: false
-   
-   secrets:
-     encryption_file: /secrets/release-name-mas-external/encryption
-     keys:
-     - kid: rsa
-       key_file: /secrets/release-name-mas-external/keysRSA
-     - kid: prime256v1
-       key_file: /secrets/release-name-mas-external/keysEcdsaPrime256v1
-   
-     - kid: secp256k1
-       key_file: /secrets/release-name-mas-external/keysEcdsaSecp256k1
-   
-     - kid: secp384r1
-       key_file: /secrets/release-name-mas-external/keysEcdsaSecp384r1
-   experimental:
-     access_token_ttl: 86400  # 1 day, up from 5 mins, until EX can better handle refresh tokens
+   mas-config-underrides.yaml: |
+     
+     policy:
+       data:
+         admin_clients: []
+         admin_users: []
+         client_registration:
+           allow_host_mismatch: false
+           allow_insecure_uris: false
+     
+   mas-config-overrides.yaml: |
+     http:
+       public_base: "https://mas.ess.localhost"
+       listeners:
+       - name: web
+         binds:
+         - host: 0.0.0.0
+           port: 8080
+         resources:
+         - name: human
+         - name: discovery
+         - name: oauth
+         - name: compat
+         - name: assets
+         - name: graphql
+           # This lets us use the GraphQL API with an OAuth 2.0 access token,
+           # which we currently use in the ansible modules and in synapse-admin
+           undocumented_oauth2_access: true
+         - name: adminapi
+       - name: internal
+         binds:
+         - host: 0.0.0.0
+           port: 8081
+         resources:
+         - name: health
+         - name: prometheus
+         - name: connection-info
+     
+     
+     database:
+       uri: "postgresql://matrixauthenticationservice_user:${POSTGRES_PASSWORD}@release-name-postgres.ess-ci.svc.cluster.local.:5432/matrixauthenticationservice?sslmode=prefer&application_name=matrix-authentication-service"
+     
+     
+     telemetry:
+       metrics:
+         exporter: prometheus
+     
+     secrets:
+       encryption_file: /secrets/release-name-mas-external/encryption
+       keys:
+       - kid: rsa
+         key_file: /secrets/release-name-mas-external/keysRSA
+       - kid: prime256v1
+         key_file: /secrets/release-name-mas-external/keysEcdsaPrime256v1
+     
+       - kid: secp256k1
+         key_file: /secrets/release-name-mas-external/keysEcdsaSecp256k1
+     
+       - kid: secp384r1
+         key_file: /secrets/release-name-mas-external/keysEcdsaSecp384r1



@@ Deployment/ess-ci/release-name-matrix-authentication-service - metadata.labels.k8s.element.io/matrix-authentication-service-config-hash @@
- a9146fccbdaea4f1583bd658f3b4fa379bbb35c7
+ da37c88b86e88d1242ee6135dd20cbd96d0d2936

@@ Deployment/ess-ci/release-name-matrix-authentication-service - spec.template.metadata.labels.k8s.element.io/matrix-authentication-service-config-hash @@
- a9146fccbdaea4f1583bd658f3b4fa379bbb35c7
+ da37c88b86e88d1242ee6135dd20cbd96d0d2936

@@ Deployment/ess-ci/release-name-matrix-authentication-service - spec.template.spec.initContainers.render-config.command @@
- - /config-templates/mas-config.yaml
+   - /config-templates/mas-config-underrides.yaml
+   - /config-templates/mas-config-overrides.yaml
matrix-authentication-service-secrets-externally-values.yaml 
@@ ConfigMap/ess-ci/release-name-matrix-authentication-service - data @@
- mas-config.yaml: |
-   http:
-     public_base: "https://mas.ess.localhost"
-     listeners:
-     - name: web
-       binds:
-       - host: 0.0.0.0
-         port: 8080
-       resources:
-       - name: human
-       - name: discovery
-       - name: oauth
-       - name: compat
-       - name: assets
-       - name: graphql
-         # This lets us use the GraphQL API with an OAuth 2.0 access token,
-         # which we currently use in the ansible modules and in synapse-admin
-         undocumented_oauth2_access: true
-       - name: adminapi
-     - name: internal
-       binds:
-       - host: 0.0.0.0
-         port: 8081
-       resources:
-       - name: health
-       - name: prometheus
-       - name: connection-info
-   
-   
-   database:
-     uri: "postgresql://mas:${POSTGRES_PASSWORD}@postgres:/mas?application_name=matrix-authentication-service"
-   
-   telemetry:
-     metrics:
-       exporter: prometheus
-   
-   policy:
-     data:
-       admin_clients: []
-       admin_users: []
-       client_registration:
-         allow_host_mismatch: false
-         allow_insecure_uris: false
-   
-   secrets:
-     encryption_file: /secrets/release-name-mas-external/encryption
-     keys:
-     - kid: rsa
-       key_file: /secrets/release-name-mas-external/keysRSA
-     - kid: prime256v1
-       key_file: /secrets/release-name-mas-external/keysEcdsaPrime256v1
-   
-     - kid: secp256k1
-       key_file: /secrets/release-name-mas-external/keysEcdsaSecp256k1
-   
-     - kid: secp384r1
-       key_file: /secrets/release-name-mas-external/keysEcdsaSecp384r1
-   experimental:
-     access_token_ttl: 86400  # 1 day, up from 5 mins, until EX can better handle refresh tokens
+   mas-config-underrides.yaml: |
+     
+     policy:
+       data:
+         admin_clients: []
+         admin_users: []
+         client_registration:
+           allow_host_mismatch: false
+           allow_insecure_uris: false
+     
+   mas-config-overrides.yaml: |
+     http:
+       public_base: "https://mas.ess.localhost"
+       listeners:
+       - name: web
+         binds:
+         - host: 0.0.0.0
+           port: 8080
+         resources:
+         - name: human
+         - name: discovery
+         - name: oauth
+         - name: compat
+         - name: assets
+         - name: graphql
+           # This lets us use the GraphQL API with an OAuth 2.0 access token,
+           # which we currently use in the ansible modules and in synapse-admin
+           undocumented_oauth2_access: true
+         - name: adminapi
+       - name: internal
+         binds:
+         - host: 0.0.0.0
+           port: 8081
+         resources:
+         - name: health
+         - name: prometheus
+         - name: connection-info
+     
+     
+     database:
+       uri: "postgresql://mas:${POSTGRES_PASSWORD}@postgres:/mas?application_name=matrix-authentication-service"
+     
+     telemetry:
+       metrics:
+         exporter: prometheus
+     
+     secrets:
+       encryption_file: /secrets/release-name-mas-external/encryption
+       keys:
+       - kid: rsa
+         key_file: /secrets/release-name-mas-external/keysRSA
+       - kid: prime256v1
+         key_file: /secrets/release-name-mas-external/keysEcdsaPrime256v1
+     
+       - kid: secp256k1
+         key_file: /secrets/release-name-mas-external/keysEcdsaSecp256k1
+     
+       - kid: secp384r1
+         key_file: /secrets/release-name-mas-external/keysEcdsaSecp384r1



@@ Deployment/ess-ci/release-name-matrix-authentication-service - metadata.labels.k8s.element.io/matrix-authentication-service-config-hash @@
- 7469a04c73a76a19b99ee3370c77fdfd63576cdc
+ 844dbfa44e35af516ac54e25834216907f722b90

@@ Deployment/ess-ci/release-name-matrix-authentication-service - spec.template.metadata.labels.k8s.element.io/matrix-authentication-service-config-hash @@
- 7469a04c73a76a19b99ee3370c77fdfd63576cdc
+ 844dbfa44e35af516ac54e25834216907f722b90

@@ Deployment/ess-ci/release-name-matrix-authentication-service - spec.template.spec.initContainers.render-config.command @@
- - /config-templates/mas-config.yaml
+   - /config-templates/mas-config-underrides.yaml
+   - /config-templates/mas-config-overrides.yaml
matrix-authentication-service-secrets-in-helm-values.yaml 
@@ ConfigMap/ess-ci/release-name-matrix-authentication-service - data @@
- mas-config.yaml: |
-   http:
-     public_base: "https://mas.ess.localhost"
-     listeners:
-     - name: web
-       binds:
-       - host: 0.0.0.0
-         port: 8080
-       resources:
-       - name: human
-       - name: discovery
-       - name: oauth
-       - name: compat
-       - name: assets
-       - name: graphql
-         # This lets us use the GraphQL API with an OAuth 2.0 access token,
-         # which we currently use in the ansible modules and in synapse-admin
-         undocumented_oauth2_access: true
-       - name: adminapi
-     - name: internal
-       binds:
-       - host: 0.0.0.0
-         port: 8081
-       resources:
-       - name: health
-       - name: prometheus
-       - name: connection-info
-   
-   
-   database:
-     uri: "postgresql://mas:${POSTGRES_PASSWORD}@postgres:/mas?application_name=matrix-authentication-service"
-   
-   telemetry:
-     metrics:
-       exporter: prometheus
-   
-   policy:
-     data:
-       admin_clients: []
-       admin_users: []
-       client_registration:
-         allow_host_mismatch: false
-         allow_insecure_uris: false
-   
-   secrets:
-     encryption_file: /secrets/release-name-matrix-authentication-service/ENCRYPTION_SECRET
-     keys:
-     - kid: rsa
-       key_file: /secrets/release-name-matrix-authentication-service/RSA_PRIVATE_KEY
-     - kid: prime256v1
-       key_file: /secrets/release-name-matrix-authentication-service/ECDSA_PRIME256V1_PRIVATE_KEY
-   
-     - kid: secp256k1
-       key_file: /secrets/release-name-matrix-authentication-service/ECDSA_SECP256K1_PRIVATE_KEY
-   
-     - kid: secp384r1
-       key_file: /secrets/release-name-matrix-authentication-service/ECDSA_SECP384R1_PRIVATE_KEY
-   experimental:
-     access_token_ttl: 86400  # 1 day, up from 5 mins, until EX can better handle refresh tokens
+   mas-config-underrides.yaml: |
+     
+     policy:
+       data:
+         admin_clients: []
+         admin_users: []
+         client_registration:
+           allow_host_mismatch: false
+           allow_insecure_uris: false
+     
+   mas-config-overrides.yaml: |
+     http:
+       public_base: "https://mas.ess.localhost"
+       listeners:
+       - name: web
+         binds:
+         - host: 0.0.0.0
+           port: 8080
+         resources:
+         - name: human
+         - name: discovery
+         - name: oauth
+         - name: compat
+         - name: assets
+         - name: graphql
+           # This lets us use the GraphQL API with an OAuth 2.0 access token,
+           # which we currently use in the ansible modules and in synapse-admin
+           undocumented_oauth2_access: true
+         - name: adminapi
+       - name: internal
+         binds:
+         - host: 0.0.0.0
+           port: 8081
+         resources:
+         - name: health
+         - name: prometheus
+         - name: connection-info
+     
+     
+     database:
+       uri: "postgresql://mas:${POSTGRES_PASSWORD}@postgres:/mas?application_name=matrix-authentication-service"
+     
+     telemetry:
+       metrics:
+         exporter: prometheus
+     
+     secrets:
+       encryption_file: /secrets/release-name-matrix-authentication-service/ENCRYPTION_SECRET
+       keys:
+       - kid: rsa
+         key_file: /secrets/release-name-matrix-authentication-service/RSA_PRIVATE_KEY
+       - kid: prime256v1
+         key_file: /secrets/release-name-matrix-authentication-service/ECDSA_PRIME256V1_PRIVATE_KEY
+     
+       - kid: secp256k1
+         key_file: /secrets/release-name-matrix-authentication-service/ECDSA_SECP256K1_PRIVATE_KEY
+     
+       - kid: secp384r1
+         key_file: /secrets/release-name-matrix-authentication-service/ECDSA_SECP384R1_PRIVATE_KEY



@@ Deployment/ess-ci/release-name-matrix-authentication-service - metadata.labels.k8s.element.io/matrix-authentication-service-config-hash @@
- 204f08a068197d388b0728e376cac13e8ed97bd0
+ 524a5a74feef9bbe3c5ebaa901083788ac3d8431

@@ Deployment/ess-ci/release-name-matrix-authentication-service - spec.template.metadata.labels.k8s.element.io/matrix-authentication-service-config-hash @@
- 204f08a068197d388b0728e376cac13e8ed97bd0
+ 524a5a74feef9bbe3c5ebaa901083788ac3d8431

@@ Deployment/ess-ci/release-name-matrix-authentication-service - spec.template.spec.initContainers.render-config.command @@
- - /config-templates/mas-config.yaml
+   - /config-templates/mas-config-underrides.yaml
+   - /config-templates/mas-config-overrides.yaml
matrix-authentication-service-synapse-syn2mas-dry-run-secrets-externally-values.yaml 
@@ ConfigMap/ess-ci/release-name-matrix-authentication-service - data @@
- mas-config.yaml: |
-   http:
-     public_base: "https://mas.ess.localhost"
-     listeners:
-     - name: web
-       binds:
-       - host: 0.0.0.0
-         port: 8080
-       resources:
-       - name: human
-       - name: discovery
-       - name: oauth
-       - name: compat
-       - name: assets
-       - name: graphql
-         # This lets us use the GraphQL API with an OAuth 2.0 access token,
-         # which we currently use in the ansible modules and in synapse-admin
-         undocumented_oauth2_access: true
-       - name: adminapi
-     - name: internal
-       binds:
-       - host: 0.0.0.0
-         port: 8081
-       resources:
-       - name: health
-       - name: prometheus
-       - name: connection-info
-   
-   
-   database:
-     uri: "postgresql://mas:${POSTGRES_PASSWORD}@postgres:/mas?application_name=matrix-authentication-service"
-   
-   telemetry:
-     metrics:
-       exporter: prometheus
-   matrix:
-     homeserver: "ess.localhost"
-     secret_file: /secrets/release-name-mas-external/synapseShared
-     endpoint: "http://release-name-synapse-main.ess-ci.svc.cluster.local.:8008"
-     kind: synapse_read_only
-   
-   policy:
-     data:
-       admin_clients: []
-       admin_users: []
-       client_registration:
-         allow_host_mismatch: false
-         allow_insecure_uris: false
-   
-   secrets:
-     encryption_file: /secrets/release-name-mas-external/encryption
-     keys:
-     - kid: rsa
-       key_file: /secrets/release-name-mas-external/keysRSA
-     - kid: prime256v1
-       key_file: /secrets/release-name-mas-external/keysEcdsaPrime256v1
-   
-     - kid: secp256k1
-       key_file: /secrets/release-name-mas-external/keysEcdsaSecp256k1
-   
-     - kid: secp384r1
-       key_file: /secrets/release-name-mas-external/keysEcdsaSecp384r1
-   experimental:
-     access_token_ttl: 86400  # 1 day, up from 5 mins, until EX can better handle refresh tokens
+   mas-config-underrides.yaml: |
+     
+     policy:
+       data:
+         admin_clients: []
+         admin_users: []
+         client_registration:
+           allow_host_mismatch: false
+           allow_insecure_uris: false
+     
+   mas-config-overrides.yaml: |
+     http:
+       public_base: "https://mas.ess.localhost"
+       listeners:
+       - name: web
+         binds:
+         - host: 0.0.0.0
+           port: 8080
+         resources:
+         - name: human
+         - name: discovery
+         - name: oauth
+         - name: compat
+         - name: assets
+         - name: graphql
+           # This lets us use the GraphQL API with an OAuth 2.0 access token,
+           # which we currently use in the ansible modules and in synapse-admin
+           undocumented_oauth2_access: true
+         - name: adminapi
+       - name: internal
+         binds:
+         - host: 0.0.0.0
+           port: 8081
+         resources:
+         - name: health
+         - name: prometheus
+         - name: connection-info
+     
+     
+     database:
+       uri: "postgresql://mas:${POSTGRES_PASSWORD}@postgres:/mas?application_name=matrix-authentication-service"
+     
+     telemetry:
+       metrics:
+         exporter: prometheus
+     matrix:
+       homeserver: "ess.localhost"
+       secret_file: /secrets/release-name-mas-external/synapseShared
+       endpoint: "http://release-name-synapse-main.ess-ci.svc.cluster.local.:8008"
+       kind: synapse_read_only
+     
+     secrets:
+       encryption_file: /secrets/release-name-mas-external/encryption
+       keys:
+       - kid: rsa
+         key_file: /secrets/release-name-mas-external/keysRSA
+       - kid: prime256v1
+         key_file: /secrets/release-name-mas-external/keysEcdsaPrime256v1
+     
+       - kid: secp256k1
+         key_file: /secrets/release-name-mas-external/keysEcdsaSecp256k1
+     
+       - kid: secp384r1
+         key_file: /secrets/release-name-mas-external/keysEcdsaSecp384r1



@@ Deployment/ess-ci/release-name-matrix-authentication-service - metadata.labels.k8s.element.io/matrix-authentication-service-config-hash @@
- 2392150a373d461230ce45dbfb47475e2351a30a
+ b56ed457e3f190137b61a227c69172fb5fc429a0

@@ Deployment/ess-ci/release-name-matrix-authentication-service - spec.template.metadata.labels.k8s.element.io/matrix-authentication-service-config-hash @@
- 2392150a373d461230ce45dbfb47475e2351a30a
+ b56ed457e3f190137b61a227c69172fb5fc429a0

@@ Deployment/ess-ci/release-name-matrix-authentication-service - spec.template.spec.initContainers.render-config.command @@
- - /config-templates/mas-config.yaml
+   - /config-templates/mas-config-underrides.yaml
+   - /config-templates/mas-config-overrides.yaml



@@ Job/ess-ci/release-name-syn2mas - metadata.labels.k8s.element.io/matrix-authentication-service-config-hash @@
- 2392150a373d461230ce45dbfb47475e2351a30a
+ b56ed457e3f190137b61a227c69172fb5fc429a0

@@ Job/ess-ci/release-name-syn2mas - spec.template.metadata.labels.k8s.element.io/matrix-authentication-service-config-hash @@
- 2392150a373d461230ce45dbfb47475e2351a30a
+ b56ed457e3f190137b61a227c69172fb5fc429a0

@@ Job/ess-ci/release-name-syn2mas - spec.template.spec.initContainers.render-config-mas.command @@
- - /config-templates/mas-config.yaml
+   - /config-templates/mas-config-underrides.yaml
+   - /config-templates/mas-config-overrides.yaml
matrix-authentication-service-synapse-syn2mas-dry-run-secrets-in-helm-values.yaml 
@@ ConfigMap/ess-ci/release-name-matrix-authentication-service - data @@
- mas-config.yaml: |
-   http:
-     public_base: "https://mas.ess.localhost"
-     listeners:
-     - name: web
-       binds:
-       - host: 0.0.0.0
-         port: 8080
-       resources:
-       - name: human
-       - name: discovery
-       - name: oauth
-       - name: compat
-       - name: assets
-       - name: graphql
-         # This lets us use the GraphQL API with an OAuth 2.0 access token,
-         # which we currently use in the ansible modules and in synapse-admin
-         undocumented_oauth2_access: true
-       - name: adminapi
-     - name: internal
-       binds:
-       - host: 0.0.0.0
-         port: 8081
-       resources:
-       - name: health
-       - name: prometheus
-       - name: connection-info
-   
-   
-   database:
-     uri: "postgresql://mas:${POSTGRES_PASSWORD}@postgres:/mas?application_name=matrix-authentication-service"
-   
-   telemetry:
-     metrics:
-       exporter: prometheus
-   matrix:
-     homeserver: "ess.localhost"
-     secret_file: /secrets/release-name-matrix-authentication-service/SYNAPSE_SHARED_SECRET
-     endpoint: "http://release-name-synapse-main.ess-ci.svc.cluster.local.:8008"
-     kind: synapse_read_only
-   
-   policy:
-     data:
-       admin_clients: []
-       admin_users: []
-       client_registration:
-         allow_host_mismatch: false
-         allow_insecure_uris: false
-   
-   secrets:
-     encryption_file: /secrets/release-name-matrix-authentication-service/ENCRYPTION_SECRET
-     keys:
-     - kid: rsa
-       key_file: /secrets/release-name-matrix-authentication-service/RSA_PRIVATE_KEY
-     - kid: prime256v1
-       key_file: /secrets/release-name-matrix-authentication-service/ECDSA_PRIME256V1_PRIVATE_KEY
-   
-     - kid: secp256k1
-       key_file: /secrets/release-name-matrix-authentication-service/ECDSA_SECP256K1_PRIVATE_KEY
-   
-     - kid: secp384r1
-       key_file: /secrets/release-name-matrix-authentication-service/ECDSA_SECP384R1_PRIVATE_KEY
-   experimental:
-     access_token_ttl: 86400  # 1 day, up from 5 mins, until EX can better handle refresh tokens
+   mas-config-underrides.yaml: |
+     
+     policy:
+       data:
+         admin_clients: []
+         admin_users: []
+         client_registration:
+           allow_host_mismatch: false
+           allow_insecure_uris: false
+     
+   mas-config-overrides.yaml: |
+     http:
+       public_base: "https://mas.ess.localhost"
+       listeners:
+       - name: web
+         binds:
+         - host: 0.0.0.0
+           port: 8080
+         resources:
+         - name: human
+         - name: discovery
+         - name: oauth
+         - name: compat
+         - name: assets
+         - name: graphql
+           # This lets us use the GraphQL API with an OAuth 2.0 access token,
+           # which we currently use in the ansible modules and in synapse-admin
+           undocumented_oauth2_access: true
+         - name: adminapi
+       - name: internal
+         binds:
+         - host: 0.0.0.0
+           port: 8081
+         resources:
+         - name: health
+         - name: prometheus
+         - name: connection-info
+     
+     
+     database:
+       uri: "postgresql://mas:${POSTGRES_PASSWORD}@postgres:/mas?application_name=matrix-authentication-service"
+     
+     telemetry:
+       metrics:
+         exporter: prometheus
+     matrix:
+       homeserver: "ess.localhost"
+       secret_file: /secrets/release-name-matrix-authentication-service/SYNAPSE_SHARED_SECRET
+       endpoint: "http://release-name-synapse-main.ess-ci.svc.cluster.local.:8008"
+       kind: synapse_read_only
+     
+     secrets:
+       encryption_file: /secrets/release-name-matrix-authentication-service/ENCRYPTION_SECRET
+       keys:
+       - kid: rsa
+         key_file: /secrets/release-name-matrix-authentication-service/RSA_PRIVATE_KEY
+       - kid: prime256v1
+         key_file: /secrets/release-name-matrix-authentication-service/ECDSA_PRIME256V1_PRIVATE_KEY
+     
+       - kid: secp256k1
+         key_file: /secrets/release-name-matrix-authentication-service/ECDSA_SECP256K1_PRIVATE_KEY
+     
+       - kid: secp384r1
+         key_file: /secrets/release-name-matrix-authentication-service/ECDSA_SECP384R1_PRIVATE_KEY



@@ Deployment/ess-ci/release-name-matrix-authentication-service - metadata.labels.k8s.element.io/matrix-authentication-service-config-hash @@
- 1294b4ea0c5a46f6977553a9d6b7c00fffe20ec2
+ c37867ad06aaabe2d5d68f9f692560a1c12a06fc

@@ Deployment/ess-ci/release-name-matrix-authentication-service - spec.template.metadata.labels.k8s.element.io/matrix-authentication-service-config-hash @@
- 1294b4ea0c5a46f6977553a9d6b7c00fffe20ec2
+ c37867ad06aaabe2d5d68f9f692560a1c12a06fc

@@ Deployment/ess-ci/release-name-matrix-authentication-service - spec.template.spec.initContainers.render-config.command @@
- - /config-templates/mas-config.yaml
+   - /config-templates/mas-config-underrides.yaml
+   - /config-templates/mas-config-overrides.yaml



@@ Job/ess-ci/release-name-syn2mas - metadata.labels.k8s.element.io/matrix-authentication-service-config-hash @@
- 1294b4ea0c5a46f6977553a9d6b7c00fffe20ec2
+ c37867ad06aaabe2d5d68f9f692560a1c12a06fc

@@ Job/ess-ci/release-name-syn2mas - spec.template.metadata.labels.k8s.element.io/matrix-authentication-service-config-hash @@
- 1294b4ea0c5a46f6977553a9d6b7c00fffe20ec2
+ c37867ad06aaabe2d5d68f9f692560a1c12a06fc

@@ Job/ess-ci/release-name-syn2mas - spec.template.spec.initContainers.render-config-mas.command @@
- - /config-templates/mas-config.yaml
+   - /config-templates/mas-config-underrides.yaml
+   - /config-templates/mas-config-overrides.yaml
matrix-authentication-service-synapse-syn2mas-migrate-secrets-externally-values.yaml 
@@ ConfigMap/ess-ci/release-name-matrix-authentication-service-pre - data @@
- mas-config.yaml: |
-   http:
-     public_base: "https://mas.ess.localhost"
-     listeners:
-     - name: web
-       binds:
-       - host: 0.0.0.0
-         port: 8080
-       resources:
-       - name: human
-       - name: discovery
-       - name: oauth
-       - name: compat
-       - name: assets
-       - name: graphql
-         # This lets us use the GraphQL API with an OAuth 2.0 access token,
-         # which we currently use in the ansible modules and in synapse-admin
-         undocumented_oauth2_access: true
-       - name: adminapi
-     - name: internal
-       binds:
-       - host: 0.0.0.0
-         port: 8081
-       resources:
-       - name: health
-       - name: prometheus
-       - name: connection-info
-   
-   
-   database:
-     uri: "postgresql://mas:${POSTGRES_PASSWORD}@postgres:/mas?application_name=matrix-authentication-service"
-   
-   telemetry:
-     metrics:
-       exporter: prometheus
-   matrix:
-     homeserver: "ess.localhost"
-     secret_file: /secrets/release-name-mas-external/synapseShared
-     endpoint: "http://release-name-synapse-main.ess-ci.svc.cluster.local.:8008"
-     kind: synapse_modern
-   
-   policy:
-     data:
-       admin_clients: []
-       admin_users: []
-       client_registration:
-         allow_host_mismatch: false
-         allow_insecure_uris: false
-   
-   secrets:
-     encryption_file: /secrets/release-name-mas-external/encryption
-     keys:
-     - kid: rsa
-       key_file: /secrets/release-name-mas-external/keysRSA
-     - kid: prime256v1
-       key_file: /secrets/release-name-mas-external/keysEcdsaPrime256v1
-   
-     - kid: secp256k1
-       key_file: /secrets/release-name-mas-external/keysEcdsaSecp256k1
-   
-     - kid: secp384r1
-       key_file: /secrets/release-name-mas-external/keysEcdsaSecp384r1
-   experimental:
-     access_token_ttl: 86400  # 1 day, up from 5 mins, until EX can better handle refresh tokens
+   mas-config-underrides.yaml: |
+     
+     policy:
+       data:
+         admin_clients: []
+         admin_users: []
+         client_registration:
+           allow_host_mismatch: false
+           allow_insecure_uris: false
+     
+   mas-config-overrides.yaml: |
+     http:
+       public_base: "https://mas.ess.localhost"
+       listeners:
+       - name: web
+         binds:
+         - host: 0.0.0.0
+           port: 8080
+         resources:
+         - name: human
+         - name: discovery
+         - name: oauth
+         - name: compat
+         - name: assets
+         - name: graphql
+           # This lets us use the GraphQL API with an OAuth 2.0 access token,
+           # which we currently use in the ansible modules and in synapse-admin
+           undocumented_oauth2_access: true
+         - name: adminapi
+       - name: internal
+         binds:
+         - host: 0.0.0.0
+           port: 8081
+         resources:
+         - name: health
+         - name: prometheus
+         - name: connection-info
+     
+     
+     database:
+       uri: "postgresql://mas:${POSTGRES_PASSWORD}@postgres:/mas?application_name=matrix-authentication-service"
+     
+     telemetry:
+       metrics:
+         exporter: prometheus
+     matrix:
+       homeserver: "ess.localhost"
+       secret_file: /secrets/release-name-mas-external/synapseShared
+       endpoint: "http://release-name-synapse-main.ess-ci.svc.cluster.local.:8008"
+       kind: synapse_modern
+     
+     secrets:
+       encryption_file: /secrets/release-name-mas-external/encryption
+       keys:
+       - kid: rsa
+         key_file: /secrets/release-name-mas-external/keysRSA
+       - kid: prime256v1
+         key_file: /secrets/release-name-mas-external/keysEcdsaPrime256v1
+     
+       - kid: secp256k1
+         key_file: /secrets/release-name-mas-external/keysEcdsaSecp256k1
+     
+       - kid: secp384r1
+         key_file: /secrets/release-name-mas-external/keysEcdsaSecp384r1



@@ ConfigMap/ess-ci/release-name-matrix-authentication-service - data @@
- mas-config.yaml: |
-   http:
-     public_base: "https://mas.ess.localhost"
-     listeners:
-     - name: web
-       binds:
-       - host: 0.0.0.0
-         port: 8080
-       resources:
-       - name: human
-       - name: discovery
-       - name: oauth
-       - name: compat
-       - name: assets
-       - name: graphql
-         # This lets us use the GraphQL API with an OAuth 2.0 access token,
-         # which we currently use in the ansible modules and in synapse-admin
-         undocumented_oauth2_access: true
-       - name: adminapi
-     - name: internal
-       binds:
-       - host: 0.0.0.0
-         port: 8081
-       resources:
-       - name: health
-       - name: prometheus
-       - name: connection-info
-   
-   
-   database:
-     uri: "postgresql://mas:${POSTGRES_PASSWORD}@postgres:/mas?application_name=matrix-authentication-service"
-   
-   telemetry:
-     metrics:
-       exporter: prometheus
-   matrix:
-     homeserver: "ess.localhost"
-     secret_file: /secrets/release-name-mas-external/synapseShared
-     endpoint: "http://release-name-synapse-main.ess-ci.svc.cluster.local.:8008"
-     kind: synapse_modern
-   
-   policy:
-     data:
-       admin_clients: []
-       admin_users: []
-       client_registration:
-         allow_host_mismatch: false
-         allow_insecure_uris: false
-   
-   secrets:
-     encryption_file: /secrets/release-name-mas-external/encryption
-     keys:
-     - kid: rsa
-       key_file: /secrets/release-name-mas-external/keysRSA
-     - kid: prime256v1
-       key_file: /secrets/release-name-mas-external/keysEcdsaPrime256v1
-   
-     - kid: secp256k1
-       key_file: /secrets/release-name-mas-external/keysEcdsaSecp256k1
-   
-     - kid: secp384r1
-       key_file: /secrets/release-name-mas-external/keysEcdsaSecp384r1
-   experimental:
-     access_token_ttl: 86400  # 1 day, up from 5 mins, until EX can better handle refresh tokens
+   mas-config-underrides.yaml: |
+     
+     policy:
+       data:
+         admin_clients: []
+         admin_users: []
+         client_registration:
+           allow_host_mismatch: false
+           allow_insecure_uris: false
+     
+   mas-config-overrides.yaml: |
+     http:
+       public_base: "https://mas.ess.localhost"
+       listeners:
+       - name: web
+         binds:
+         - host: 0.0.0.0
+           port: 8080
+         resources:
+         - name: human
+         - name: discovery
+         - name: oauth
+         - name: compat
+         - name: assets
+         - name: graphql
+           # This lets us use the GraphQL API with an OAuth 2.0 access token,
+           # which we currently use in the ansible modules and in synapse-admin
+           undocumented_oauth2_access: true
+         - name: adminapi
+       - name: internal
+         binds:
+         - host: 0.0.0.0
+           port: 8081
+         resources:
+         - name: health
+         - name: prometheus
+         - name: connection-info
+     
+     
+     database:
+       uri: "postgresql://mas:${POSTGRES_PASSWORD}@postgres:/mas?application_name=matrix-authentication-service"
+     
+     telemetry:
+       metrics:
+         exporter: prometheus
+     matrix:
+       homeserver: "ess.localhost"
+       secret_file: /secrets/release-name-mas-external/synapseShared
+       endpoint: "http://release-name-synapse-main.ess-ci.svc.cluster.local.:8008"
+       kind: synapse_modern
+     
+     secrets:
+       encryption_file: /secrets/release-name-mas-external/encryption
+       keys:
+       - kid: rsa
+         key_file: /secrets/release-name-mas-external/keysRSA
+       - kid: prime256v1
+         key_file: /secrets/release-name-mas-external/keysEcdsaPrime256v1
+     
+       - kid: secp256k1
+         key_file: /secrets/release-name-mas-external/keysEcdsaSecp256k1
+     
+       - kid: secp384r1
+         key_file: /secrets/release-name-mas-external/keysEcdsaSecp384r1



@@ Deployment/ess-ci/release-name-matrix-authentication-service - metadata.labels.k8s.element.io/matrix-authentication-service-config-hash @@
- 7cad477ccf7203e8e5ec4c049f3b66e6f5799820
+ 376789dda8fe89ba8096f9f2df4835ed1a8acab7

@@ Deployment/ess-ci/release-name-matrix-authentication-service - spec.template.metadata.labels.k8s.element.io/matrix-authentication-service-config-hash @@
- 7cad477ccf7203e8e5ec4c049f3b66e6f5799820
+ 376789dda8fe89ba8096f9f2df4835ed1a8acab7

@@ Deployment/ess-ci/release-name-matrix-authentication-service - spec.template.spec.initContainers.render-config.command @@
- - /config-templates/mas-config.yaml
+   - /config-templates/mas-config-underrides.yaml
+   - /config-templates/mas-config-overrides.yaml



@@ Job/ess-ci/release-name-syn2mas - metadata.labels.k8s.element.io/matrix-authentication-service-config-hash @@
- 7cad477ccf7203e8e5ec4c049f3b66e6f5799820
+ 376789dda8fe89ba8096f9f2df4835ed1a8acab7

@@ Job/ess-ci/release-name-syn2mas - spec.template.metadata.labels.k8s.element.io/matrix-authentication-service-config-hash @@
- 7cad477ccf7203e8e5ec4c049f3b66e6f5799820
+ 376789dda8fe89ba8096f9f2df4835ed1a8acab7

@@ Job/ess-ci/release-name-syn2mas - spec.template.spec.initContainers.render-config-mas.command @@
- - /config-templates/mas-config.yaml
+   - /config-templates/mas-config-underrides.yaml
+   - /config-templates/mas-config-overrides.yaml
matrix-authentication-service-synapse-syn2mas-migrate-secrets-in-helm-values.yaml 
@@ ConfigMap/ess-ci/release-name-matrix-authentication-service-pre - data @@
- mas-config.yaml: |
-   http:
-     public_base: "https://mas.ess.localhost"
-     listeners:
-     - name: web
-       binds:
-       - host: 0.0.0.0
-         port: 8080
-       resources:
-       - name: human
-       - name: discovery
-       - name: oauth
-       - name: compat
-       - name: assets
-       - name: graphql
-         # This lets us use the GraphQL API with an OAuth 2.0 access token,
-         # which we currently use in the ansible modules and in synapse-admin
-         undocumented_oauth2_access: true
-       - name: adminapi
-     - name: internal
-       binds:
-       - host: 0.0.0.0
-         port: 8081
-       resources:
-       - name: health
-       - name: prometheus
-       - name: connection-info
-   
-   
-   database:
-     uri: "postgresql://mas:${POSTGRES_PASSWORD}@postgres:/mas?application_name=matrix-authentication-service"
-   
-   telemetry:
-     metrics:
-       exporter: prometheus
-   matrix:
-     homeserver: "ess.localhost"
-     secret_file: /secrets/release-name-matrix-authentication-service-pre/SYNAPSE_SHARED_SECRET
-     endpoint: "http://release-name-synapse-main.ess-ci.svc.cluster.local.:8008"
-     kind: synapse_modern
-   
-   policy:
-     data:
-       admin_clients: []
-       admin_users: []
-       client_registration:
-         allow_host_mismatch: false
-         allow_insecure_uris: false
-   
-   secrets:
-     encryption_file: /secrets/release-name-matrix-authentication-service-pre/ENCRYPTION_SECRET
-     keys:
-     - kid: rsa
-       key_file: /secrets/release-name-matrix-authentication-service-pre/RSA_PRIVATE_KEY
-     - kid: prime256v1
-       key_file: /secrets/release-name-matrix-authentication-service-pre/ECDSA_PRIME256V1_PRIVATE_KEY
-   
-     - kid: secp256k1
-       key_file: /secrets/release-name-matrix-authentication-service-pre/ECDSA_SECP256K1_PRIVATE_KEY
-   
-     - kid: secp384r1
-       key_file: /secrets/release-name-matrix-authentication-service-pre/ECDSA_SECP384R1_PRIVATE_KEY
-   experimental:
-     access_token_ttl: 86400  # 1 day, up from 5 mins, until EX can better handle refresh tokens
+   mas-config-underrides.yaml: |
+     
+     policy:
+       data:
+         admin_clients: []
+         admin_users: []
+         client_registration:
+           allow_host_mismatch: false
+           allow_insecure_uris: false
+     
+   mas-config-overrides.yaml: |
+     http:
+       public_base: "https://mas.ess.localhost"
+       listeners:
+       - name: web
+         binds:
+         - host: 0.0.0.0
+           port: 8080
+         resources:
+         - name: human
+         - name: discovery
+         - name: oauth
+         - name: compat
+         - name: assets
+         - name: graphql
+           # This lets us use the GraphQL API with an OAuth 2.0 access token,
+           # which we currently use in the ansible modules and in synapse-admin
+           undocumented_oauth2_access: true
+         - name: adminapi
+       - name: internal
+         binds:
+         - host: 0.0.0.0
+           port: 8081
+         resources:
+         - name: health
+         - name: prometheus
+         - name: connection-info
+     
+     
+     database:
+       uri: "postgresql://mas:${POSTGRES_PASSWORD}@postgres:/mas?application_name=matrix-authentication-service"
+     
+     telemetry:
+       metrics:
+         exporter: prometheus
+     matrix:
+       homeserv...*[Comment body truncated]*

@benbz benbz merged commit cc26986 into main Sep 19, 2025
68 checks passed
@benbz benbz deleted the bbz/mas-underrides branch September 19, 2025 09:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@gaelgatelement gaelgatelement gaelgatelement approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Make experimental for mas configurable
2 participants
@benbz @gaelgatelement