optionaly-disable-pgbouncer-for-stream-writers (#24)

* optionaly-disable-pgbouncer-for-stream-writers

* fix worker list

Author: shcherbak

charts/synapse/Chart.yaml

@@ -2,5 +2,5 @@
 apiVersion: v2
 name: synapse
 description: matrix synapse kubernetes deployment
-version: 2.0.9
+version: 2.1.0
 appVersion: 1.149.1

charts/synapse/templates/synapse-secret.yaml

@@ -1,18 +1,25 @@
-{{- $workers := merge (deepCopy .Values.synapse.autoscalingWorkers) (deepCopy .Values.synapse.deployScalingWorkers) (deepCopy .Values.synapse.singletonWorkers) -}}
+{{- $workers := merge (deepCopy .Values.synapse.autoscalingWorkers) (deepCopy .Values.synapse.deployScalingWorkers) (deepCopy .Values.synapse.singletonWorkers) }}
+{{- $mediaWorkers       := list "media_repository" "media_repository_background_jobs" }}
+{{- $fedOnlyWorkers     := list "federation_reader" "federation_sender" }}
+{{- $clientFedWorkers   := list "master" "room" }}
+{{- $noHttpWorkers      := list "background_worker" "pusher" }}
+{{- $streamWriters      := list "master" "typing" "to_device" "account_data" "presence" "push_rules" "receipts" "device_lists" "thread_subscriptions" "quarantined_media" "event_persister" }}
+{{- $replicationWorkers := list "master" "typing" "to_device" "account_data" "presence" "push_rules" "receipts" "device_lists" "thread_subscriptions" "quarantined_media" "event_persister" "federation_sender" }}
+{{- $clientOnlyWorkers  := list "typing" "to_device" "account_data" "presence" "push_rules" "receipts" "device_lists" "thread_subscriptions" "quarantined_media" "event_persister" "sync" "client_reader" "user_dir" }}
 
-{{- $registration_shared_secret := .Values.registration_shared_secret -}}
-{{- $form_secret := .Values.form_secret -}}
-{{- $macaroon_secret_key := .Values.macaroon_secret_key -}}
-{{- $media_storage_providers := .Values.media_storage_providers -}}
-{{- $turn_uris := .Values.turn_uris -}}
-{{- $password_providers := .Values.password_providers -}}
-{{- $oidc_providers := .Values.oidc_providers -}}
-{{- $signing_key := .Values.signing_key -}}
+{{- $registration_shared_secret := .Values.registration_shared_secret }}
+{{- $form_secret := .Values.form_secret }}
+{{- $macaroon_secret_key := .Values.macaroon_secret_key }}
+{{- $media_storage_providers := .Values.media_storage_providers }}
+{{- $turn_uris := .Values.turn_uris }}
+{{- $password_providers := .Values.password_providers }}
+{{- $oidc_providers := .Values.oidc_providers }}
+{{- $signing_key := .Values.signing_key }}
 {{- $federation_domain_whitelist := .Values.federation_domain_whitelist }}
 {{- $federation_metrics_domains := .Values.federation_metrics_domains }}
 {{- $idp_metadata := .Values.idp_metadata | default "" }}
 {{- $password_enabled := .Values.password_enabled }}
-{{- $rc_message := .Values.rc_message -}}
+{{- $rc_message := .Values.rc_message }}
 
 {{- range $worker, $options := $workers }}
 {{ $name := $worker | replace "_" "-"}}
@@ -35,7 +42,7 @@ stringData:
     ---
     server_name: {{ $.Values.synapse.serverName }}
     {{- if ne $worker "master" }}
-    {{- if has $worker (list "media_repository" "media_repository_background_jobs") }}
+    {{- if has $worker $mediaWorkers }}
     worker_app: synapse.app.media_repository
     {{- else }}
     worker_app: synapse.app.generic_worker
@@ -66,7 +73,11 @@ stringData:
         cp_max: {{ $.Values.synapse.postgres.cp_max }}
         cp_min: {{ $.Values.synapse.postgres.cp_min }}
         database: {{ $.Values.synapse.postgres.dbname }}
+        {{- if and $.Values.synapse.disablePgBouncerForStreamWriters (has $worker $streamWriters) }}
+        host: {{ $.Values.synapse.postgres.host }}
+        {{- else }}
         host: synapse-pgbouncer
+        {{- end }}
         password: {{ $.Values.synapse.postgres.password }}
         user: {{ $.Values.synapse.postgres.user }}
       name: psycopg2
@@ -98,30 +109,30 @@ stringData:
         resources:
           - names: [metrics]
             compress: false
-      {{- if not (has $worker (list "background_worker" "pusher")) }}
+      {{- if not (has $worker $noHttpWorkers) }}
       - port: 8008
         tls: false
         type: http
         x_forwarded: true
         bind_addresses: ['0.0.0.0']
         resources:
-          {{- if has $worker (list "master" "room") }}
+          {{- if has $worker $clientFedWorkers }}
           - names: [client, federation]
             compress: true
           {{- end }}
-          {{- if has $worker (list "federation_reader" "federation_sender") }}
+          {{- if has $worker $fedOnlyWorkers }}
           - names: [federation]
             compress: true
           {{- end }}
-          {{- if has $worker (list "typing" "to_device" "account_data" "presence" "push_rules" "receipts" "device_lists" "thread_subscriptions" "quarantined_media" "event_persister" "sync" "client_reader" "user_dir") }}
+          {{- if has $worker $clientOnlyWorkers }}
           - names: [client]
             compress: true
           {{- end }}
-          {{- if has $worker (list "media_repository" "media_repository_background_jobs") }}
+          {{- if has $worker $mediaWorkers }}
           - names: [media]
             compress: false
           {{- end }}
-      {{- if has $worker (list "master" "typing" "to_device" "account_data" "presence" "push_rules" "receipts" "device_lists" "thread_subscriptions" "quarantined_media" "event_persister" "federation_sender") }}
+      {{- if has $worker $replicationWorkers }}
       - port: 9093
         tls: false
         type: http
@@ -223,7 +234,7 @@ stringData:
     run_background_tasks_on: synapse-background-worker-0
     log_config: /data/log.config
     macaroon_secret_key: "{{ $macaroon_secret_key }}"
-    {{- if has $worker (list "media_repository" "media_repository_background_jobs") }}
+    {{- if has $worker $mediaWorkers }}
     enable_media_repo: true
     media_storage_providers: {{ toYaml $media_storage_providers | nindent 6 }}
     {{- else }}
@@ -233,11 +244,11 @@ stringData:
     media_store_path: /tmp/media_store
     enable_local_media_storage: true
     metrics_flags: ~
-    oidc_providers: {{ $oidc_providers | toYaml | nindent 6 }}
+    oidc_providers: {{ toYaml $oidc_providers | nindent 6 }}
     old_signing_keys: ~
     password_config:
       enabled: {{ $password_enabled }}
-    password_providers: {{- $password_providers | toYaml | nindent 6 }}
+    password_providers: {{ toYaml $password_providers | nindent 6 }}
     pid_file: /tmp/homeserver.pid
     push: ~
     start_pushers: False

charts/synapse/templates/synapse-workers-pdb.yaml

@@ -1,5 +1,5 @@
 {{- if .Values.synapse.deployScalingWorkersPdb.enabled }}
-{{/* deployScalingWorkers: replicas >= 1, minAvailable:1 allows rolling updates */}}
+{{/* deployScalingWorkers: replicas>1 → minAvailable:1; replicas=1 → maxUnavailable:1 allows node drain */}}
 {{- range $worker, $options := .Values.synapse.deployScalingWorkers }}
 {{ $name := $worker | replace "_" "-" }}
 ---
@@ -8,11 +8,15 @@ kind: PodDisruptionBudget
 metadata:
   name: synapse-{{ $name }}
 spec:
+  {{- if gt ($options.replicas | int) 1 }}
   {{- if and $.Values.synapse.deployScalingWorkersPdb.minAvailable (not (hasKey $.Values.synapse.deployScalingWorkersPdb "maxUnavailable")) }}
   minAvailable: {{ $.Values.synapse.deployScalingWorkersPdb.minAvailable }}
   {{- else if $.Values.synapse.deployScalingWorkersPdb.maxUnavailable }}
   maxUnavailable: {{ $.Values.synapse.deployScalingWorkersPdb.maxUnavailable }}
   {{- end }}
+  {{- else }}
+  maxUnavailable: 1
+  {{- end }}
   selector:
     matchLabels:
       {{- include "synapse-workers.selectorLabels" $name | nindent 6 }}

charts/synapse/templates/well-known-configmap.yaml

@@ -22,7 +22,7 @@ data:
       "m.homeserver": {
         "base_url": "https://{{ .Values.synapse.serverName }}"
       },
-      {{- if .Values.experimentalFeatures.msc2965.enabled }}
+      {{- if or .Values.experimentalFeatures.msc2965.enabled .Values.matrixAuthentication.enabled }}
       "org.matrix.msc2965.authentication": {
         "issuer": "https://{{ .Values.matrixAuthentication.ingress.host }}/",
         "account": "https://{{ .Values.matrixAuthentication.ingress.host }}/account"

charts/synapse/values.yaml

@@ -78,8 +78,7 @@ synapse:
     # also this ghcr contains synapse:v1.146.0-e2e-optimized with e2e_room_key query patches
     tag: "v1.149.1"
     pullPolicy: IfNotPresent
-  autoscaling:
-    enabled: true
+  disablePgBouncerForStreamWriters: false
   nodeSelector: {}
   tolerations: []
   affinity: {}
@@ -394,6 +393,8 @@ experimentalFeatures:
   msc3967:
     enabled: true
   # msc2965 will be enabled with msc3861
+  msc2965:
+    enabled: true
   msc3861:
     # TODO: enabled by matrixAuthentication.enabled, deprecated section
     issuer: NOT-CONFIGURED
@@ -443,6 +444,7 @@ ingress:
   # source: room.py:1472 client_patterns("/rooms/.*/typing/...", v1=True) -> (api/v1|r0|v3|unstable)
   typing:
     #- "/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/typing"
+    # this is hack to make this regexp longer, because ImplementationSpecific chose longest if both match
     - "/_matrix/client/(api/v1|r0|v3|unstable)/rooms/(?:%21|!)[A-Za-z0-9._=\\-]+(?::|%3[Aa])[A-Za-z0-9.\\-]+/typing"
   # https://matrix-org.github.io/synapse/latest/workers.html#the-to_device-stream
   # routes to to_device stream writer singleton worker
@@ -625,7 +627,6 @@ admin:
       cloud.google.com/neg: '{"ingress":false}'
 
 envoyProxy:
-  enabled: true
   admin:
     port: 9901
   metrics: true