try to fix federation reader route conflict

Author: shcherbak

charts/synapse/Chart.yaml

@@ -2,5 +2,5 @@
 apiVersion: v2
 name: synapse
 description: matrix synapse kubernetes deployment
-version: 2.1.0
+version: 2.1.1
 appVersion: 1.149.1

charts/synapse/values.yaml

@@ -434,7 +434,7 @@ ingress:
     - "/_matrix/client/(unstable|v1)/org.matrix.msc4108/rendezvous$"
     - "/_synapse/client/rendezvous$"
     # federation overrides to main/master process
-    - "/_matrix/federation/v1/openid/userinfo$"
+    #- "/_matrix/federation/v1/openid/userinfo$"
   # send all other traffic to the main/master process, should go last in lb config
   masterRoutes:
     - "/_matrix/"
@@ -576,8 +576,15 @@ ingress:
     # source: no specific password_policy file found; workers.md:276 documents (r0|v3|unstable)
     - "/_matrix/client/(r0|v3|unstable)/password_policy$"
   federationReaderRoutes:
-    # broad pattern - must be LAST to avoid shadowing more specific routes above
-    - "/_matrix/(federation/(v1|v2)|key/v2)/"
+    # original:
+    # - "/_matrix/(federation/(v1|v2)|key/v2)/"
+    # NGINX ingress sorts ImplementationSpecific regex paths by string length (longer = higher priority).
+    # This pattern (56 chars) is tried before shorter routes, so negative lookaheads are required to
+    # prevent shadowing:
+    #   - (?!/(media|openid)) excludes:
+    #       /_matrix/federation/v1/media/   (29 chars) → must go to synapse-media-repository
+    #       /_matrix/federation/v1/openid/  (37 chars) → must go to synapse-master (masterOverridesRoutes)
+    - "/_matrix/(federation/(v1|v2)(?!/(media|openid))|key/v2)/"
   # enabled if MAS is enabled, mutually exclusive with clientReaderRegister
   # source: login.py:76,588 logout.py:38,65
   # Fixed: explicit version prefixes instead of greedy (.*) to avoid matching subpaths unexpectedly