chore(container): update image ghcr.io/element-hq/ess-helm/matrix-stack ( 26.3.0 → 26.3.1 ) - #1445
Merged
Mafyuh merged 1 commit intoMar 29, 2026
Conversation
…ck ( 26.3.0 → 26.3.1 )
Mafyuh
deleted the
renovate/ghcr.io-element-hq-ess-helm-matrix-stack-26.x
branch
March 29, 2026 00:47
--- kubernetes/apps/matrix/app Kustomization: matrix/matrix OCIRepository: matrix/matrix
+++ kubernetes/apps/matrix/app Kustomization: matrix/matrix OCIRepository: matrix/matrix
@@ -11,9 +11,9 @@
spec:
interval: 15m
layerSelector:
mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
operation: copy
ref:
- tag: 26.3.0
+ tag: 26.3.1
url: oci://ghcr.io/element-hq/ess-helm/matrix-stack
|
--- HelmRelease: matrix/matrix ConfigMap: matrix/matrix-element-admin
+++ HelmRelease: matrix/matrix ConfigMap: matrix/matrix-element-admin
@@ -1,81 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
- labels:
- app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/part-of: matrix-stack
- app.kubernetes.io/component: matrix-admin-client
- app.kubernetes.io/name: element-admin
- app.kubernetes.io/instance: matrix-element-admin
- name: matrix-element-admin
- namespace: matrix
-data:
- default.conf: |
- # Built from https://github.com/element-hq/element-admin/blob/main/docker/nginx.conf
- # * /health added for k8s
- # * setting a charset
- # * setting error_page
- # * listening on IPv6
- # * setting server_name
- # * adding 'Cache-Control: no-cache' to root
- # * ensuring security headers are applied even where there's location blocks
- server {
- listen 8080;
- listen [::]:8080 ipv6only=on;
- server_name localhost;
-
- root /dist; # noqa
- index index.html;
- charset utf-8;
-
- # Enable gzip compression
- gzip on;
- gzip_static on;
-
- # Cache static assets
- location /assets {
- expires 1y;
- add_header Cache-Control "public, max-age=31536000, immutable";
- include /etc/nginx/security_headers.conf;
- }
-
- include /etc/nginx/security_headers.conf;
-
- # Set no-cache for the index.html
- # so that browsers always check for a new copy of Element Admin.
- # NB http://your-domain/ and http://your-domain/? are also covered by this
- location / {
- add_header Cache-Control "no-cache";
- index /index.runtime.html /index.html;
- try_files $uri $uri/ /;
- include /etc/nginx/security_headers.conf;
- }
-
- location = /health {
- allow all;
- default_type 'application/json';
- return 200 '{"status": "ok"}';
- }
- # redirect server error pages to the static page /50x.html
- #
- error_page 500 502 503 504 /50x.html;
- }
- http_customisations.conf: |
- server_tokens off;
- set_real_ip_from 0.0.0.0/0;
- set_real_ip_from ::/0;
- real_ip_header X-Forwarded-For;
- security_headers.conf: |
- # Copyright 2025 New Vector Ltd
- # Copyright 2025 Element Creations Ltd
- # SPDX-License-Identifier: AGPL-3.0-only
-
- add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' blob: data:; font-src 'self'; connect-src *; object-src 'none'; media-src 'self'; child-src 'none'; worker-src 'self'; manifest-src 'self';" always;
- add_header X-Content-Type-Options "nosniff" always;
- add_header X-Frame-Options "DENY" always;
- add_header X-Robots-Tag "noindex, nofollow, noarchive, noimageindex" always;
- add_header X-XSS-Protection "1; mode=block" always;
- add_header Referrer-Policy "strict-origin-when-cross-origin" always;
- add_header Permissions-Policy "geolocation=(), camera=(), microphone=(), payment=(), usb=(), magnetometer=(), accelerometer=(), gyroscope=()" always;
-
--- HelmRelease: matrix/matrix ConfigMap: matrix/matrix-element-web-nginx
+++ HelmRelease: matrix/matrix ConfigMap: matrix/matrix-element-web-nginx
@@ -26,13 +26,14 @@
root /usr/share/nginx/html; # noqa
index index.html;
charset utf-8;
include /etc/nginx/security_headers.conf;
- # Set no-cache for the version, config and index.html
+ # Set no-cache for the version, config, i18n and index.html
+ # As in https://github.com/element-hq/element-web/tree/develop/apps/web#caching-requirements
# so that browsers always check for a new copy of Element Web.
# NB http://your-domain/ and http://your-domain/? are also covered by this
location = /index.html {
add_header Cache-Control "no-cache";
include /etc/nginx/security_headers.conf;
@@ -42,12 +43,16 @@
include /etc/nginx/security_headers.conf;
}
# covers config.json and config.hostname.json requests as it is prefix.
location /config {
# Serving /app/config.json as per https://github.com/element-hq/element-web/blob/v1.11.97/docker/docker-entrypoint.d/18-load-element-modules.sh#L15
root /tmp/element-web-config;
+ add_header Cache-Control "no-cache";
+ include /etc/nginx/security_headers.conf;
+ }
+ location = /i18n {
add_header Cache-Control "no-cache";
include /etc/nginx/security_headers.conf;
}
location /modules {
alias /modules;
}
--- HelmRelease: matrix/matrix ConfigMap: matrix/matrix-synapse
+++ HelmRelease: matrix/matrix ConfigMap: matrix/matrix-synapse
@@ -18,12 +18,18 @@
require_auth_for_profile_requests: true
federation_client_minimum_tls_version: '1.2'
experimental_features:
msc4028_push_encrypted_events: true
+
+ database:
+ args:
+ # Synapse has no defaults, so up from Twisted's defaults of 3-5
+ cp_min: 5
+ cp_max: 10
# The maximum allowed duration by which sent events can be delayed, as
# per MSC4140.
max_event_delay_duration: 24h
rc_message:
# This needs to match at least e2ee key sharing frequency plus a bit of headroom
@@ -47,13 +53,13 @@
database:
name: psycopg2
args:
user: matrix
password: ${SYNAPSE_POSTGRES_PASSWORD}
- database: matrix
+ dbname: matrix
host: pg-cluster-primary.databases.svc.cluster.local
port: 5432
sslmode: prefer
application_name: ${APPLICATION_NAME}
keepalives: 1
--- HelmRelease: matrix/matrix ConfigMap: matrix/matrix-synapse-haproxy
+++ HelmRelease: matrix/matrix ConfigMap: matrix/matrix-synapse-haproxy
@@ -26,8 +26,8 @@
# A map file that is used in haproxy config to map from matrix paths to the
# named backend. The format is: path_regexp backend_name
path_map_file_get: |
# A map file that is used in haproxy config to map from matrix paths to the
# named backend. The format is: path_regexp backend_name
ess-version.json: |
- {"version": "26.3.0", "edition": "community"}
+ {"version": "26.3.1", "edition": "community"}
--- HelmRelease: matrix/matrix Deployment: matrix/matrix-element-admin
+++ HelmRelease: matrix/matrix Deployment: matrix/matrix-element-admin
@@ -5,13 +5,12 @@
labels:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/part-of: matrix-stack
app.kubernetes.io/component: matrix-admin-client
app.kubernetes.io/name: element-admin
app.kubernetes.io/instance: matrix-element-admin
- k8s.element.io/element-admin-config-hash: 6b669cd646bf3a19cda81458eb79e5295db17683
name: matrix-element-admin
namespace: matrix
spec:
replicas: 1
selector:
matchLabels:
@@ -26,13 +25,12 @@
labels:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/part-of: matrix-stack
app.kubernetes.io/component: matrix-admin-client
app.kubernetes.io/name: element-admin
app.kubernetes.io/instance: matrix-element-admin
- k8s.element.io/element-admin-config-hash: 6b669cd646bf3a19cda81458eb79e5295db17683
spec:
automountServiceAccountToken: false
serviceAccountName: matrix-element-admin
securityContext:
fsGroup: 10104
runAsGroup: 10104
@@ -50,13 +48,13 @@
- pod-template-hash
maxSkew: 1
topologyKey: kubernetes.io/hostname
whenUnsatisfiable: ScheduleAnyway
containers:
- name: element-admin
- image: oci.element.io/element-admin:0.1.10
+ image: oci.element.io/element-admin:0.1.11
imagePullPolicy: Always
env:
- name: SERVER_NAME
value: mafyuh.dev
securityContext:
allowPrivilegeEscalation: false
@@ -99,29 +97,13 @@
limits:
memory: 200Mi
requests:
cpu: 50m
memory: 50Mi
volumeMounts:
- - mountPath: /etc/nginx/conf.d/default.conf
- name: nginx-config
- readOnly: true
- subPath: default.conf
- - mountPath: /etc/nginx/conf.d/http_customisations.conf
- name: nginx-config
- readOnly: true
- subPath: http_customisations.conf
- - mountPath: /etc/nginx/security_headers.conf
- name: nginx-config
- readOnly: true
- subPath: security_headers.conf
- mountPath: /tmp
name: nginx-tmp
volumes:
- - configMap:
- defaultMode: 420
- name: matrix-element-admin
- name: nginx-config
- emptyDir:
medium: Memory
name: nginx-tmp
--- HelmRelease: matrix/matrix Deployment: matrix/matrix-element-web
+++ HelmRelease: matrix/matrix Deployment: matrix/matrix-element-web
@@ -6,13 +6,13 @@
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/part-of: matrix-stack
app.kubernetes.io/component: matrix-client
app.kubernetes.io/name: element-web
app.kubernetes.io/instance: matrix-element-web
k8s.element.io/element-web-config-hash: 39c600d44063f611cf16b5c501fe4f3b3e6e37db
- k8s.element.io/nginx-config-hash: ebf74e60cb1f5e455ca5140db2681c39df455fd6
+ k8s.element.io/nginx-config-hash: d86911f8422803691910ecb4322f42fc597a40b8
name: matrix-element-web
namespace: matrix
spec:
replicas: 1
selector:
matchLabels:
@@ -28,13 +28,13 @@
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/part-of: matrix-stack
app.kubernetes.io/component: matrix-client
app.kubernetes.io/name: element-web
app.kubernetes.io/instance: matrix-element-web
k8s.element.io/element-web-config-hash: 39c600d44063f611cf16b5c501fe4f3b3e6e37db
- k8s.element.io/nginx-config-hash: ebf74e60cb1f5e455ca5140db2681c39df455fd6
+ k8s.element.io/nginx-config-hash: d86911f8422803691910ecb4322f42fc597a40b8
spec:
automountServiceAccountToken: false
serviceAccountName: matrix-element-web
securityContext:
fsGroup: 10004
runAsGroup: 10004
@@ -52,13 +52,13 @@
- pod-template-hash
maxSkew: 1
topologyKey: kubernetes.io/hostname
whenUnsatisfiable: ScheduleAnyway
containers:
- name: element-web
- image: oci.element.io/element-web:v1.12.12
+ image: oci.element.io/element-web:v1.12.13
imagePullPolicy: Always
env:
- name: NGINX_ENVSUBST_TEMPLATE_DIR
value: /non-existant-so-that-this-works-with-read-only-root-filesystem
securityContext:
allowPrivilegeEscalation: false
--- HelmRelease: matrix/matrix Deployment: matrix/matrix-haproxy
+++ HelmRelease: matrix/matrix Deployment: matrix/matrix-haproxy
@@ -6,13 +6,13 @@
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/part-of: matrix-stack
app.kubernetes.io/component: matrix-stack-ingress
app.kubernetes.io/name: haproxy
app.kubernetes.io/instance: matrix-haproxy
k8s.element.io/shared-haproxy-config-hash: 157f64e28cdb73779dac61c7ef5a3923627052db
- k8s.element.io/synapse-haproxy-config-hash: 0211e35d1fe34246f73e341707881590decf82a8
+ k8s.element.io/synapse-haproxy-config-hash: 7f5875914c0a9f26689e357403574b72afab6eb3
k8s.element.io/wellknowndelegation-haproxy-config-hash: b646e9a755fc2e69170a9cc207ae2f4ec31ad09a
name: matrix-haproxy
namespace: matrix
spec:
replicas: 1
selector:
@@ -29,13 +29,13 @@
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/part-of: matrix-stack
app.kubernetes.io/component: matrix-stack-ingress
app.kubernetes.io/name: haproxy
app.kubernetes.io/instance: matrix-haproxy
k8s.element.io/shared-haproxy-config-hash: 157f64e28cdb73779dac61c7ef5a3923627052db
- k8s.element.io/synapse-haproxy-config-hash: 0211e35d1fe34246f73e341707881590decf82a8
+ k8s.element.io/synapse-haproxy-config-hash: 7f5875914c0a9f26689e357403574b72afab6eb3
k8s.element.io/wellknowndelegation-haproxy-config-hash: b646e9a755fc2e69170a9cc207ae2f4ec31ad09a
spec:
automountServiceAccountToken: false
serviceAccountName: matrix-haproxy
securityContext:
fsGroup: 10001
--- HelmRelease: matrix/matrix Deployment: matrix/matrix-matrix-authentication-service
+++ HelmRelease: matrix/matrix Deployment: matrix/matrix-matrix-authentication-service
@@ -118,13 +118,13 @@
cpu: 50m
memory: 50Mi
- name: database-migrate
args:
- database
- migrate
- image: ghcr.io/element-hq/matrix-authentication-service:1.13.0
+ image: ghcr.io/element-hq/matrix-authentication-service:1.14.0
imagePullPolicy: Always
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
@@ -154,13 +154,13 @@
readOnly: true
containers:
- name: matrix-authentication-service
args:
- server
- --no-migrate
- image: ghcr.io/element-hq/matrix-authentication-service:1.13.0
+ image: ghcr.io/element-hq/matrix-authentication-service:1.14.0
imagePullPolicy: Always
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
--- HelmRelease: matrix/matrix StatefulSet: matrix/matrix-synapse-main
+++ HelmRelease: matrix/matrix StatefulSet: matrix/matrix-synapse-main
@@ -6,13 +6,13 @@
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/part-of: matrix-stack
app.kubernetes.io/component: matrix-server
app.kubernetes.io/name: synapse-main
app.kubernetes.io/instance: matrix-synapse-main
k8s.element.io/synapse-instance: matrix-synapse
- k8s.element.io/synapse-config-hash: 17f7f56ca9a4e6993e26cfecfbabea7278cf9964
+ k8s.element.io/synapse-config-hash: 291c9698a4aa58ab33b20c8d4ce1ac35d32693df
k8s.element.io/synapse-secret-hash: 14a87e3164288500c1ad5518288100d54ed0a160
k8s.element.io/postgres-password-synapse-hash: 339761d619fb445ebe76f44f4d63176d2d223a54
name: matrix-synapse-main
namespace: matrix
spec:
replicas: 1
@@ -29,13 +29,13 @@
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/part-of: matrix-stack
app.kubernetes.io/component: matrix-server
app.kubernetes.io/name: synapse-main
app.kubernetes.io/instance: matrix-synapse-main
k8s.element.io/synapse-instance: matrix-synapse
- k8s.element.io/synapse-config-hash: 17f7f56ca9a4e6993e26cfecfbabea7278cf9964
+ k8s.element.io/synapse-config-hash: 291c9698a4aa58ab33b20c8d4ce1ac35d32693df
k8s.element.io/synapse-secret-hash: 14a87e3164288500c1ad5518288100d54ed0a160
k8s.element.io/postgres-password-synapse-hash: 339761d619fb445ebe76f44f4d63176d2d223a54
spec:
automountServiceAccountToken: false
serviceAccountName: matrix-synapse
securityContext:
@@ -121,13 +121,13 @@
memory: 4Gi
requests:
cpu: 100m
memory: 100Mi
containers:
- name: synapse
- image: oci.element.io/synapse:v1.149.1-ess.1
+ image: oci.element.io/synapse:v1.150.0
imagePullPolicy: Always
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
--- HelmRelease: matrix/matrix ConfigMap: matrix/matrix-synapse-hook
+++ HelmRelease: matrix/matrix ConfigMap: matrix/matrix-synapse-hook
@@ -21,12 +21,18 @@
require_auth_for_profile_requests: true
federation_client_minimum_tls_version: '1.2'
experimental_features:
msc4028_push_encrypted_events: true
+
+ database:
+ args:
+ # Synapse has no defaults, so up from Twisted's defaults of 3-5
+ cp_min: 5
+ cp_max: 10
# The maximum allowed duration by which sent events can be delayed, as
# per MSC4140.
max_event_delay_duration: 24h
rc_message:
# This needs to match at least e2ee key sharing frequency plus a bit of headroom
@@ -50,13 +56,13 @@
database:
name: psycopg2
args:
user: matrix
password: ${SYNAPSE_POSTGRES_PASSWORD}
- database: matrix
+ dbname: matrix
host: pg-cluster-primary.databases.svc.cluster.local
port: 5432
sslmode: prefer
application_name: ${APPLICATION_NAME}
keepalives: 1
--- HelmRelease: matrix/matrix Job: matrix/matrix-synapse-check-config
+++ HelmRelease: matrix/matrix Job: matrix/matrix-synapse-check-config
@@ -11,13 +11,13 @@
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/part-of: matrix-stack
app.kubernetes.io/component: matrix-server
app.kubernetes.io/name: synapse-check-config
app.kubernetes.io/instance: matrix-synapse-check-config
k8s.element.io/synapse-instance: matrix-synapse-check-config
- k8s.element.io/synapse-config-hash: 17f7f56ca9a4e6993e26cfecfbabea7278cf9964
+ k8s.element.io/synapse-config-hash: 291c9698a4aa58ab33b20c8d4ce1ac35d32693df
k8s.element.io/synapse-secret-hash: 14a87e3164288500c1ad5518288100d54ed0a160
k8s.element.io/postgres-password-synapse-hash: 339761d619fb445ebe76f44f4d63176d2d223a54
spec:
backoffLimit: 0
completionMode: NonIndexed
completions: 1
@@ -30,13 +30,13 @@
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/part-of: matrix-stack
app.kubernetes.io/component: matrix-server
app.kubernetes.io/name: synapse-check-config
app.kubernetes.io/instance: matrix-synapse-check-config
k8s.element.io/synapse-instance: matrix-synapse-check-config
- k8s.element.io/synapse-config-hash: 17f7f56ca9a4e6993e26cfecfbabea7278cf9964
+ k8s.element.io/synapse-config-hash: 291c9698a4aa58ab33b20c8d4ce1ac35d32693df
k8s.element.io/synapse-secret-hash: 14a87e3164288500c1ad5518288100d54ed0a160
k8s.element.io/postgres-password-synapse-hash: 339761d619fb445ebe76f44f4d63176d2d223a54
spec:
automountServiceAccountToken: false
serviceAccountName: matrix-synapse-check-config
securityContext:
@@ -81,16 +81,16 @@
value: '{{ hostname }}'
- name: SYNAPSE_POSTGRES_PASSWORD
value: '{{ readfile "/secrets/pg-cluster-pguser-matrix/password" | quote
}}'
resources:
limits:
- memory: 4Gi
+ memory: 200Mi
requests:
- cpu: 100m
- memory: 100Mi
+ cpu: 50m
+ memory: 50Mi
volumeMounts:
- mountPath: /config-templates
name: plain-config
readOnly: true
- mountPath: /secrets/matrix-synapse-hook
name: secret-8902a28799c0
@@ -103,13 +103,13 @@
readOnly: true
- mountPath: /conf
name: rendered-config
readOnly: false
containers:
- name: synapse
- image: oci.element.io/synapse:v1.149.1-ess.1
+ image: oci.element.io/synapse:v1.150.0
imagePullPolicy: Always
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
@@ -122,16 +122,16 @@
- /conf/homeserver.yaml
env:
- name: LD_PRELOAD
value: libjemalloc.so.2
resources:
limits:
- memory: 4Gi
+ memory: 200Mi
requests:
- cpu: 100m
- memory: 100Mi
+ cpu: 50m
+ memory: 50Mi
volumeMounts:
- mountPath: /conf/homeserver.yaml
name: rendered-config
subPath: homeserver.yaml
readOnly: true
- mountPath: /secrets/matrix-synapse-hook |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
26.3.0→26.3.1Release Notes
element-hq/ess-helm (ghcr.io/element-hq/ess-helm/matrix-stack)
v26.3.1Compare Source
Changed
Synapse: Change
database.args.databaseand replace withdatabase.args.dbname. (#1151)Upgrade Element Admin to v0.1.11.
Highlights:
ModerationtoSupervisionnginxconfigurationFull Changelogs:
(#1170)
Raise the default size of Synapse's connection pool.
Goes from 3-5 (min-max) to 5-10.
These settings can be overridden with additional Synapse configuration. (#1171)
Upgrade Element Web to v1.12.13.
Highlights:
Full Changelogs:
(#1173)
Allow configuration of the resources for Synapse's check config
Job.Rather than using the resources for the Synapse
mainprocess. (#1174)Upgrade Synapse to v1.150.0.
Highlights:
/versionsand/auth_metadatapublic endpointsFull Changelogs:
(#1175)
Upgrade Matrix Authentication Service to v1.14.0.
Highlights:
lockedflag to SynapseFull Changelogs:
(#1176)
Fixed
Cache-Controlheader on/i18n. (#1167)Documentation
ess-migration-toolcommand. (#1147)Internal
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.