Run the MatrixRTC Authorisation Service as an application service by barodeur · Pull Request #1626 · element-hq/ess-helm

barodeur · 2026-09-30T16:05:20Z

This PR adds a test for the delegation of the MSC4140 delayed leave event to the MatrixRTC Authorisation Service (lk-jwt-service), through /get_token as Element Call does it. Today the service restarts and sends that event on behalf of the user without any authentication.

Delayed event management requests will have to be authenticated as soon as element-hq/synapse#20257 lands. The service will then need credentials to act for a user, which it gets by running as an application service and asserting the user (?user_id=).

This PR configures that, the same way Hookshot is wired.

What this PR unblocks

In this order:

Pinning an lk-jwt-service release with MSC4140: authenticate delegated delayed leave management calls, and document the appservice requirement lk-jwt-service#240. lk-jwt-service 0.7.0 only authenticates on the endpoints Synapse proxies to it. That change makes it authenticate on /get_token too, which is what the /get_token test added here goes through. It needs the registration this PR provides.
Pinning a Synapse release with MSC4140: authenticate the delayed event management endpoints and allow guests synapse#20257. It needs both of the above, otherwise that test fails.

Changes

New matrixRTC.appserviceRegistration credential. When serverName is set and the credential isn't provided, initSecrets generates it from configs/matrix-rtc/registration.yaml.tpl:
- sender_localpart from the new matrixRTC.user.localpart value (default _lk_jwt_service), like hookshot.user.localpart;
- non-exclusive users namespace covering the local users (@.*:<serverName>, like the registrations of the ESS Pro bots), so the service can act for any of them;
- url: null, so no transactions are pushed to it;
- io.element.msc4502.scopes: [urn:matrix:client:io.element.msc4502:rooms:is_joined], to check room membership without joining;
- io.element.msc4512.proxy_prefix: rtc/livekit and io.element.msc4512.proxy_url pointing at the authorisation service Service.
Synapse loads the registration (app_service_config_files) and enables msc4502_enabled and msc4512_enabled. Any process with a client or federation listener serves the MSC4512 proxy, so the worker routing doesn't change.
When Synapse isn't deployed by the chart, the homeserver must load the registration, e.g. copied from the generated Secret. If it doesn't run in the same cluster, io.element.msc4512.proxy_url must be changed, or both io.element.msc4512.* keys removed.
The authorisation service gets LIVEKIT_AS_REGISTRATION_FILE and LIVEKIT_HS_SERVER_NAME. LIVEKIT_FULL_ACCESS_HOMESERVERS and LIVEKIT_CS_API_URL_OVERRIDES stay, because the non-proxied routes still use them.
A registration provided inline (matrixRTC.appserviceRegistration.value) is templated, so it can refer to the release, e.g. {{ $.Release.Name }} in its proxy_url. It is also written to a -pre hook Secret, so Synapse's check-config and syn2mas hooks can load it.

The registration uses the key names Synapse parses (read in v1.161.0, deployed on v1.162.0). Synapse silently ignores the keys used in the lk-jwt-service README example (scopes, io.element.msc4502.scope, proxy_prefix, proxy_url).

Requirements and upgrade notes

Important

Adding the first appservice to a Synapse makes it replay its whole event history once

Synapse only advances its appservice stream position while an appservice is registered. On the first start with this registration, it walks every event since the database was created, 100 at a time. The problem is similar to element-hq/synapse#11629.

element-hq/synapse#20273 addresses it. With that change, Synapse no longer gathers events for a registration with url: null, so this one causes neither a replay nor any ongoing per-event work. Until the chart pins a Synapse release that includes it, deployments without another appservice go through the replay once. It would be better to merge this PR after that.

Synapse ≥ 1.161.0, the first release with MSC4512 proxying. msc4502_enabled has existed since 1.160.0. The chart pins v1.162.0.
initSecrets disabled with serverName set: matrixRTC.appserviceRegistration must now be provided, inline or as an existing Secret, otherwise the chart fails to render.
Synapse not deployed by the chart, with serverName set: the service now runs as an application service with a registration the homeserver doesn't know yet. Nothing changes with lk-jwt-service 0.7.0, but the homeserver must load the registration before the chart pins an lk-jwt-service release with MSC4140: authenticate delegated delayed leave management calls, and document the appservice requirement lk-jwt-service#240, otherwise delegated leave stops working.
Providing your own registration: include the MSC4502 scope and the MSC4512 proxy keys from configs/matrix-rtc/registration.yaml.tpl, with your own tokens and proxy_url. Without them, membership checks and proxying don't work.
Already registered lk-jwt-service by hand (in synapse.appservices, plus matrixRTC.extraEnv/extraVolumes): move that registration to matrixRTC.appserviceRegistration, and remove it from synapse.appservices and the extra env/volumes. If you don't:
- if it sets io.element.msc4512.proxy_prefix, Synapse refuses two registrations claiming rtc/livekit, so the check-config hook fails and the upgrade aborts before anything changes;
- otherwise the upgrade goes through and the chart's environment overrides extraEnv, so the service switches to the generated registration. Yours stays loaded in Synapse but unused, and adds its own per-event matching cost.

…elayed leave The only MatrixRTC request covered so far was the deprecated /sfu/get. Cover /get_token, together with the delegation of the MSC4140 delayed leave event to the authorisation service, the way Element Call does it today: with the token request. The user never connects to the SFU, so the service gives up waiting after `delay_timeout` and sends the leave event itself, which the test then finds in the room. The service calls Synapse's delayed event management endpoints without authentication here. This test will fail if the chart pins a Synapse which requires authentication on them before the service is able to authenticate.

The MatrixRTC Authorisation Service needs an application service registration to authenticate to the homeserver and act on behalf of users. It is generated by initSecrets when Synapse is deployed by the chart, and optional otherwise.

Synapse is about to require an access token on the MSC4140 delayed event management endpoints. The authorisation service restarts and sends delayed leave events on behalf of users, so it needs to authenticate as an application service and assert the user. When Synapse is deployed by the chart, initSecrets generates the registration (unless provided) and Synapse loads it, with the MSC4502 (room membership queries) and MSC4512 (rtc/livekit proxying) experimental features enabled. The registration uses the key names Synapse 1.161.0 parses: io.element.msc4502.scopes and io.element.msc4512.proxy_prefix/proxy_url. The authorisation service gets LIVEKIT_AS_REGISTRATION_FILE and LIVEKIT_HS_SERVER_NAME. When Synapse isn't deployed by the chart, this only happens if a registration is provided, as the chart can't register it with an external homeserver. A registration provided inline is also put in a hook Secret so that Synapse's check-config hook can load it.

Cover the generated registration and its contents, Synapse loading it with the MSC4502 and MSC4512 experimental features, the authorisation service environment, and registrations provided inline, via an existing Secret, or without the chart's Synapse. Add synapse-matrix-rtc-secrets-{in-helm,externally} values files so the generic manifest tests also run with a provided registration.

…n appservice

Request a LiveKit token through the endpoint Synapse proxies to the authorisation service (MSC4512), for a user joined to the room and for one who isn't. This covers the generated registration being loaded by Synapse, the proxying, and the room membership check the service makes with its as_token (MSC4502). Delegate a delayed leave event through the proxied endpoint for a user who never connects to the SFU, and check the service sends it on the user's behalf. This covers the MSC4140 management calls made as an application service asserting the user. Both are skipped in the first step of the upgrade tests, which deploys the chart of the latest release.

github-actions · 2026-09-30T16:07:31Z

dyff of changes in rendered templates of CI manifests

Full contents of manifests and dyffs are available in https://github.com/element-hq/ess-helm/actions/runs/37763904321/artifacts/11542889840

all-enabled-values.yaml

@@ ConfigMap/ess-ci/release-name-init-secrets - data @@
+   matrix-rtc-registration.yaml: |
+     id: matrix-rtc-authorisation-service
+     as_token: "${AS_TOKEN}"
+     hs_token: "${HS_TOKEN}"
+     sender_localpart: _lk_jwt_service
+     # The service asserts the identity of the local users it acts for (e.g. MSC4140 delayed leave events)
+     namespaces:
+       users:
+       - exclusive: false
+         regex: "@.*:ess.localhost"
+     # The service doesn't need any events pushed to it
+     url: null
+     # MSC4502: let the service check room memberships without joining the rooms
+     io.element.msc4502.scopes:
+     - "urn:matrix:client:io.element.msc4502:rooms:is_joined"
+     # MSC4512: Synapse proxies the rtc/livekit endpoints of the C-S and S-S APIs to the service
+     io.element.msc4512.proxy_prefix: rtc/livekit
+     io.element.msc4512.proxy_url: "http://release-name-matrix-rtc-authorisation-service.ess-ci.svc.cluster.local.:8080"



@@ ConfigMap/ess-ci/release-name-synapse-hook - data.04-homeserver-overrides.yaml @@
  public_baseurl: https://synapse.ess.localhost/
  server_name: ess.localhost
  signing_key_path: /secrets/release-name-generated/SYNAPSE_SIGNING_KEY
  enable_metrics: true
  
  [45 lines unchanged)]
  
    msc4143_enabled: true
    # MSC4222 needed for syncv2 state_after. This allow clients to
    # correctly track the state of the room.
    msc4222_enabled: true
+   # MSC4502 lets the MatrixRTC Authorisation Service check room memberships without joining the rooms
+   msc4502_enabled: true
+   # MSC4512 proxies the MatrixRTC Authorisation Service endpoints (rtc/livekit) on the C-S and S-S APIs
+   msc4512_enabled: true
    # MSCs required for Hookshot encryption support
    # https://matrix-org.github.io/matrix-hookshot/latest/advanced/encryption.html
    msc2409_to_device_messages_enabled: true
    msc3202_device_masquerading: true
  
  [eight lines unchanged)]
  
    - type: livekit
      livekit_service_url: https://mrtc.ess.localhost
  app_service_config_files:
  - /secrets/release-name-generated/HOOKSHOT_REGISTRATION
+ - /secrets/release-name-generated/MATRIX_RTC_REGISTRATION
  
  send_federation: true
  
  max_upload_size: "100M"
  
  [three lines unchanged)]
  
  instance_map:
    main:
      host: release-name-synapse-main.ess-ci.svc.cluster.local.
      port: 9093



@@ ConfigMap/ess-ci/release-name-synapse - data.04-homeserver-overrides.yaml @@
  public_baseurl: https://synapse.ess.localhost/
  server_name: ess.localhost
  signing_key_path: /secrets/release-name-generated/SYNAPSE_SIGNING_KEY
  enable_metrics: true
  
  [45 lines unchanged)]
  
    msc4143_enabled: true
    # MSC4222 needed for syncv2 state_after. This allow clients to
    # correctly track the state of the room.
    msc4222_enabled: true
+   # MSC4502 lets the MatrixRTC Authorisation Service check room memberships without joining the rooms
+   msc4502_enabled: true
+   # MSC4512 proxies the MatrixRTC Authorisation Service endpoints (rtc/livekit) on the C-S and S-S APIs
+   msc4512_enabled: true
    # MSCs required for Hookshot encryption support
    # https://matrix-org.github.io/matrix-hookshot/latest/advanced/encryption.html
    msc2409_to_device_messages_enabled: true
    msc3202_device_masquerading: true
  
  [eight lines unchanged)]
  
    - type: livekit
      livekit_service_url: https://mrtc.ess.localhost
  app_service_config_files:
  - /secrets/release-name-generated/HOOKSHOT_REGISTRATION
+ - /secrets/release-name-generated/MATRIX_RTC_REGISTRATION
  
  send_federation: true
  
  max_upload_size: "100M"
  
  [three lines unchanged)]
  
  instance_map:
    main:
      host: release-name-synapse-main.ess-ci.svc.cluster.local.
      port: 9093



@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env @@
+   - name: LIVEKIT_AS_REGISTRATION_FILE
+     value: /secrets/release-name-generated/MATRIX_RTC_REGISTRATION
+   - name: LIVEKIT_HS_SERVER_NAME
+     value: ess.localhost



@@ Job/ess-ci/release-name-init-secrets - spec.template.spec.containers.init-secrets.args @@
- - "release-name-generated:POSTGRES_SYNAPSE_PASSWORD:rand32,release-name-generated:POSTGRES_MATRIX_AUTHENTICATION_SERVICE_PASSWORD:rand32,release-name-generated:POSTGRES_ADMIN_PASSWORD:rand32,release-name-generated:ELEMENT_CALL_LIVEKIT_SECRET:rand32,release-name-generated:SYNAPSE_EXTRA:extra,release-name-generated:SYNAPSE_MACAROON:rand32,release-name-generated:SYNAPSE_REGISTRATION_SHARED_SECRET:rand32,release-name-generated:SYNAPSE_SIGNING_KEY:signingkey,release-name-generated:MAS_SYNAPSE_SHARED_SECRET:rand32,release-name-generated:MAS_ENCRYPTION_SECRET:randbytes:32:hex,release-name-generated:MAS_RSA_PRIVATE_KEY:rsa:4096:der,release-name-generated:MAS_ECDSA_PRIME256V1_PRIVATE_KEY:ecdsaprime256v1,release-name-generated:HOOKSHOT_REGISTRATION:registration:/registration-templates/hookshot-registration.yaml,release-name-generated:HOOKSHOT_RSA_PASSKEY:rsa:4096:pem"
+   - "release-name-generated:POSTGRES_SYNAPSE_PASSWORD:rand32,release-name-generated:POSTGRES_MATRIX_AUTHENTICATION_SERVICE_PASSWORD:rand32,release-name-generated:POSTGRES_ADMIN_PASSWORD:rand32,release-name-generated:ELEMENT_CALL_LIVEKIT_SECRET:rand32,release-name-generated:MATRIX_RTC_REGISTRATION:registration:/registration-templates/matrix-rtc-registration.yaml,release-name-generated:SYNAPSE_EXTRA:extra,release-name-generated:SYNAPSE_MACAROON:rand32,release-name-generated:SYNAPSE_REGISTRATION_SHARED_SECRET:rand32,release-name-generated:SYNAPSE_SIGNING_KEY:signingkey,release-name-generated:MAS_SYNAPSE_SHARED_SECRET:rand32,release-name-generated:MAS_ENCRYPTION_SECRET:randbytes:32:hex,release-name-generated:MAS_RSA_PRIVATE_KEY:rsa:4096:der,release-name-generated:MAS_ECDSA_PRIME256V1_PRIVATE_KEY:ecdsaprime256v1,release-name-generated:HOOKSHOT_REGISTRATION:registration:/registration-templates/hookshot-registration.yaml,release-name-generated:HOOKSHOT_RSA_PASSKEY:rsa:4096:pem"

example-default-enabled-components-checkov-values.yaml

@@ ConfigMap/ess-ci/release-name-init-secrets @@
+ ---
+ # Source: matrix-stack/templates/init-secrets/configmap.yaml
+ apiVersion: v1
+ kind: ConfigMap
+ metadata:
+   name: release-name-init-secrets
+   namespace: ess-ci
+   annotations:
+     "helm.sh/hook": pre-install,pre-upgrade
+     "helm.sh/hook-weight": "-11"
+   labels:
+     helm.sh/chart: "matrix-stack-26.9.5-dev"
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/part-of: matrix-stack
+     app.kubernetes.io/component: matrix-tools
+     app.kubernetes.io/name: init-secrets
+     app.kubernetes.io/instance: release-name-init-secrets
+     app.kubernetes.io/version: "0.10.3"
+ data:
+   matrix-rtc-registration.yaml: |
+     id: matrix-rtc-authorisation-service
+     as_token: "${AS_TOKEN}"
+     hs_token: "${HS_TOKEN}"
+     sender_localpart: _lk_jwt_service
+     # The service asserts the identity of the local users it acts for (e.g. MSC4140 delayed leave events)
+     namespaces:
+       users:
+       - exclusive: false
+         regex: "@.*:ess.localhost"
+     # The service doesn't need any events pushed to it
+     url: null
+     # MSC4502: let the service check room memberships without joining the rooms
+     io.element.msc4502.scopes:
+     - "urn:matrix:client:io.element.msc4502:rooms:is_joined"
+     # MSC4512: Synapse proxies the rtc/livekit endpoints of the C-S and S-S APIs to the service
+     io.element.msc4512.proxy_prefix: rtc/livekit
+     io.element.msc4512.proxy_url: "http://release-name-matrix-rtc-authorisation-service.ess-ci.svc.cluster.local.:8080"



@@ ConfigMap/ess-ci/release-name-synapse-hook - data.04-homeserver-overrides.yaml @@
  public_baseurl: https://synapse.ess.localhost/
  server_name: ess.localhost
  signing_key_path: /secrets/release-name-generated/SYNAPSE_SIGNING_KEY
  enable_metrics: true
  
  [45 lines unchanged)]
  
    msc4143_enabled: true
    # MSC4222 needed for syncv2 state_after. This allow clients to
    # correctly track the state of the room.
    msc4222_enabled: true
+   # MSC4502 lets the MatrixRTC Authorisation Service check room memberships without joining the rooms
+   msc4502_enabled: true
+   # MSC4512 proxies the MatrixRTC Authorisation Service endpoints (rtc/livekit) on the C-S and S-S APIs
+   msc4512_enabled: true
  
  password_config:
    localdb_enabled: false
    enabled: false
  
  [one line unchanged)]
  
  matrix_rtc:
    transports:
    - type: livekit
      livekit_service_url: https://mrtc.ess.localhost
+ app_service_config_files:
+ - /secrets/release-name-generated/MATRIX_RTC_REGISTRATION
  
  send_federation: true
  
  max_upload_size: "100M"
  
  [three lines unchanged)]
  
  instance_map:
    main:
      host: release-name-synapse-main.ess-ci.svc.cluster.local.
      port: 9093



@@ ConfigMap/ess-ci/release-name-synapse - data.04-homeserver-overrides.yaml @@
  public_baseurl: https://synapse.ess.localhost/
  server_name: ess.localhost
  signing_key_path: /secrets/release-name-generated/SYNAPSE_SIGNING_KEY
  enable_metrics: true
  
  [45 lines unchanged)]
  
    msc4143_enabled: true
    # MSC4222 needed for syncv2 state_after. This allow clients to
    # correctly track the state of the room.
    msc4222_enabled: true
+   # MSC4502 lets the MatrixRTC Authorisation Service check room memberships without joining the rooms
+   msc4502_enabled: true
+   # MSC4512 proxies the MatrixRTC Authorisation Service endpoints (rtc/livekit) on the C-S and S-S APIs
+   msc4512_enabled: true
  
  password_config:
    localdb_enabled: false
    enabled: false
  
  [one line unchanged)]
  
  matrix_rtc:
    transports:
    - type: livekit
      livekit_service_url: https://mrtc.ess.localhost
+ app_service_config_files:
+ - /secrets/release-name-generated/MATRIX_RTC_REGISTRATION
  
  send_federation: true
  
  max_upload_size: "100M"
  
  [three lines unchanged)]
  
  instance_map:
    main:
      host: release-name-synapse-main.ess-ci.svc.cluster.local.
      port: 9093



@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env @@
+   - name: LIVEKIT_AS_REGISTRATION_FILE
+     value: /secrets/release-name-generated/MATRIX_RTC_REGISTRATION
+   - name: LIVEKIT_HS_SERVER_NAME
+     value: ess.localhost



@@ Job/ess-ci/release-name-init-secrets - spec.template.spec @@
+   volumes:
+   - name: registration-templates
+     configMap:
+       name: release-name-init-secrets
+       defaultMode: 420

@@ Job/ess-ci/release-name-init-secrets - spec.template.spec.containers.init-secrets @@
+   volumeMounts:
+   - name: registration-templates
+     mountPath: /registration-templates
+     readOnly: true

@@ Job/ess-ci/release-name-init-secrets - spec.template.spec.containers.init-secrets.args @@
- - "release-name-generated:POSTGRES_SYNAPSE_PASSWORD:rand32,release-name-generated:POSTGRES_MATRIX_AUTHENTICATION_SERVICE_PASSWORD:rand32,release-name-generated:POSTGRES_ADMIN_PASSWORD:rand32,release-name-generated:ELEMENT_CALL_LIVEKIT_SECRET:rand32,release-name-generated:SYNAPSE_EXTRA:extra,release-name-generated:SYNAPSE_MACAROON:rand32,release-name-generated:SYNAPSE_REGISTRATION_SHARED_SECRET:rand32,release-name-generated:SYNAPSE_SIGNING_KEY:signingkey,release-name-generated:MAS_SYNAPSE_SHARED_SECRET:rand32,release-name-generated:MAS_ENCRYPTION_SECRET:randbytes:32:hex,release-name-generated:MAS_RSA_PRIVATE_KEY:rsa:4096:der,release-name-generated:MAS_ECDSA_PRIME256V1_PRIVATE_KEY:ecdsaprime256v1"
+   - "release-name-generated:POSTGRES_SYNAPSE_PASSWORD:rand32,release-name-generated:POSTGRES_MATRIX_AUTHENTICATION_SERVICE_PASSWORD:rand32,release-name-generated:POSTGRES_ADMIN_PASSWORD:rand32,release-name-generated:ELEMENT_CALL_LIVEKIT_SECRET:rand32,release-name-generated:MATRIX_RTC_REGISTRATION:registration:/registration-templates/matrix-rtc-registration.yaml,release-name-generated:SYNAPSE_EXTRA:extra,release-name-generated:SYNAPSE_MACAROON:rand32,release-name-generated:SYNAPSE_REGISTRATION_SHARED_SECRET:rand32,release-name-generated:SYNAPSE_SIGNING_KEY:signingkey,release-name-generated:MAS_SYNAPSE_SHARED_SECRET:rand32,release-name-generated:MAS_ENCRYPTION_SECRET:randbytes:32:hex,release-name-generated:MAS_RSA_PRIVATE_KEY:rsa:4096:der,release-name-generated:MAS_ECDSA_PRIME256V1_PRIVATE_KEY:ecdsaprime256v1"

example-default-enabled-components-values.yaml

@@ ConfigMap/ess-ci/release-name-init-secrets @@
+ ---
+ # Source: matrix-stack/templates/init-secrets/configmap.yaml
+ apiVersion: v1
+ kind: ConfigMap
+ metadata:
+   name: release-name-init-secrets
+   namespace: ess-ci
+   annotations:
+     "helm.sh/hook": pre-install,pre-upgrade
+     "helm.sh/hook-weight": "-11"
+   labels:
+     helm.sh/chart: "matrix-stack-26.9.5-dev"
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/part-of: matrix-stack
+     app.kubernetes.io/component: matrix-tools
+     app.kubernetes.io/name: init-secrets
+     app.kubernetes.io/instance: release-name-init-secrets
+     app.kubernetes.io/version: "0.10.3"
+ data:
+   matrix-rtc-registration.yaml: |
+     id: matrix-rtc-authorisation-service
+     as_token: "${AS_TOKEN}"
+     hs_token: "${HS_TOKEN}"
+     sender_localpart: _lk_jwt_service
+     # The service asserts the identity of the local users it acts for (e.g. MSC4140 delayed leave events)
+     namespaces:
+       users:
+       - exclusive: false
+         regex: "@.*:ess.localhost"
+     # The service doesn't need any events pushed to it
+     url: null
+     # MSC4502: let the service check room memberships without joining the rooms
+     io.element.msc4502.scopes:
+     - "urn:matrix:client:io.element.msc4502:rooms:is_joined"
+     # MSC4512: Synapse proxies the rtc/livekit endpoints of the C-S and S-S APIs to the service
+     io.element.msc4512.proxy_prefix: rtc/livekit
+     io.element.msc4512.proxy_url: "http://release-name-matrix-rtc-authorisation-service.ess-ci.svc.cluster.local.:8080"



@@ ConfigMap/ess-ci/release-name-synapse-hook - data.04-homeserver-overrides.yaml @@
  public_baseurl: https://synapse.ess.localhost/
  server_name: ess.localhost
  signing_key_path: /secrets/release-name-generated/SYNAPSE_SIGNING_KEY
  enable_metrics: true
  
  [45 lines unchanged)]
  
    msc4143_enabled: true
    # MSC4222 needed for syncv2 state_after. This allow clients to
    # correctly track the state of the room.
    msc4222_enabled: true
+   # MSC4502 lets the MatrixRTC Authorisation Service check room memberships without joining the rooms
+   msc4502_enabled: true
+   # MSC4512 proxies the MatrixRTC Authorisation Service endpoints (rtc/livekit) on the C-S and S-S APIs
+   msc4512_enabled: true
  
  password_config:
    localdb_enabled: false
    enabled: false
  
  [one line unchanged)]
  
  matrix_rtc:
    transports:
    - type: livekit
      livekit_service_url: https://mrtc.ess.localhost
+ app_service_config_files:
+ - /secrets/release-name-generated/MATRIX_RTC_REGISTRATION
  
  send_federation: true
  
  max_upload_size: "100M"
  
  [three lines unchanged)]
  
  instance_map:
    main:
      host: release-name-synapse-main.ess-ci.svc.cluster.local.
      port: 9093



@@ ConfigMap/ess-ci/release-name-synapse - data.04-homeserver-overrides.yaml @@
  public_baseurl: https://synapse.ess.localhost/
  server_name: ess.localhost
  signing_key_path: /secrets/release-name-generated/SYNAPSE_SIGNING_KEY
  enable_metrics: true
  
  [45 lines unchanged)]
  
    msc4143_enabled: true
    # MSC4222 needed for syncv2 state_after. This allow clients to
    # correctly track the state of the room.
    msc4222_enabled: true
+   # MSC4502 lets the MatrixRTC Authorisation Service check room memberships without joining the rooms
+   msc4502_enabled: true
+   # MSC4512 proxies the MatrixRTC Authorisation Service endpoints (rtc/livekit) on the C-S and S-S APIs
+   msc4512_enabled: true
  
  password_config:
    localdb_enabled: false
    enabled: false
  
  [one line unchanged)]
  
  matrix_rtc:
    transports:
    - type: livekit
      livekit_service_url: https://mrtc.ess.localhost
+ app_service_config_files:
+ - /secrets/release-name-generated/MATRIX_RTC_REGISTRATION
  
  send_federation: true
  
  max_upload_size: "100M"
  
  [three lines unchanged)]
  
  instance_map:
    main:
      host: release-name-synapse-main.ess-ci.svc.cluster.local.
      port: 9093



@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env @@
+   - name: LIVEKIT_AS_REGISTRATION_FILE
+     value: /secrets/release-name-generated/MATRIX_RTC_REGISTRATION
+   - name: LIVEKIT_HS_SERVER_NAME
+     value: ess.localhost



@@ Job/ess-ci/release-name-init-secrets - spec.template.spec @@
+   volumes:
+   - name: registration-templates
+     configMap:
+       name: release-name-init-secrets
+       defaultMode: 420

@@ Job/ess-ci/release-name-init-secrets - spec.template.spec.containers.init-secrets @@
+   volumeMounts:
+   - name: registration-templates
+     mountPath: /registration-templates
+     readOnly: true

@@ Job/ess-ci/release-name-init-secrets - spec.template.spec.containers.init-secrets.args @@
- - "release-name-generated:POSTGRES_SYNAPSE_PASSWORD:rand32,release-name-generated:POSTGRES_MATRIX_AUTHENTICATION_SERVICE_PASSWORD:rand32,release-name-generated:POSTGRES_ADMIN_PASSWORD:rand32,release-name-generated:ELEMENT_CALL_LIVEKIT_SECRET:rand32,release-name-generated:SYNAPSE_EXTRA:extra,release-name-generated:SYNAPSE_MACAROON:rand32,release-name-generated:SYNAPSE_REGISTRATION_SHARED_SECRET:rand32,release-name-generated:SYNAPSE_SIGNING_KEY:signingkey,release-name-generated:MAS_SYNAPSE_SHARED_SECRET:rand32,release-name-generated:MAS_ENCRYPTION_SECRET:randbytes:32:hex,release-name-generated:MAS_RSA_PRIVATE_KEY:rsa:4096:der,release-name-generated:MAS_ECDSA_PRIME256V1_PRIVATE_KEY:ecdsaprime256v1"
+   - "release-name-generated:POSTGRES_SYNAPSE_PASSWORD:rand32,release-name-generated:POSTGRES_MATRIX_AUTHENTICATION_SERVICE_PASSWORD:rand32,release-name-generated:POSTGRES_ADMIN_PASSWORD:rand32,release-name-generated:ELEMENT_CALL_LIVEKIT_SECRET:rand32,release-name-generated:MATRIX_RTC_REGISTRATION:registration:/registration-templates/matrix-rtc-registration.yaml,release-name-generated:SYNAPSE_EXTRA:extra,release-name-generated:SYNAPSE_MACAROON:rand32,release-name-generated:SYNAPSE_REGISTRATION_SHARED_SECRET:rand32,release-name-generated:SYNAPSE_SIGNING_KEY:signingkey,release-name-generated:MAS_SYNAPSE_SHARED_SECRET:rand32,release-name-generated:MAS_ENCRYPTION_SECRET:randbytes:32:hex,release-name-generated:MAS_RSA_PRIVATE_KEY:rsa:4096:der,release-name-generated:MAS_ECDSA_PRIME256V1_PRIVATE_KEY:ecdsaprime256v1"

matrix-rtc-checkov-values.yaml

@@ ConfigMap/ess-ci/release-name-init-secrets @@
+ ---
+ # Source: matrix-stack/templates/init-secrets/configmap.yaml
+ apiVersion: v1
+ kind: ConfigMap
+ metadata:
+   name: release-name-init-secrets
+   namespace: ess-ci
+   annotations:
+     "helm.sh/hook": pre-install,pre-upgrade
+     "helm.sh/hook-weight": "-11"
+   labels:
+     helm.sh/chart: "matrix-stack-26.9.5-dev"
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/part-of: matrix-stack
+     app.kubernetes.io/component: matrix-tools
+     app.kubernetes.io/name: init-secrets
+     app.kubernetes.io/instance: release-name-init-secrets
+     app.kubernetes.io/version: "0.10.3"
+ data:
+   matrix-rtc-registration.yaml: |
+     id: matrix-rtc-authorisation-service
+     as_token: "${AS_TOKEN}"
+     hs_token: "${HS_TOKEN}"
+     sender_localpart: _lk_jwt_service
+     # The service asserts the identity of the local users it acts for (e.g. MSC4140 delayed leave events)
+     namespaces:
+       users:
+       - exclusive: false
+         regex: "@.*:ess.localhost"
+     # The service doesn't need any events pushed to it
+     url: null
+     # MSC4502: let the service check room memberships without joining the rooms
+     io.element.msc4502.scopes:
+     - "urn:matrix:client:io.element.msc4502:rooms:is_joined"
+     # MSC4512: Synapse proxies the rtc/livekit endpoints of the C-S and S-S APIs to the service
+     io.element.msc4512.proxy_prefix: rtc/livekit
+     io.element.msc4512.proxy_url: "http://release-name-matrix-rtc-authorisation-service.ess-ci.svc.cluster.local.:8080"



@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env @@
+   - name: LIVEKIT_AS_REGISTRATION_FILE
+     value: /secrets/release-name-generated/MATRIX_RTC_REGISTRATION
+   - name: LIVEKIT_HS_SERVER_NAME
+     value: ess.localhost

@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env.LIVEKIT_FULL_ACCESS_HOMESERVERS.value @@
- *
+ ess.localhost



@@ Job/ess-ci/release-name-init-secrets - spec.template.spec @@
+   volumes:
+   - name: registration-templates
+     configMap:
+       name: release-name-init-secrets
+       defaultMode: 420

@@ Job/ess-ci/release-name-init-secrets - spec.template.spec.containers.init-secrets @@
+   volumeMounts:
+   - name: registration-templates
+     mountPath: /registration-templates
+     readOnly: true

@@ Job/ess-ci/release-name-init-secrets - spec.template.spec.containers.init-secrets.args @@
- - "release-name-generated:ELEMENT_CALL_LIVEKIT_SECRET:rand32"
+   - "release-name-generated:ELEMENT_CALL_LIVEKIT_SECRET:rand32,release-name-generated:MATRIX_RTC_REGISTRATION:registration:/registration-templates/matrix-rtc-registration.yaml"

matrix-rtc-clusterip-services-values.yaml

@@ ConfigMap/ess-ci/release-name-init-secrets @@
+ ---
+ # Source: matrix-stack/templates/init-secrets/configmap.yaml
+ apiVersion: v1
+ kind: ConfigMap
+ metadata:
+   name: release-name-init-secrets
+   namespace: ess-ci
+   annotations:
+     "helm.sh/hook": pre-install,pre-upgrade
+     "helm.sh/hook-weight": "-11"
+   labels:
+     helm.sh/chart: "matrix-stack-26.9.5-dev"
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/part-of: matrix-stack
+     app.kubernetes.io/component: matrix-tools
+     app.kubernetes.io/name: init-secrets
+     app.kubernetes.io/instance: release-name-init-secrets
+     app.kubernetes.io/version: "0.10.3"
+ data:
+   matrix-rtc-registration.yaml: |
+     id: matrix-rtc-authorisation-service
+     as_token: "${AS_TOKEN}"
+     hs_token: "${HS_TOKEN}"
+     sender_localpart: _lk_jwt_service
+     # The service asserts the identity of the local users it acts for (e.g. MSC4140 delayed leave events)
+     namespaces:
+       users:
+       - exclusive: false
+         regex: "@.*:ess.localhost"
+     # The service doesn't need any events pushed to it
+     url: null
+     # MSC4502: let the service check room memberships without joining the rooms
+     io.element.msc4502.scopes:
+     - "urn:matrix:client:io.element.msc4502:rooms:is_joined"
+     # MSC4512: Synapse proxies the rtc/livekit endpoints of the C-S and S-S APIs to the service
+     io.element.msc4512.proxy_prefix: rtc/livekit
+     io.element.msc4512.proxy_url: "http://release-name-matrix-rtc-authorisation-service.ess-ci.svc.cluster.local.:8080"



@@ ConfigMap/ess-ci/release-name-matrix-rtc-sfu - data.config-overrides.yaml @@
  port: 7880
  
  prometheus:
    port: 6789
  
  [19 lines unchanged)]
  
  turn:
    enabled: true
  
    tls_port: 5349
-   domain: turn.
+   domain: turn.ess.localhost
    cert_file: /turn-tls/tls.crt
    key_file: /turn-tls/tls.key
    external_tls: false
  
  
  [ten lines unchanged)]
  
    api_key: matrix-rtc
  
    urls:
    - http://release-name-matrix-rtc-authorisation-service.ess-ci.svc.cluster.local.:8080/sfu_webhook



@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env @@
+   - name: LIVEKIT_AS_REGISTRATION_FILE
+     value: /secrets/release-name-generated/MATRIX_RTC_REGISTRATION
+   - name: LIVEKIT_HS_SERVER_NAME
+     value: ess.localhost

@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env.LIVEKIT_FULL_ACCESS_HOMESERVERS.value @@
- *
+ ess.localhost



@@ Job/ess-ci/release-name-init-secrets - spec.template.spec @@
+   volumes:
+   - name: registration-templates
+     configMap:
+       name: release-name-init-secrets
+       defaultMode: 420

@@ Job/ess-ci/release-name-init-secrets - spec.template.spec.containers.init-secrets @@
+   volumeMounts:
+   - name: registration-templates
+     mountPath: /registration-templates
+     readOnly: true

@@ Job/ess-ci/release-name-init-secrets - spec.template.spec.containers.init-secrets.args @@
- - "release-name-generated:ELEMENT_CALL_LIVEKIT_SECRET:rand32"
+   - "release-name-generated:ELEMENT_CALL_LIVEKIT_SECRET:rand32,release-name-generated:MATRIX_RTC_REGISTRATION:registration:/registration-templates/matrix-rtc-registration.yaml"

matrix-rtc-exposed-services-cert-manager-values.yaml

@@ Certificate/ess-ci/release-name-matrix-rtc-sfu-turn-tls - spec.commonName @@
- turn.
+ turn.ess.localhost

@@ Certificate/ess-ci/release-name-matrix-rtc-sfu-turn-tls - spec.dnsNames.0 @@
- turn.
+ turn.ess.localhost


@@ ConfigMap/ess-ci/release-name-init-secrets @@
+ ---
+ # Source: matrix-stack/templates/init-secrets/configmap.yaml
+ apiVersion: v1
+ kind: ConfigMap
+ metadata:
+   name: release-name-init-secrets
+   namespace: ess-ci
+   annotations:
+     "helm.sh/hook": pre-install,pre-upgrade
+     "helm.sh/hook-weight": "-11"
+   labels:
+     helm.sh/chart: "matrix-stack-26.9.5-dev"
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/part-of: matrix-stack
+     app.kubernetes.io/component: matrix-tools
+     app.kubernetes.io/name: init-secrets
+     app.kubernetes.io/instance: release-name-init-secrets
+     app.kubernetes.io/version: "0.10.3"
+ data:
+   matrix-rtc-registration.yaml: |
+     id: matrix-rtc-authorisation-service
+     as_token: "${AS_TOKEN}"
+     hs_token: "${HS_TOKEN}"
+     sender_localpart: _lk_jwt_service
+     # The service asserts the identity of the local users it acts for (e.g. MSC4140 delayed leave events)
+     namespaces:
+       users:
+       - exclusive: false
+         regex: "@.*:ess.localhost"
+     # The service doesn't need any events pushed to it
+     url: null
+     # MSC4502: let the service check room memberships without joining the rooms
+     io.element.msc4502.scopes:
+     - "urn:matrix:client:io.element.msc4502:rooms:is_joined"
+     # MSC4512: Synapse proxies the rtc/livekit endpoints of the C-S and S-S APIs to the service
+     io.element.msc4512.proxy_prefix: rtc/livekit
+     io.element.msc4512.proxy_url: "http://release-name-matrix-rtc-authorisation-service.ess-ci.svc.cluster.local.:8080"



@@ ConfigMap/ess-ci/release-name-matrix-rtc-sfu - data.config-overrides.yaml @@
  port: 7880
  
  prometheus:
    port: 6789
  
  [21 lines unchanged)]
  
  turn:
    enabled: true
  
    tls_port: 5349
-   domain: turn.
+   domain: turn.ess.localhost
    cert_file: /turn-tls/tls.crt
    key_file: /turn-tls/tls.key
    external_tls: false
  
  
  [ten lines unchanged)]
  
    api_key: matrix-rtc
  
    urls:
    - http://release-name-matrix-rtc-authorisation-service.ess-ci.svc.cluster.local.:8080/sfu_webhook



@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env @@
+   - name: LIVEKIT_AS_REGISTRATION_FILE
+     value: /secrets/release-name-generated/MATRIX_RTC_REGISTRATION
+   - name: LIVEKIT_HS_SERVER_NAME
+     value: ess.localhost

@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env.LIVEKIT_FULL_ACCESS_HOMESERVERS.value @@
- *
+ ess.localhost



@@ Job/ess-ci/release-name-init-secrets - spec.template.spec @@
+   volumes:
+   - name: registration-templates
+     configMap:
+       name: release-name-init-secrets
+       defaultMode: 420

@@ Job/ess-ci/release-name-init-secrets - spec.template.spec.containers.init-secrets @@
+   volumeMounts:
+   - name: registration-templates
+     mountPath: /registration-templates
+     readOnly: true

@@ Job/ess-ci/release-name-init-secrets - spec.template.spec.containers.init-secrets.args @@
- - "release-name-generated:ELEMENT_CALL_LIVEKIT_SECRET:rand32"
+   - "release-name-generated:ELEMENT_CALL_LIVEKIT_SECRET:rand32,release-name-generated:MATRIX_RTC_REGISTRATION:registration:/registration-templates/matrix-rtc-registration.yaml"

matrix-rtc-exposed-services-tls-values.yaml

@@ ConfigMap/ess-ci/release-name-init-secrets @@
+ ---
+ # Source: matrix-stack/templates/init-secrets/configmap.yaml
+ apiVersion: v1
+ kind: ConfigMap
+ metadata:
+   name: release-name-init-secrets
+   namespace: ess-ci
+   annotations:
+     "helm.sh/hook": pre-install,pre-upgrade
+     "helm.sh/hook-weight": "-11"
+   labels:
+     helm.sh/chart: "matrix-stack-26.9.5-dev"
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/part-of: matrix-stack
+     app.kubernetes.io/component: matrix-tools
+     app.kubernetes.io/name: init-secrets
+     app.kubernetes.io/instance: release-name-init-secrets
+     app.kubernetes.io/version: "0.10.3"
+ data:
+   matrix-rtc-registration.yaml: |
+     id: matrix-rtc-authorisation-service
+     as_token: "${AS_TOKEN}"
+     hs_token: "${HS_TOKEN}"
+     sender_localpart: _lk_jwt_service
+     # The service asserts the identity of the local users it acts for (e.g. MSC4140 delayed leave events)
+     namespaces:
+       users:
+       - exclusive: false
+         regex: "@.*:ess.localhost"
+     # The service doesn't need any events pushed to it
+     url: null
+     # MSC4502: let the service check room memberships without joining the rooms
+     io.element.msc4502.scopes:
+     - "urn:matrix:client:io.element.msc4502:rooms:is_joined"
+     # MSC4512: Synapse proxies the rtc/livekit endpoints of the C-S and S-S APIs to the service
+     io.element.msc4512.proxy_prefix: rtc/livekit
+     io.element.msc4512.proxy_url: "http://release-name-matrix-rtc-authorisation-service.ess-ci.svc.cluster.local.:8080"



@@ ConfigMap/ess-ci/release-name-matrix-rtc-sfu - data.config-overrides.yaml @@
  port: 7880
  
  prometheus:
    port: 6789
  
  [21 lines unchanged)]
  
  turn:
    enabled: true
  
    tls_port: 5349
-   domain: turn.
+   domain: turn.ess.localhost
    cert_file: /turn-tls/tls.crt
    key_file: /turn-tls/tls.key
    external_tls: false
  
  
  [ten lines unchanged)]
  
    api_key: matrix-rtc
  
    urls:
    - http://release-name-matrix-rtc-authorisation-service.ess-ci.svc.cluster.local.:8080/sfu_webhook



@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env @@
+   - name: LIVEKIT_AS_REGISTRATION_FILE
+     value: /secrets/release-name-generated/MATRIX_RTC_REGISTRATION
+   - name: LIVEKIT_HS_SERVER_NAME
+     value: ess.localhost

@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env.LIVEKIT_FULL_ACCESS_HOMESERVERS.value @@
- *
+ ess.localhost



@@ Job/ess-ci/release-name-init-secrets - spec.template.spec @@
+   volumes:
+   - name: registration-templates
+     configMap:
+       name: release-name-init-secrets
+       defaultMode: 420

@@ Job/ess-ci/release-name-init-secrets - spec.template.spec.containers.init-secrets @@
+   volumeMounts:
+   - name: registration-templates
+     mountPath: /registration-templates
+     readOnly: true

@@ Job/ess-ci/release-name-init-secrets - spec.template.spec.containers.init-secrets.args @@
- - "release-name-generated:ELEMENT_CALL_LIVEKIT_SECRET:rand32"
+   - "release-name-generated:ELEMENT_CALL_LIVEKIT_SECRET:rand32,release-name-generated:MATRIX_RTC_REGISTRATION:registration:/registration-templates/matrix-rtc-registration.yaml"

matrix-rtc-external-livekit-secrets-externally-values.yaml

@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env @@
+   - name: LIVEKIT_AS_REGISTRATION_FILE
+     value: /secrets/release-name-matrix-rtc-external-registration/registration.yaml
+   - name: LIVEKIT_HS_SERVER_NAME
+     value: ess.localhost

@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env.LIVEKIT_FULL_ACCESS_HOMESERVERS.value @@
- *
+ ess.localhost

@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.volumeMounts @@
+   - name: secret-8044fd2e2c00
+     mountPath: /secrets/release-name-matrix-rtc-external-registration
+     readOnly: true

@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.volumes @@
+   - name: secret-8044fd2e2c00
+     secret:
+       secretName: release-name-matrix-rtc-external-registration

matrix-rtc-external-livekit-secrets-in-helm-values.yaml

@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env @@
+   - name: LIVEKIT_AS_REGISTRATION_FILE
+     value: /secrets/release-name-matrix-rtc-authorisation-service/REGISTRATION
+   - name: LIVEKIT_HS_SERVER_NAME
+     value: ess.localhost

@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env.LIVEKIT_FULL_ACCESS_HOMESERVERS.value @@
- *
+ ess.localhost



@@ Secret/ess-ci/release-name-matrix-rtc-authorisation-service - data @@
+   REGISTRATION: aWQ6IG1hdHJpeC1ydGMtYXV0aG9yaXNhdGlvbi1zZXJ2aWNlCmFzX3Rva2VuOiAiQ0hBTkdFTUUtQWhuZzRvaFlhZVc1SWVwaG84ZWVxdW9oNWFodGhlZTAiCmhzX3Rva2VuOiAiQ0hBTkdFTUUtdXU2b2hiZWU5RWV0aDlhaGNvaDFOZWlwaDRhaVpvb3giCnNlbmRlcl9sb2NhbHBhcnQ6IF9sa19qd3Rfc2VydmljZQpuYW1lc3BhY2VzOgogIHVzZXJzOgogICAgLSByZWdleDogIi4qIgogICAgICBleGNsdXNpdmU6IGZhbHNlCnVybDogbnVsbAppby5lbGVtZW50Lm1zYzQ1MDIuc2NvcGVzOgogIC0gInVybjptYXRyaXg6Y2xpZW50OmlvLmVsZW1lbnQubXNjNDUwMjpyb29tczppc19qb2luZWQiCmlvLmVsZW1lbnQubXNjNDUxMi5wcm94eV9wcmVmaXg6IHJ0Yy9saXZla2l0CmlvLmVsZW1lbnQubXNjNDUxMi5wcm94eV91cmw6ICJodHRwOi8vcmVsZWFzZS1uYW1lLW1hdHJpeC1ydGMtYXV0aG9yaXNhdGlvbi1zZXJ2aWNlLmVzcy1jaS5zdmMuY2x1c3Rlci5sb2NhbC46ODA4MCIK

matrix-rtc-host-mode-values.yaml

@@ ConfigMap/ess-ci/release-name-init-secrets @@
+ ---
+ # Source: matrix-stack/templates/init-secrets/configmap.yaml
+ apiVersion: v1
+ kind: ConfigMap
+ metadata:
+   name: release-name-init-secrets
+   namespace: ess-ci
+   annotations:
+     "helm.sh/hook": pre-install,pre-upgrade
+     "helm.sh/hook-weight": "-11"
+   labels:
+     helm.sh/chart: "matrix-stack-26.9.5-dev"
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/part-of: matrix-stack
+     app.kubernetes.io/component: matrix-tools
+     app.kubernetes.io/name: init-secrets
+     app.kubernetes.io/instance: release-name-init-secrets
+     app.kubernetes.io/version: "0.10.3"
+ data:
+   matrix-rtc-registration.yaml: |
+     id: matrix-rtc-authorisation-service
+     as_token: "${AS_TOKEN}"
+     hs_token: "${HS_TOKEN}"
+     sender_localpart: _lk_jwt_service
+     # The service asserts the identity of the local users it acts for (e.g. MSC4140 delayed leave events)
+     namespaces:
+       users:
+       - exclusive: false
+         regex: "@.*:ess.localhost"
+     # The service doesn't need any events pushed to it
+     url: null
+     # MSC4502: let the service check room memberships without joining the rooms
+     io.element.msc4502.scopes:
+     - "urn:matrix:client:io.element.msc4502:rooms:is_joined"
+     # MSC4512: Synapse proxies the rtc/livekit endpoints of the C-S and S-S APIs to the service
+     io.element.msc4512.proxy_prefix: rtc/livekit
+     io.element.msc4512.proxy_url: "http://release-name-matrix-rtc-authorisation-service.ess-ci.svc.cluster.local.:8080"



@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env @@
+   - name: LIVEKIT_AS_REGISTRATION_FILE
+     value: /secrets/release-name-generated/MATRIX_RTC_REGISTRATION
+   - name: LIVEKIT_HS_SERVER_NAME
+     value: ess.localhost

@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env.LIVEKIT_FULL_ACCESS_HOMESERVERS.value @@
- *
+ ess.localhost



@@ Job/ess-ci/release-name-init-secrets - spec.template.spec @@
+   volumes:
+   - name: registration-templates
+     configMap:
+       name: release-name-init-secrets
+       defaultMode: 420

@@ Job/ess-ci/release-name-init-secrets - spec.template.spec.containers.init-secrets @@
+   volumeMounts:
+   - name: registration-templates
+     mountPath: /registration-templates
+     readOnly: true

@@ Job/ess-ci/release-name-init-secrets - spec.template.spec.containers.init-secrets.args @@
- - "release-name-generated:ELEMENT_CALL_LIVEKIT_SECRET:rand32"
+   - "release-name-generated:ELEMENT_CALL_LIVEKIT_SECRET:rand32,release-name-generated:MATRIX_RTC_REGISTRATION:registration:/registration-templates/matrix-rtc-registration.yaml"

matrix-rtc-minimal-values.yaml

@@ ConfigMap/ess-ci/release-name-init-secrets @@
+ ---
+ # Source: matrix-stack/templates/init-secrets/configmap.yaml
+ apiVersion: v1
+ kind: ConfigMap
+ metadata:
+   name: release-name-init-secrets
+   namespace: ess-ci
+   annotations:
+     "helm.sh/hook": pre-install,pre-upgrade
+     "helm.sh/hook-weight": "-11"
+   labels:
+     helm.sh/chart: "matrix-stack-26.9.5-dev"
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/part-of: matrix-stack
+     app.kubernetes.io/component: matrix-tools
+     app.kubernetes.io/name: init-secrets
+     app.kubernetes.io/instance: release-name-init-secrets
+     app.kubernetes.io/version: "0.10.3"
+ data:
+   matrix-rtc-registration.yaml: |
+     id: matrix-rtc-authorisation-service
+     as_token: "${AS_TOKEN}"
+     hs_token: "${HS_TOKEN}"
+     sender_localpart: _lk_jwt_service
+     # The service asserts the identity of the local users it acts for (e.g. MSC4140 delayed leave events)
+     namespaces:
+       users:
+       - exclusive: false
+         regex: "@.*:ess.localhost"
+     # The service doesn't need any events pushed to it
+     url: null
+     # MSC4502: let the service check room memberships without joining the rooms
+     io.element.msc4502.scopes:
+     - "urn:matrix:client:io.element.msc4502:rooms:is_joined"
+     # MSC4512: Synapse proxies the rtc/livekit endpoints of the C-S and S-S APIs to the service
+     io.element.msc4512.proxy_prefix: rtc/livekit
+     io.element.msc4512.proxy_url: "http://release-name-matrix-rtc-authorisation-service.ess-ci.svc.cluster.local.:8080"



@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env @@
+   - name: LIVEKIT_AS_REGISTRATION_FILE
+     value: /secrets/release-name-generated/MATRIX_RTC_REGISTRATION
+   - name: LIVEKIT_HS_SERVER_NAME
+     value: ess.localhost

@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env.LIVEKIT_FULL_ACCESS_HOMESERVERS.value @@
- *
+ ess.localhost



@@ Job/ess-ci/release-name-init-secrets - spec.template.spec @@
+   volumes:
+   - name: registration-templates
+     configMap:
+       name: release-name-init-secrets
+       defaultMode: 420

@@ Job/ess-ci/release-name-init-secrets - spec.template.spec.containers.init-secrets @@
+   volumeMounts:
+   - name: registration-templates
+     mountPath: /registration-templates
+     readOnly: true

@@ Job/ess-ci/release-name-init-secrets - spec.template.spec.containers.init-secrets.args @@
- - "release-name-generated:ELEMENT_CALL_LIVEKIT_SECRET:rand32"
+   - "release-name-generated:ELEMENT_CALL_LIVEKIT_SECRET:rand32,release-name-generated:MATRIX_RTC_REGISTRATION:registration:/registration-templates/matrix-rtc-registration.yaml"

matrix-rtc-no-stun-manual-ip-values.yaml

@@ ConfigMap/ess-ci/release-name-init-secrets @@
+ ---
+ # Source: matrix-stack/templates/init-secrets/configmap.yaml
+ apiVersion: v1
+ kind: ConfigMap
+ metadata:
+   name: release-name-init-secrets
+   namespace: ess-ci
+   annotations:
+     "helm.sh/hook": pre-install,pre-upgrade
+     "helm.sh/hook-weight": "-11"
+   labels:
+     helm.sh/chart: "matrix-stack-26.9.5-dev"
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/part-of: matrix-stack
+     app.kubernetes.io/component: matrix-tools
+     app.kubernetes.io/name: init-secrets
+     app.kubernetes.io/instance: release-name-init-secrets
+     app.kubernetes.io/version: "0.10.3"
+ data:
+   matrix-rtc-registration.yaml: |
+     id: matrix-rtc-authorisation-service
+     as_token: "${AS_TOKEN}"
+     hs_token: "${HS_TOKEN}"
+     sender_localpart: _lk_jwt_service
+     # The service asserts the identity of the local users it acts for (e.g. MSC4140 delayed leave events)
+     namespaces:
+       users:
+       - exclusive: false
+         regex: "@.*:ess.localhost"
+     # The service doesn't need any events pushed to it
+     url: null
+     # MSC4502: let the service check room memberships without joining the rooms
+     io.element.msc4502.scopes:
+     - "urn:matrix:client:io.element.msc4502:rooms:is_joined"
+     # MSC4512: Synapse proxies the rtc/livekit endpoints of the C-S and S-S APIs to the service
+     io.element.msc4512.proxy_prefix: rtc/livekit
+     io.element.msc4512.proxy_url: "http://release-name-matrix-rtc-authorisation-service.ess-ci.svc.cluster.local.:8080"



@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env @@
+   - name: LIVEKIT_AS_REGISTRATION_FILE
+     value: /secrets/release-name-generated/MATRIX_RTC_REGISTRATION
+   - name: LIVEKIT_HS_SERVER_NAME
+     value: ess.localhost

@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env.LIVEKIT_FULL_ACCESS_HOMESERVERS.value @@
- *
+ ess.localhost



@@ Job/ess-ci/release-name-init-secrets - spec.template.spec @@
+   volumes:
+   - name: registration-templates
+     configMap:
+       name: release-name-init-secrets
+       defaultMode: 420

@@ Job/ess-ci/release-name-init-secrets - spec.template.spec.containers.init-secrets @@
+   volumeMounts:
+   - name: registration-templates
+     mountPath: /registration-templates
+     readOnly: true

@@ Job/ess-ci/release-name-init-secrets - spec.template.spec.containers.init-secrets.args @@
- - "release-name-generated:ELEMENT_CALL_LIVEKIT_SECRET:rand32"
+   - "release-name-generated:ELEMENT_CALL_LIVEKIT_SECRET:rand32,release-name-generated:MATRIX_RTC_REGISTRATION:registration:/registration-templates/matrix-rtc-registration.yaml"

matrix-rtc-no-stun-no-manual-ip-values.yaml

@@ ConfigMap/ess-ci/release-name-init-secrets @@
+ ---
+ # Source: matrix-stack/templates/init-secrets/configmap.yaml
+ apiVersion: v1
+ kind: ConfigMap
+ metadata:
+   name: release-name-init-secrets
+   namespace: ess-ci
+   annotations:
+     "helm.sh/hook": pre-install,pre-upgrade
+     "helm.sh/hook-weight": "-11"
+   labels:
+     helm.sh/chart: "matrix-stack-26.9.5-dev"
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/part-of: matrix-stack
+     app.kubernetes.io/component: matrix-tools
+     app.kubernetes.io/name: init-secrets
+     app.kubernetes.io/instance: release-name-init-secrets
+     app.kubernetes.io/version: "0.10.3"
+ data:
+   matrix-rtc-registration.yaml: |
+     id: matrix-rtc-authorisation-service
+     as_token: "${AS_TOKEN}"
+     hs_token: "${HS_TOKEN}"
+     sender_localpart: _lk_jwt_service
+     # The service asserts the identity of the local users it acts for (e.g. MSC4140 delayed leave events)
+     namespaces:
+       users:
+       - exclusive: false
+         regex: "@.*:ess.localhost"
+     # The service doesn't need any events pushed to it
+     url: null
+     # MSC4502: let the service check room memberships without joining the rooms
+     io.element.msc4502.scopes:
+     - "urn:matrix:client:io.element.msc4502:rooms:is_joined"
+     # MSC4512: Synapse proxies the rtc/livekit endpoints of the C-S and S-S APIs to the service
+     io.element.msc4512.proxy_prefix: rtc/livekit
+     io.element.msc4512.proxy_url: "http://release-name-matrix-rtc-authorisation-service.ess-ci.svc.cluster.local.:8080"



@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env @@
+   - name: LIVEKIT_AS_REGISTRATION_FILE
+     value: /secrets/release-name-generated/MATRIX_RTC_REGISTRATION
+   - name: LIVEKIT_HS_SERVER_NAME
+     value: ess.localhost

@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env.LIVEKIT_FULL_ACCESS_HOMESERVERS.value @@
- *
+ ess.localhost



@@ Job/ess-ci/release-name-init-secrets - spec.template.spec @@
+   volumes:
+   - name: registration-templates
+     configMap:
+       name: release-name-init-secrets
+       defaultMode: 420

@@ Job/ess-ci/release-name-init-secrets - spec.template.spec.containers.init-secrets @@
+   volumeMounts:
+   - name: registration-templates
+     mountPath: /registration-templates
+     readOnly: true

@@ Job/ess-ci/release-name-init-secrets - spec.template.spec.containers.init-secrets.args @@
- - "release-name-generated:ELEMENT_CALL_LIVEKIT_SECRET:rand32"
+   - "release-name-generated:ELEMENT_CALL_LIVEKIT_SECRET:rand32,release-name-generated:MATRIX_RTC_REGISTRATION:registration:/registration-templates/matrix-rtc-registration.yaml"

matrix-rtc-no-stun-pod-ip-values.yaml

@@ ConfigMap/ess-ci/release-name-init-secrets @@
+ ---
+ # Source: matrix-stack/templates/init-secrets/configmap.yaml
+ apiVersion: v1
+ kind: ConfigMap
+ metadata:
+   name: release-name-init-secrets
+   namespace: ess-ci
+   annotations:
+     "helm.sh/hook": pre-install,pre-upgrade
+     "helm.sh/hook-weight": "-11"
+   labels:
+     helm.sh/chart: "matrix-stack-26.9.5-dev"
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/part-of: matrix-stack
+     app.kubernetes.io/component: matrix-tools
+     app.kubernetes.io/name: init-secrets
+     app.kubernetes.io/instance: release-name-init-secrets
+     app.kubernetes.io/version: "0.10.3"
+ data:
+   matrix-rtc-registration.yaml: |
+     id: matrix-rtc-authorisation-service
+     as_token: "${AS_TOKEN}"
+     hs_token: "${HS_TOKEN}"
+     sender_localpart: _lk_jwt_service
+     # The service asserts the identity of the local users it acts for (e.g. MSC4140 delayed leave events)
+     namespaces:
+       users:
+       - exclusive: false
+         regex: "@.*:ess.localhost"
+     # The service doesn't need any events pushed to it
+     url: null
+     # MSC4502: let the service check room memberships without joining the rooms
+     io.element.msc4502.scopes:
+     - "urn:matrix:client:io.element.msc4502:rooms:is_joined"
+     # MSC4512: Synapse proxies the rtc/livekit endpoints of the C-S and S-S APIs to the service
+     io.element.msc4512.proxy_prefix: rtc/livekit
+     io.element.msc4512.proxy_url: "http://release-name-matrix-rtc-authorisation-service.ess-ci.svc.cluster.local.:8080"



@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env @@
+   - name: LIVEKIT_AS_REGISTRATION_FILE
+     value: /secrets/release-name-generated/MATRIX_RTC_REGISTRATION
+   - name: LIVEKIT_HS_SERVER_NAME
+     value: ess.localhost

@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env.LIVEKIT_FULL_ACCESS_HOMESERVERS.value @@
- *
+ ess.localhost



@@ Job/ess-ci/release-name-init-secrets - spec.template.spec @@
+   volumes:
+   - name: registration-templates
+     configMap:
+       name: release-name-init-secrets
+       defaultMode: 420

@@ Job/ess-ci/release-name-init-secrets - spec.template.spec.containers.init-secrets @@
+   volumeMounts:
+   - name: registration-templates
+     mountPath: /registration-templates
+     readOnly: true

@@ Job/ess-ci/release-name-init-secrets - spec.template.spec.containers.init-secrets.args @@
- - "release-name-generated:ELEMENT_CALL_LIVEKIT_SECRET:rand32"
+   - "release-name-generated:ELEMENT_CALL_LIVEKIT_SECRET:rand32,release-name-generated:MATRIX_RTC_REGISTRATION:registration:/registration-templates/matrix-rtc-registration.yaml"

matrix-rtc-secrets-externally-values.yaml

@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env @@
+   - name: LIVEKIT_AS_REGISTRATION_FILE
+     value: /secrets/release-name-matrix-rtc-external-registration/registration.yaml
+   - name: LIVEKIT_HS_SERVER_NAME
+     value: ess.localhost

@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env.LIVEKIT_FULL_ACCESS_HOMESERVERS.value @@
- *
+ ess.localhost

@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.volumeMounts @@
+   - name: secret-8044fd2e2c00
+     mountPath: /secrets/release-name-matrix-rtc-external-registration
+     readOnly: true

@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.volumes @@
+   - name: secret-8044fd2e2c00
+     secret:
+       secretName: release-name-matrix-rtc-external-registration



@@ Deployment/ess-ci/release-name-matrix-rtc-sfu - spec.template.spec.initContainers.render-config-keys-yaml.volumeMounts @@
+   - name: secret-8044fd2e2c00
+     mountPath: /secrets/release-name-matrix-rtc-external-registration
+     readOnly: true

@@ Deployment/ess-ci/release-name-matrix-rtc-sfu - spec.template.spec.initContainers.render-config-sfu.volumeMounts @@
+   - name: secret-8044fd2e2c00
+     mountPath: /secrets/release-name-matrix-rtc-external-registration
+     readOnly: true

@@ Deployment/ess-ci/release-name-matrix-rtc-sfu - spec.template.spec.containers.sfu.volumeMounts @@
+   - name: secret-8044fd2e2c00
+     mountPath: /secrets/release-name-matrix-rtc-external-registration
+     readOnly: true

@@ Deployment/ess-ci/release-name-matrix-rtc-sfu - spec.template.spec.volumes @@
+   - name: secret-8044fd2e2c00
+     secret:
+       secretName: release-name-matrix-rtc-external-registration

matrix-rtc-secrets-in-helm-values.yaml

@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env @@
+   - name: LIVEKIT_AS_REGISTRATION_FILE
+     value: /secrets/release-name-matrix-rtc-authorisation-service/REGISTRATION
+   - name: LIVEKIT_HS_SERVER_NAME
+     value: ess.localhost

@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env.LIVEKIT_FULL_ACCESS_HOMESERVERS.value @@
- *
+ ess.localhost



@@ Secret/ess-ci/release-name-matrix-rtc-authorisation-service - data @@
+   REGISTRATION: aWQ6IG1hdHJpeC1ydGMtYXV0aG9yaXNhdGlvbi1zZXJ2aWNlCmFzX3Rva2VuOiAiQ0hBTkdFTUUtQWhuZzRvaFlhZVc1SWVwaG84ZWVxdW9oNWFodGhlZTAiCmhzX3Rva2VuOiAiQ0hBTkdFTUUtdXU2b2hiZWU5RWV0aDlhaGNvaDFOZWlwaDRhaVpvb3giCnNlbmRlcl9sb2NhbHBhcnQ6IF9sa19qd3Rfc2VydmljZQpuYW1lc3BhY2VzOgogIHVzZXJzOgogICAgLSByZWdleDogIi4qIgogICAgICBleGNsdXNpdmU6IGZhbHNlCnVybDogbnVsbAppby5lbGVtZW50Lm1zYzQ1MDIuc2NvcGVzOgogIC0gInVybjptYXRyaXg6Y2xpZW50OmlvLmVsZW1lbnQubXNjNDUwMjpyb29tczppc19qb2luZWQiCmlvLmVsZW1lbnQubXNjNDUxMi5wcm94eV9wcmVmaXg6IHJ0Yy9saXZla2l0CmlvLmVsZW1lbnQubXNjNDUxMi5wcm94eV91cmw6ICJodHRwOi8vcmVsZWFzZS1uYW1lLW1hdHJpeC1ydGMtYXV0aG9yaXNhdGlvbi1zZXJ2aWNlLmVzcy1jaS5zdmMuY2x1c3Rlci5sb2NhbC46ODA4MCIK

matrix-rtc-stun-values.yaml

@@ ConfigMap/ess-ci/release-name-init-secrets @@
+ ---
+ # Source: matrix-stack/templates/init-secrets/configmap.yaml
+ apiVersion: v1
+ kind: ConfigMap
+ metadata:
+   name: release-name-init-secrets
+   namespace: ess-ci
+   annotations:
+     "helm.sh/hook": pre-install,pre-upgrade
+     "helm.sh/hook-weight": "-11"
+   labels:
+     helm.sh/chart: "matrix-stack-26.9.5-dev"
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/part-of: matrix-stack
+     app.kubernetes.io/component: matrix-tools
+     app.kubernetes.io/name: init-secrets
+     app.kubernetes.io/instance: release-name-init-secrets
+     app.kubernetes.io/version: "0.10.3"
+ data:
+   matrix-rtc-registration.yaml: |
+     id: matrix-rtc-authorisation-service
+     as_token: "${AS_TOKEN}"
+     hs_token: "${HS_TOKEN}"
+     sender_localpart: _lk_jwt_service
+     # The service asserts the identity of the local users it acts for (e.g. MSC4140 delayed leave events)
+     namespaces:
+       users:
+       - exclusive: false
+         regex: "@.*:ess.localhost"
+     # The service doesn't need any events pushed to it
+     url: null
+     # MSC4502: let the service check room memberships without joining the rooms
+     io.element.msc4502.scopes:
+     - "urn:matrix:client:io.element.msc4502:rooms:is_joined"
+     # MSC4512: Synapse proxies the rtc/livekit endpoints of the C-S and S-S APIs to the service
+     io.element.msc4512.proxy_prefix: rtc/livekit
+     io.element.msc4512.proxy_url: "http://release-name-matrix-rtc-authorisation-service.ess-ci.svc.cluster.local.:8080"



@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env @@
+   - name: LIVEKIT_AS_REGISTRATION_FILE
+     value: /secrets/release-name-generated/MATRIX_RTC_REGISTRATION
+   - name: LIVEKIT_HS_SERVER_NAME
+     value: ess.localhost

@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env.LIVEKIT_FULL_ACCESS_HOMESERVERS.value @@
- *
+ ess.localhost



@@ Job/ess-ci/release-name-init-secrets - spec.template.spec @@
+   volumes:
+   - name: registration-templates
+     configMap:
+       name: release-name-init-secrets
+       defaultMode: 420

@@ Job/ess-ci/release-name-init-secrets - spec.template.spec.containers.init-secrets @@
+   volumeMounts:
+   - name: registration-templates
+     mountPath: /registration-templates
+     readOnly: true

@@ Job/ess-ci/release-name-init-secrets - spec.template.spec.containers.init-secrets.args @@
- - "release-name-generated:ELEMENT_CALL_LIVEKIT_SECRET:rand32"
+   - "release-name-generated:ELEMENT_CALL_LIVEKIT_SECRET:rand32,release-name-generated:MATRIX_RTC_REGISTRATION:registration:/registration-templates/matrix-rtc-registration.yaml"

matrix-rtc-turn-tls-external-values.yaml

@@ ConfigMap/ess-ci/release-name-init-secrets @@
+ ---
+ # Source: matrix-stack/templates/init-secrets/configmap.yaml
+ apiVersion: v1
+ kind: ConfigMap
+ metadata:
+   name: release-name-init-secrets
+   namespace: ess-ci
+   annotations:
+     "helm.sh/hook": pre-install,pre-upgrade
+     "helm.sh/hook-weight": "-11"
+   labels:
+     helm.sh/chart: "matrix-stack-26.9.5-dev"
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/part-of: matrix-stack
+     app.kubernetes.io/component: matrix-tools
+     app.kubernetes.io/name: init-secrets
+     app.kubernetes.io/instance: release-name-init-secrets
+     app.kubernetes.io/version: "0.10.3"
+ data:
+   matrix-rtc-registration.yaml: |
+     id: matrix-rtc-authorisation-service
+     as_token: "${AS_TOKEN}"
+     hs_token: "${HS_TOKEN}"
+     sender_localpart: _lk_jwt_service
+     # The service asserts the identity of the local users it acts for (e.g. MSC4140 delayed leave events)
+     namespaces:
+       users:
+       - exclusive: false
+         regex: "@.*:ess.localhost"
+     # The service doesn't need any events pushed to it
+     url: null
+     # MSC4502: let the service check room memberships without joining the rooms
+     io.element.msc4502.scopes:
+     - "urn:matrix:client:io.element.msc4502:rooms:is_joined"
+     # MSC4512: Synapse proxies the rtc/livekit endpoints of the C-S and S-S APIs to the service
+     io.element.msc4512.proxy_prefix: rtc/livekit
+     io.element.msc4512.proxy_url: "http://release-name-matrix-rtc-authorisation-service.ess-ci.svc.cluster.local.:8080"



@@ ConfigMap/ess-ci/release-name-matrix-rtc-sfu - data.config-overrides.yaml @@
  port: 7880
  
  prometheus:
    port: 6789
  
  [21 lines unchanged)]
  
  turn:
    enabled: true
  
    tls_port: 5349
-   domain: turn.
+   domain: turn.ess.localhost
    external_tls: true
  
    udp_port: 31003
  
  
  [eight lines unchanged)]
  
    api_key: matrix-rtc
  
    urls:
    - http://release-name-matrix-rtc-authorisation-service.ess-ci.svc.cluster.local.:8080/sfu_webhook



@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env @@
+   - name: LIVEKIT_AS_REGISTRATION_FILE
+     value: /secrets/release-name-generated/MATRIX_RTC_REGISTRATION
+   - name: LIVEKIT_HS_SERVER_NAME
+     value: ess.localhost

@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env.LIVEKIT_FULL_ACCESS_HOMESERVERS.value @@
- *
+ ess.localhost



@@ Job/ess-ci/release-name-init-secrets - spec.template.spec @@
+   volumes:
+   - name: registration-templates
+     configMap:
+       name: release-name-init-secrets
+       defaultMode: 420

@@ Job/ess-ci/release-name-init-secrets - spec.template.spec.containers.init-secrets @@
+   volumeMounts:
+   - name: registration-templates
+     mountPath: /registration-templates
+     readOnly: true

@@ Job/ess-ci/release-name-init-secrets - spec.template.spec.containers.init-secrets.args @@
- - "release-name-generated:ELEMENT_CALL_LIVEKIT_SECRET:rand32"
+   - "release-name-generated:ELEMENT_CALL_LIVEKIT_SECRET:rand32,release-name-generated:MATRIX_RTC_REGISTRATION:registration:/registration-templates/matrix-rtc-registration.yaml"

pytest-matrix-rtc-standalone-values.yaml

@@ ConfigMap/ess-ci/release-name-init-secrets @@
+ ---
+ # Source: matrix-stack/templates/init-secrets/configmap.yaml
+ apiVersion: v1
+ kind: ConfigMap
+ metadata:
+   name: release-name-init-secrets
+   namespace: ess-ci
+   annotations:
+     "helm.sh/hook": pre-install,pre-upgrade
+     "helm.sh/hook-weight": "-11"
+   labels:
+     helm.sh/chart: "matrix-stack-26.9.5-dev"
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/part-of: matrix-stack
+     app.kubernetes.io/component: matrix-tools
+     app.kubernetes.io/name: init-secrets
+     app.kubernetes.io/instance: release-name-init-secrets
+     app.kubernetes.io/version: "0.10.3"
+ data:
+   matrix-rtc-registration.yaml: |
+     id: matrix-rtc-authorisation-service
+     as_token: "${AS_TOKEN}"
+     hs_token: "${HS_TOKEN}"
+     sender_localpart: _lk_jwt_service
+     # The service asserts the identity of the local users it acts for (e.g. MSC4140 delayed leave events)
+     namespaces:
+       users:
+       - exclusive: false
+         regex: "@.*:ess.localhost"
+     # The service doesn't need any events pushed to it
+     url: null
+     # MSC4502: let the service check room memberships without joining the rooms
+     io.element.msc4502.scopes:
+     - "urn:matrix:client:io.element.msc4502:rooms:is_joined"
+     # MSC4512: Synapse proxies the rtc/livekit endpoints of the C-S and S-S APIs to the service
+     io.element.msc4512.proxy_prefix: rtc/livekit
+     io.element.msc4512.proxy_url: "http://release-name-matrix-rtc-authorisation-service.ess-ci.svc.cluster.local.:8080"



@@ ConfigMap/ess-ci/release-name-matrix-rtc-sfu - data.config-overrides.yaml @@
  port: 7880
  
  prometheus:
    port: 6789
  
  [19 lines unchanged)]
  
  turn:
    enabled: true
  
    tls_port: 5349
-   domain: turn.
+   domain: turn.ess.localhost
    cert_file: /turn-tls/tls.crt
    key_file: /turn-tls/tls.key
    external_tls: false
  
  
  [nine lines unchanged)]
  
    api_key: matrix-rtc
  
    urls:
    - http://release-name-matrix-rtc-authorisation-service.ess-ci.svc.cluster.local.:8080/sfu_webhook



@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env @@
+   - name: LIVEKIT_AS_REGISTRATION_FILE
+     value: /secrets/release-name-generated/MATRIX_RTC_REGISTRATION
+   - name: LIVEKIT_HS_SERVER_NAME
+     value: ess.localhost

@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env.LIVEKIT_FULL_ACCESS_HOMESERVERS.value @@
- *
+ ess.localhost

@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env.LIVEKIT_URL.value @@
- wss://mrtc.
+ wss://mrtc.ess.localhost



@@ Ingress/ess-ci/release-name-matrix-rtc - spec.tls.0.hosts.0 @@
- mrtc.
+ mrtc.ess.localhost

@@ Ingress/ess-ci/release-name-matrix-rtc - spec.rules.0.host @@
- mrtc.
+ mrtc.ess.localhost



@@ Job/ess-ci/release-name-init-secrets - spec.template.spec @@
+   volumes:
+   - name: registration-templates
+     configMap:
+       name: release-name-init-secrets
+       defaultMode: 420

@@ Job/ess-ci/release-name-init-secrets - spec.template.spec.containers.init-secrets @@
+   volumeMounts:
+   - name: registration-templates
+     mountPath: /registration-templates
+     readOnly: true

@@ Job/ess-ci/release-name-init-secrets - spec.template.spec.containers.init-secrets.args @@
- - "release-name-generated:ELEMENT_CALL_LIVEKIT_SECRET:rand32"
+   - "release-name-generated:ELEMENT_CALL_LIVEKIT_SECRET:rand32,release-name-generated:MATRIX_RTC_REGISTRATION:registration:/registration-templates/matrix-rtc-registration.yaml"

pytest-matrix-rtc-synapse-wellknown-values.yaml

@@ ConfigMap/ess-ci/release-name-init-secrets @@
+ ---
+ # Source: matrix-stack/templates/init-secrets/configmap.yaml
+ apiVersion: v1
+ kind: ConfigMap
+ metadata:
+   name: release-name-init-secrets
+   namespace: ess-ci
+   annotations:
+     "helm.sh/hook": pre-install,pre-upgrade
+     "helm.sh/hook-weight": "-11"
+   labels:
+     helm.sh/chart: "matrix-stack-26.9.5-dev"
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/part-of: matrix-stack
+     app.kubernetes.io/component: matrix-tools
+     app.kubernetes.io/name: init-secrets
+     app.kubernetes.io/instance: release-name-init-secrets
+     app.kubernetes.io/version: "0.10.3"
+ data:
+   matrix-rtc-registration.yaml: |
+     id: matrix-rtc-authorisation-service
+     as_token: "${AS_TOKEN}"
+     hs_token: "${HS_TOKEN}"
+     sender_localpart: _lk_jwt_service
+     # The service asserts the identity of the local users it acts for (e.g. MSC4140 delayed leave events)
+     namespaces:
+       users:
+       - exclusive: false
+         regex: "@.*:ess.localhost"
+     # The service doesn't need any events pushed to it
+     url: null
+     # MSC4502: let the service check room memberships without joining the rooms
+     io.element.msc4502.scopes:
+     - "urn:matrix:client:io.element.msc4502:rooms:is_joined"
+     # MSC4512: Synapse proxies the rtc/livekit endpoints of the C-S and S-S APIs to the service
+     io.element.msc4512.proxy_prefix: rtc/livekit
+     io.element.msc4512.proxy_url: "http://release-name-matrix-rtc-authorisation-service.ess-ci.svc.cluster.local.:8080"



@@ ConfigMap/ess-ci/release-name-synapse-hook - data.04-homeserver-overrides.yaml @@
  public_baseurl: https://synapse.ess.localhost/
  server_name: ess.localhost
  signing_key_path: /secrets/release-name-generated/SYNAPSE_SIGNING_KEY
  enable_metrics: true
  
  [40 lines unchanged)]
  
    msc4143_enabled: true
    # MSC4222 needed for syncv2 state_after. This allow clients to
    # correctly track the state of the room.
    msc4222_enabled: true
+   # MSC4502 lets the MatrixRTC Authorisati...*[Comment body truncated]*

benbz

Thanks for raising this. It has been on my list to do since both LK JWT Service 0.7.0 and Synapse 1.161.0 were merged. It seems you have more context than me as I wasn't aware of the Synapse changes that would mean holding off until later Synapse releases is desirable

The authorisation service only acts for users of the homeserver it is registered on, so its namespace doesn't need to cover remote users. This follows the registrations of the ESS Pro bots, which use the same non-exclusive "@.*:<serverName>" regex.

Add matrixRTC.user.localpart, like the other application services of the chart (hookshot.user.localpart). It defaults to _lk_jwt_service, the name used by the lk-jwt-service documentation, and is ignored when matrixRTC.appserviceRegistration is provided.

The homeserver the authorisation service is registered on doesn't have to be deployed by the chart. Like Hookshot, generate the registration whenever serverName is set, so that it can be copied from the generated Secret to the homeserver. The generated proxy_url only works for a homeserver in the same cluster. The values comment says how to adapt the registration otherwise.

Both usages of the helper prefixed its result with it. Co-authored-by: Ben Banfield-Zanin <benbz@element.io>

Like the media upload test in test_synapse.py, only skip in the first step of the upgrade tests when it deploys a given release, rather than any release. The release has to be updated before merging.

Like the rest of the configuration provided in the values, the registration can now refer to the release, e.g. for its proxy_url. Co-authored-by: Ben Banfield-Zanin <benbz@element.io>

The integration test it described is now part of this PR.

Co-authored-by: Ben Banfield-Zanin <ben@banfieldzanin.com>

benbz

Happy for you to merge once the last tag has been updated.

Thanks for this

barodeur · 2026-10-08T10:31:32Z

Thanks a lot for the review @benbz 🙏

benbz · 2026-10-08T10:50:08Z

Merging despite the Element Admin failure. Looks like #1640 broke something here and it will be investigated separately

barodeur added 7 commits September 30, 2026 17:06

Rename the newsfragment to match the PR number

b7a6158

Add newsfragment for running the MatrixRTC Authorisation Service as a…

371b5fe

…n appservice

barodeur mentioned this pull request Sep 30, 2026

[Epic] MSC4140: Cancellable Delayed Events element-hq/synapse#20254

Open

2 of 12 tasks

barodeur deployed to pypi September 30, 2026 16:08 — with GitHub Actions Active

benbz reviewed Oct 1, 2026

View reviewed changes

barodeur added 3 commits October 1, 2026 15:00

Rename the newsfragment to match the PR number

f789de1

barodeur deployed to pypi October 1, 2026 13:42 — with GitHub Actions Active

barodeur and others added 4 commits October 1, 2026 15:52

Include the /secrets/ prefix in the registration path helper

6ec0d30

Both usages of the helper prefixed its result with it. Co-authored-by: Ben Banfield-Zanin <benbz@element.io>

Skip the proxied Matrix RTC tests only when upgrading from 26.9.4

108b61c

Like the media upload test in test_synapse.py, only skip in the first step of the upgrade tests when it deploys a given release, rather than any release. The release has to be updated before merging.

Template the registration provided in the values

b878c9b

Like the rest of the configuration provided in the values, the registration can now refer to the release, e.g. for its proxy_url. Co-authored-by: Ben Banfield-Zanin <benbz@element.io>

barodeur deployed to pypi October 2, 2026 09:37 — with GitHub Actions Active

barodeur mentioned this pull request Oct 2, 2026

Add an integration test for MatrixRTC token requests with delegated delayed leave #1625

Closed

barodeur marked this pull request as ready for review October 2, 2026 09:53

barodeur requested a review from a team as a code owner October 2, 2026 09:53

barodeur requested a review from benbz October 2, 2026 09:54

Remove the newsfragment of the closed PR

2d2cf7a

The integration test it described is now part of this PR.

barodeur deployed to pypi October 2, 2026 10:05 — with GitHub Actions Active

benbz reviewed Oct 2, 2026

View reviewed changes

Comment thread charts/matrix-stack/templates/matrix-rtc/_helpers.tpl Outdated

Comment thread charts/matrix-stack/templates/matrix-rtc/_helpers.tpl Outdated

Comment thread charts/matrix-stack/templates/matrix-rtc/_helpers.tpl Outdated

Update charts/matrix-stack/templates/matrix-rtc/_helpers.tpl

3fd95f8

Co-authored-by: Ben Banfield-Zanin <ben@banfieldzanin.com>

barodeur requested a review from benbz October 7, 2026 16:38

barodeur deployed to pypi October 7, 2026 16:38 — with GitHub Actions Active

Always run the authorisation service as an appservice with MatrixRTC

bcfd25a

barodeur force-pushed the msc4140-rtc-appservice-mode branch from de9e30c to bcfd25a Compare October 7, 2026 16:40

barodeur deployed to pypi October 7, 2026 16:43 — with GitHub Actions Active

benbz approved these changes Oct 8, 2026

View reviewed changes

Comment thread tests/integration/test_element_call.py Outdated

Keep 26.9.4 as the last release without the Matrix RTC proxy

7701332

barodeur deployed to pypi October 8, 2026 10:32 — with GitHub Actions Active

benbz merged commit 3892b7c into element-hq:main Oct 8, 2026
245 of 248 checks passed

barodeur deleted the msc4140-rtc-appservice-mode branch October 8, 2026 13:09

This was referenced Oct 13, 2026

Update Synapse -> MatrixRTC link #1664

Merged

Upgrade Synapse to v1.161.0 #1580

Merged

Hookshot: template registration files as Helm values #1666

Merged

Navigation Menu

Repository navigation

Run the MatrixRTC Authorisation Service as an application service - #1626

Run the MatrixRTC Authorisation Service as an application service#1626
benbz merged 18 commits into
element-hq:mainfrom
barodeur:msc4140-rtc-appservice-mode

barodeur commented Sep 30, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 30, 2026 •

edited

Loading

Uh oh!

benbz left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

benbz left a comment

Uh oh!

Uh oh!

barodeur commented Oct 8, 2026

Uh oh!

benbz commented Oct 8, 2026

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

barodeur commented Sep 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR unblocks

Changes

Requirements and upgrade notes

Uh oh!

github-actions Bot commented Sep 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

dyff of changes in rendered templates of CI manifests

Uh oh!

benbz left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

benbz left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

barodeur commented Oct 8, 2026

Uh oh!

benbz commented Oct 8, 2026

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

barodeur commented Sep 30, 2026 •

edited

Loading

github-actions Bot commented Sep 30, 2026 •

edited

Loading