update rocket-chat

2025-04-03 15:16:10 +02:00
parent 31f6b361ac
commit 571c3a4dbb
180 changed files with 1 additions and 48 deletions
--- a/deploy/rocket-chat/templates/NOTES.txt
+++ b/deploy/rocket-chat/templates/NOTES.txt
@@ -0,0 +1,27 @@
+Rocket.Chat can be accessed via port 80 on the following DNS name from within your cluster:
+
+- http://{{ template "rocketchat.fullname" . }}.{{ .Release.Namespace }}
+
+You can easily connect to the remote instance from your browser. Forward the webserver port to localhost:8888
+
+- kubectl port-forward --namespace {{ .Release.Namespace }} $(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ template "rocketchat.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath='{ .items[0].metadata.name }') 8888:3000
+
+You can also connect to the container running Rocket.Chat. To open a shell session in the pod run the following:
+
+- kubectl exec -i -t --namespace {{ .Release.Namespace }} $(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ template "rocketchat.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath='{.items[0].metadata.name}') /bin/sh
+
+To trail the logs for the Rocket.Chat pod run the following:
+
+- kubectl logs -f --namespace {{ .Release.Namespace }} $(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ template "rocketchat.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath='{ .items[0].metadata.name }')
+
+{{- if .Values.ingress.enabled }}
+
+Rocket.Chat will be available at the URL:
+
+- http://{{ .Values.host }}
+{{ else }}
+
+To expose Rocket.Chat via an Ingress you need to set host and enable ingress.
+
+helm install --set host=chat.yourdomain.com --set ingress.enabled=true stable/rocketchat
+{{- end -}}
--- a/deploy/rocket-chat/templates/_helpers.tpl
+++ b/deploy/rocket-chat/templates/_helpers.tpl
@@ -0,0 +1,171 @@
+{{/* vim: set filetype=helm: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "rocketchat.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+*/}}
+{{- define "rocketchat.fullname" -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+*/}}
+{{- define "rocketchat.mongodb.fullname" -}}
+{{- printf "%s-%s-headless" .Release.Name "mongodb" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "rocketchat.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "rocketchat.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create -}}
+    {{ default (include "rocketchat.fullname" .) .Values.serviceAccount.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccount.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Return the apiVersion of deployment.
+*/}}
+{{- define "deployment.apiVersion" -}}
+{{- if semverCompare "<1.14-0" .Capabilities.KubeVersion.GitVersion -}}
+{{- print "extensions/v1beta1" -}}
+{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}
+{{- print "apps/v1" -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Renders a value that contains template. 
+Note: This function was lent from Bitnami Common Library Chart (cf. 
+https://github.com/bitnami/charts/blob/master/bitnami/common/templates/_tplvalues.tpl)
+Usage:
+{{ include "common.tplvalues.render" ( dict "value" .Values.path.to.the.Value "context" $) }}
+*/}}
+{{- define "common.tplvalues.render" -}}
+    {{- if typeIs "string" .value }}
+        {{- tpl .value .context }}
+    {{- else }}
+        {{- tpl (.value | toYaml) .context }}
+    {{- end }}
+{{- end -}}
+
+{{/*Generate the MONGO_URL*/}}
+{{- define "rocketchat.mongodb.url" }}
+    {{- if .Values.externalMongodbUrl }}
+        {{- print .Values.externalMongodbUrl }}
+    {{- else }}
+        {{- $service := include "rocketchat.mongodb.fullname" . }}
+        {{- $user := required "usernames array must have at least one entry" (first .Values.mongodb.auth.usernames) }}
+        {{- $password := required "passwords array must have at least one entry" (first .Values.mongodb.auth.passwords) }}
+        {{- $database := required "databases array must have at least one entry" (first .Values.mongodb.auth.databases) }}
+        {{- $port := .Values.mongodb.service.ports.mongodb }}
+        {{- $rs := .Values.mongodb.replicaSetName }}
+        {{- printf "mongodb://%s:%s@%s:%0.f/%s?replicaSet=%s" $user $password $service $port $database $rs }}
+    {{- end }}
+{{- end }}
+
+{{/*Generate MONGO_OPLOG_URL*/}}
+{{- define "rocketchat.mongodb.oplogUrl" }}
+    {{- if .Values.externalMongodbOplogUrl }}
+        {{- print .Values.externalMongodbOplogUrl }}
+    {{- else }}
+        {{- $service := include "rocketchat.mongodb.fullname" . }}
+        {{- $user := .Values.mongodb.auth.rootUser }}
+        {{- $password := required "root password must be provided" .Values.mongodb.auth.rootPassword }}
+        {{- $port := .Values.mongodb.service.ports.mongodb }}
+        {{- $rs := .Values.mongodb.replicaSetName }}
+        {{- printf "mongodb://%s:%s@%s:%0.f/local?replicaSet=%s&authSource=admin" $user $password $service $port $rs }}
+    {{- end }}
+{{- end }}
+
+{{/* TODO: fail if types of the following are not what is expected instead of silently ignoring */}}
+
+{{/* Get correct tolerations */}}
+{{- define "rocketchat.tolerations" -}}
+{{- $name := .name -}}
+{{- $tolerations := list -}}
+{{- with .context }}
+{{- if eq $name "meteor" }}
+{{ $tolerations = .Values.tolerations }}
+{{- else }}
+{{ $tolerations = get (get .Values.microservices $name) "tolerations" }}
+{{- end }}
+{{- if (and (kindIs "slice" $tolerations) (gt (len $tolerations) 0)) }}
+{{- toYaml $tolerations }}
+{{- else if (and (kindIs "slice" .Values.global.tolerations) (gt (len .Values.global.tolerations) 0)) }}
+{{- toYaml .Values.global.tolerations }}
+{{- end }}
+{{- end }}
+{{- end -}}
+
+{{/* Get correct annotations */}}
+{{- define "rocketchat.annotations" -}}
+{{- $name := .name -}}
+{{- $annotations := dict -}}
+{{- with .context }}
+{{- if eq $name "meteor" }}
+{{ $annotations = .Values.podAnnotations}}
+{{- else }}
+{{ $annotations = get (get .Values.microservices $name) "annotations" }}
+{{- end }}
+{{- if (and (kindIs "map" $annotations) (gt (len $annotations) 0)) }}
+{{- toYaml $annotations}}
+{{- else if (and (kindIs "map" .Values.global.annotations) (gt (keys .Values.global.annotations | len) 0)) }}
+{{- toYaml .Values.global.annotations}}
+{{- end }}
+{{- end }}
+{{- end -}}
+
+{{/* Get correct nodeSelector */}}
+{{- define "rocketchat.nodeSelector" -}}
+{{- $name := .name -}}
+{{- $nodeSelector := dict -}}
+{{- with .context }}
+{{- if eq $name "meteor" }}
+{{ $nodeSelector = .Values.nodeSelector }}
+{{- else }}
+{{ $nodeSelector = get (get .Values.microservices $name) "nodeSelector" }}
+{{- end }}
+{{- if (and (kindIs "map" $nodeSelector) (gt (len $nodeSelector) 0)) }}
+{{- toYaml $nodeSelector | indent 2 }}
+{{- else if (and (kindIs "map" .Values.global.nodeSelector) (gt (keys .Values.global.nodeSelector | len) 0)) }}
+{{- toYaml .Values.global.nodeSelector | indent 2 }}
+{{- end }}
+{{- end }}
+{{- end -}}
+
+{{/* Get correct nodeAffinity */}}
+{{- define "rocketchat.nodeAffinity" -}}
+{{- $name := .name -}}
+{{- $nodeAffinity := dict -}}
+{{- with .context }}
+{{- if eq $name "meteor" }}
+{{ $nodeAffinity = .Values.affinity }}
+{{- else }}
+{{ $nodeAffinity = get (get .Values.microservices $name) "affinity" }}
+{{- end }}
+{{- if (and (kindIs "map" $nodeAffinity) (gt (len $nodeAffinity) 0)) }}
+{{- toYaml $nodeAffinity | indent 8 }}
+{{- else if (and (kindIs "map" .Values.global.affinity) (gt (keys .Values.global.affinity | len) 0)) }}
+{{- toYaml .Values.global.affinity | indent 8 }}
+{{- end }}
+{{- end }}
+{{- end -}}
--- a/deploy/rocket-chat/templates/chat-deployment.yaml
+++ b/deploy/rocket-chat/templates/chat-deployment.yaml
@@ -0,0 +1,266 @@
+apiVersion: {{ template "deployment.apiVersion" . }}
+kind: Deployment
+metadata:
+  name: {{ template "rocketchat.fullname" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "rocketchat.name" . }}
+    helm.sh/chart: {{ include "rocketchat.chart" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- if .Values.deploymentLabels }}
+{{ toYaml .Values.deploymentLabels | indent 4 }}
+    {{- end }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ include "rocketchat.name" . }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  strategy:
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 1
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: {{ include "rocketchat.name" . }}
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        {{- if .Values.podLabels }}
+{{ toYaml .Values.podLabels | indent 8 }}
+        {{- end }}   
+      annotations:  
+          {{ include "rocketchat.annotations" (dict "name" "meteor" "context" $) | indent 8 }}
+        checksum/secret: {{ include (print .Template.BasePath "/secret.yaml") . | sha256sum }}
+
+    spec:
+    {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+      {{- if .Values.securityContext.enabled }}
+      securityContext:
+        fsGroup: {{ .Values.securityContext.fsGroup }}
+        runAsUser: {{ .Values.securityContext.runAsUser }}
+      {{- end }}
+      serviceAccountName: {{ template "rocketchat.serviceAccountName" . }}
+      {{- if .Values.extraInitContainers }}
+      initContainers:
+        {{- toYaml .Values.extraInitContainers | nindent 8 }}
+      {{- end }}
+      containers:
+      - name: rocketchat
+        image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+        imagePullPolicy: {{ .Values.image.pullPolicy }}
+        {{- if .Values.extraSecret }}
+        envFrom:
+        - secretRef:
+            name: {{ .Values.extraSecret }}
+        {{- end }}
+        env:
+        - name: DEPLOY_PLATFORM
+          value: helm-chart
+        - name: INSTANCE_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        {{- if .Values.existingMongodbSecret }}
+        - name: MONGO_URL
+          valueFrom:
+            secretKeyRef:
+              name: {{ .Values.existingMongodbSecret }}
+              key: mongo-uri
+        - name: MONGO_OPLOG_URL
+          valueFrom:
+            secretKeyRef:
+              name: {{ .Values.existingMongodbSecret }}
+              key: mongo-oplog-uri
+        {{- else }}
+        - name: MONGO_URL
+          valueFrom:
+            secretKeyRef:
+              name: {{ template "rocketchat.fullname" . }}
+              key: mongo-uri
+        - name: MONGO_OPLOG_URL
+          valueFrom:
+            secretKeyRef:
+              name: {{ template "rocketchat.fullname" . }}
+              key: mongo-oplog-uri
+        {{- end }}
+        {{- if .Values.host }}
+        - name: ROOT_URL
+          value: https://{{ .Values.host }}
+        {{- end }}
+        {{- if .Values.smtp.enabled }}
+        {{- if not .Values.smtp.existingSecret }}
+        - name: MAIL_URL
+          valueFrom:
+            secretKeyRef:
+              name: {{ template "rocketchat.fullname" . }}
+              key: mail-url
+        {{- else }}
+        - name: MAIL_URL
+          valueFrom:
+            secretKeyRef:
+              name: {{ .Values.smtp.existingSecret }}
+              key: mail-url
+        {{- end }}
+        {{- end }}
+        {{- if and .Values.registrationToken .Release.IsInstall }}
+        - name: REG_TOKEN
+          valueFrom:
+            secretKeyRef:
+              name: {{ template "rocketchat.fullname" . }}
+              key: reg-token
+        {{- end }}
+        {{- if and .Values.license .Release.IsInstall }}
+        - name: ROCKETCHAT_LICENSE
+          valueFrom:
+            secretKeyRef:
+              name: {{ template "rocketchat.fullname" . }}
+              key: license
+        {{- end }}
+        {{- if .Values.prometheusScraping.enabled }}
+        - name: OVERWRITE_SETTING_Prometheus_Enabled
+          value: "true"
+        - name: OVERWRITE_SETTING_Prometheus_Port
+          value: "{{ .Values.prometheusScraping.port }}"
+        {{- end }}
+        # Environment variables for microservices option
+        {{- if .Values.microservices.enabled }}
+        - name: TRANSPORTER
+          value: nats://{{ .Release.Name }}-nats:4222
+        - name: MOLECULER_LOG_LEVEL
+          value: {{ .Values.microservices.logLevel | quote }}
+        - name: HEARTBEAT_INTERVAL
+          value: {{ .Values.microservices.heartbeatInterval | quote }}
+        - name: HEARTBEAT_TIMEOUT
+          value: {{ .Values.microservices.heartbeatTimeout | quote }}
+        - name: RETRY_ENABLED
+          value: 'yes'
+        - name: MS_METRICS
+          value: {{ .Values.prometheusScraping.enabled | default "false" | quote }}
+        {{- end}} # end of microservices envvar. options
+{{- with .Values.extraEnv }}
+	{{- include "common.tplvalues.render" (dict "value" . "context" $) | nindent 8 }}
+{{- end }}
+        {{- if .Values.federation.enabled }}
+        - name: OVERWRITE_SETTING_Federation_Matrix_homeserver_domain
+          value: {{ .Values.host }}
+        - name: OVERWRITE_SETTING_Federation_Matrix_enabled
+          value: "true"
+        - name: OVERWRITE_SETTING_Federation_Matrix_serve_well_known
+          {{- if not .Values.ingress.federation.serveWellKnown }}
+          value: "true"
+          {{- else }}
+          value: "false"
+          {{- end }}
+        - name: OVERWRITE_SETTING_Federation_Matrix_id
+          valueFrom:
+            secretKeyRef:
+              name: {{ include "rocketchat.fullname" . }}-synapse
+              key: appservice_id
+        - name: OVERWRITE_SETTING_Federation_Matrix_hs_token
+          valueFrom:
+            secretKeyRef:
+              name: {{ include "rocketchat.fullname" . }}-synapse
+              key: hs_token
+        - name: OVERWRITE_SETTING_Federation_Matrix_as_token
+          valueFrom:
+            secretKeyRef:
+              name: {{ include "rocketchat.fullname" . }}-synapse
+              key: as_token
+        - name: OVERWRITE_SETTING_Federation_Matrix_bridge_url
+          valueFrom:
+            secretKeyRef:
+              name: {{ include "rocketchat.fullname" . }}-synapse
+              key: bridge_url
+        - name: OVERWRITE_SETTING_Federation_Matrix_homeserver_url
+         {{- if .Values.ingress.federation.serveWellKnown }}
+          value: http://{{ template "rocketchat.fullname" . }}-synapse:8008
+          {{- else }}
+          value: https://{{ .Values.federation.host }}
+          {{- end }} 
+        - name: OVERWRITE_SETTING_Federation_Matrix_bridge_localpart
+          value: "rocket.cat"
+        {{end}}
+        ports:
+        - name: http
+          containerPort: 3000
+        {{- if .Values.prometheusScraping.enabled }}
+        - name: metrics
+          containerPort: {{ .Values.prometheusScraping.port }}
+        {{- end}}
+        {{- if .Values.livenessProbe.enabled }}
+        livenessProbe:
+          httpGet:
+            path: {{ .Values.livenessProbe.path }}
+            port: http
+          initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }}
+          periodSeconds: {{ .Values.livenessProbe.periodSeconds }}
+          timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }}
+          successThreshold: {{ .Values.livenessProbe.successThreshold }}
+          failureThreshold: {{ .Values.livenessProbe.failureThreshold }}
+        {{- end }}
+        {{- if .Values.readinessProbe.enabled }}
+        readinessProbe:
+          httpGet:
+            path: {{ .Values.readinessProbe.path }}
+            port: http
+          initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
+          periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
+          timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }}
+          successThreshold: {{ .Values.readinessProbe.successThreshold }}
+          failureThreshold: {{ .Values.readinessProbe.failureThreshold }}
+        {{- end }}
+        resources:
+{{ toYaml .Values.resources | indent 10 }}
+        volumeMounts:
+        - name: rocket-data
+          mountPath: /app/uploads
+        - name: tmp
+          mountPath: /tmp
+        {{- if .Values.extraVolumeMounts }}
+        {{- include "common.tplvalues.render" (dict "value" .Values.extraVolumeMounts "context" $) | nindent 8 }}
+        {{- end }}          
+      volumes:
+      - name: tmp
+        emptyDir: {}
+      - name: rocket-data
+      {{- if .Values.persistence.enabled }}
+        persistentVolumeClaim:
+          claimName: {{ if .Values.persistence.existingClaim }}{{ .Values.persistence.existingClaim }}{{- else }}{{ template "rocketchat.fullname" . }}{{- end }}
+      {{- else }}
+        emptyDir: {}
+      {{- end }}
+      {{- if .Values.extraVolumes }}
+      {{- include "common.tplvalues.render" (dict "value" .Values.extraVolumes "context" $) | nindent 6 }}
+      {{- end }}
+      nodeSelector:
+        {{ include "rocketchat.nodeSelector" (dict "name" "meteor" "context" $) | indent 8 }} 
+      tolerations:
+        {{ include "rocketchat.tolerations" (dict "name" "meteor" "context" $) | indent 8 }}
+{{- if or .Values.podAntiAffinity .Values.affinity }}
+      affinity:
+{{- if .Values.affinity }}
+        {{ include "rocketchat.nodeAffinity" (dict "name" "meteor"  "context" $) | indent 10 }}
+{{- end }}
+{{- if eq .Values.podAntiAffinity "hard" }}
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+          - topologyKey: {{ .Values.podAntiAffinityTopologyKey }}
+            labelSelector:
+              matchLabels:
+                app.kubernetes.io/name: {{ include "rocketchat.name" . }}
+{{- else if eq .Values.podAntiAffinity "soft" }}
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 100
+            podAffinityTerm:
+              topologyKey: {{ .Values.podAntiAffinityTopologyKey }}
+              labelSelector:
+                matchLabels:
+                  app.kubernetes.io/name: {{ include "rocketchat.name" . }}
+                  app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+{{- end }}
--- a/deploy/rocket-chat/templates/hook-verify-mongodb-version.yaml
+++ b/deploy/rocket-chat/templates/hook-verify-mongodb-version.yaml
@@ -0,0 +1,71 @@
+{{- if .Values.mongodb.enabled }}
+# https://kubernetes.io/docs/concepts/workloads/pods/
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: '{{ include "rocketchat.fullname" . }}-pre-upgrade'
+  annotations:
+    "helm.sh/hook": pre-upgrade
+    "helm.sh/hook-delete-policy": hook-succeeded
+spec:
+  backoffLimit: 5
+  parallelism: 1
+  completions: 1
+  template:
+    metadata:
+      name: '{{ include "rocketchat.fullname" . }}-pre-upgrade'
+      {{- with .Values.hooks.preUpgrade.podAnnotations }}
+      annotations:
+{{ toYaml . | indent 8 }}
+      {{- end }}
+      labels:
+        app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+        app.kubernetes.io/instance: {{ .Release.Name | quote }}
+        helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+        {{- with .Values.hooks.preUpgrade.podLabels }}
+{{ toYaml . | indent 8 }}
+        {{- end }}
+    spec:
+      restartPolicy: OnFailure
+        {{- if $.Values.tolerations }}
+      tolerations:
+{{ toYaml $.Values.tolerations | indent 8 }}
+      {{- end }}
+
+      containers:
+        - name: '{{ include "rocketchat.fullname" . }}-pre-upgrade'
+          {{- $registry := .Values.mongodb.image.registry }}
+          {{- $name := .Values.mongodb.image.repository }}
+          {{- $tag := toString .Values.mongodb.image.tag }}
+          image: {{ printf "%s/%s:%s" $registry $name $tag | quote }}
+          imagePullPolicy: IfNotPresent
+          env:
+            {{- if .Values.existingMongodbSecret }}
+            - name: MONGODB_HOST
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.existingMongodbSecret }}
+                  key: mongo-uri
+            {{- else }}
+            - name: MONGODB_HOST
+              value: {{ include "rocketchat.mongodb.url" . | quote }}
+            {{- end }}
+          volumeMounts:
+            - mountPath: /tmp
+              name: mongodb-script
+          command:
+            - sh
+            - -c
+            - 'mongosh "$MONGODB_HOST" /tmp/verifyMongodb.js {{ .Values.mongodb.image.tag }}'
+    {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+      volumes:
+        - name: mongodb-script
+          configMap:
+            name: "{{ include "rocketchat.fullname" . }}-scripts"
+            items:
+              - key: verifyMongodb.js
+                path: verifyMongodb.js
+{{- end }}
--- a/deploy/rocket-chat/templates/ingress.yaml
+++ b/deploy/rocket-chat/templates/ingress.yaml
@@ -0,0 +1,90 @@
+{{- $ingress := .Values.ingress -}}
+{{- if $ingress.enabled -}}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ template "rocketchat.fullname" . }}
+{{- with $ingress.annotations }}
+  annotations:
+{{ toYaml . | indent 4 }}
+{{- end }}
+  labels:
+    app.kubernetes.io/name: {{ include "rocketchat.name" . }}
+    helm.sh/chart: {{ include "rocketchat.chart" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+spec:
+{{- if .Values.ingress.ingressClassName }}
+  ingressClassName: {{ .Values.ingress.ingressClassName }}
+{{- end }}
+{{- if $ingress.tls }}
+  tls:
+  {{- range $ingress.tls }}
+    - hosts:
+      {{- range .hosts }}
+        - {{ . }}
+      {{- end }}
+      {{- if .secretName }}
+      secretName: {{ .secretName }}
+      {{- end }}
+  {{- end }}
+{{- end }}
+  rules:
+  - 
+  {{- if .Values.host }}
+    host: {{ .Values.host }}
+  {{- end }}
+    http:
+      paths:
+      - path: {{ $ingress.path }}
+        pathType: {{ if $ingress.pathType }} {{ $ingress.pathType }} {{ else }} {{ print "Prefix" }} {{ end }}
+        backend:
+          service:
+            name: {{ template "rocketchat.fullname" . }}
+            port:
+              name: http
+      {{- if .Values.microservices.enabled }}
+      - path: /sockjs
+        pathType: Prefix
+        backend:
+          service:
+            name: {{ .Release.Name }}-ddp-streamer
+            port:
+              name: http
+      - path: /websocket
+        pathType: Prefix
+        backend:
+          service:
+            name: {{ .Release.Name }}-ddp-streamer
+            port:
+              name: http
+      {{- end }}
+      {{- if .Values.federation.enabled }}
+      {{- if .Values.ingress.federation.serveWellKnown }}
+      - path: /.well-known/matrix/server
+        pathType: Prefix
+        backend:
+          service:
+            name: {{ template "rocketchat.fullname" . }}-wellknown
+            port:
+              name: http
+      - path: /.well-known/matrix/client
+        pathType: Prefix
+        backend:
+          service:
+            name: {{ template "rocketchat.fullname" . }}-wellknown
+            port:
+              name: http
+      {{- end }}
+  - host: {{ .Values.federation.host }}
+    http:
+      paths:
+        - path: /
+          pathType: Prefix
+          backend:
+            service:
+              name: {{ template "rocketchat.fullname" . }}-synapse
+              port:
+                name: http
+    {{end}}
+{{- end }}
--- a/deploy/rocket-chat/templates/lighttpd.yaml
+++ b/deploy/rocket-chat/templates/lighttpd.yaml
@@ -0,0 +1,89 @@
+{{ if and .Values.federation.enabled .Values.ingress.federation.serveWellKnown }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "rocketchat.fullname" . }}-wellknown
+data:
+  lighttpd.conf: |
+    server.port = 8080
+    server.document-root = "/var/www/lighttpd"
+    server.modules = (
+      "mod_rewrite",
+      "mod_setenv"
+    )
+    url.rewrite-once     = (
+      "^/\.well-known/matrix/server" => "/server.json",
+      "^/\.well-known/matrix/client" => "/client.json"
+    )
+    setenv.add-response-header = (
+      "access-control-allow-methods" => "GET",
+      "access-control-allow-origin" => "*"
+    )
+    setenv.set-response-header = (
+      "content-type" => "application/json"
+    )
+
+  server.json: |
+    {{ dict "m.server" (printf "%s:443" .Values.federation.host) | toJson }}
+  client.json: |
+    {{ dict "m.homeserver" (dict "base_url" (printf "https://%s" .Values.federation.host)) | toJson }}
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "rocketchat.fullname" . }}-wellknown
+  labels:
+    app.kubernetes.io/name: {{ include "rocketchat.fullname" . }}-wellknown
+    app.kubernetes.io/instance: {{ .Release.Name }}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ include "rocketchat.fullname" . }}-wellknown
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: {{ include "rocketchat.fullname" . }}-wellknown
+        helm.sh/chart: {{ include "rocketchat.chart" . }}
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        app.kubernetes.io/managed-by: {{ .Release.Service }}
+    spec:
+      containers:
+        - name: lighttpd
+          image: jitesoft/lighttpd
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 8080
+              name: http
+              protocol: TCP
+          volumeMounts:
+            - mountPath: /etc/lighttpd/lighttpd.conf
+              name: files
+              subPath: lighttpd.conf
+            - mountPath: /var/www/lighttpd/server.json
+              name: files
+              subPath: server.json
+            - mountPath: /var/www/lighttpd/client.json
+              name: files
+              subPath: client.json
+      volumes:
+        - name: files
+          configMap:
+            name: {{ include "rocketchat.fullname" . }}-wellknown
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "rocketchat.fullname" . }}-wellknown
+spec:
+  type: ClusterIP
+  ports:
+  - port: 80
+    targetPort: http
+    protocol: TCP
+    name: http
+  selector:
+    app.kubernetes.io/name: {{ template "rocketchat.fullname" . }}-wellknown
+{{ end}}
--- a/deploy/rocket-chat/templates/microservices-account-deployment.yaml
+++ b/deploy/rocket-chat/templates/microservices-account-deployment.yaml
@@ -0,0 +1,89 @@
+{{- if .Values.microservices.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}-account
+  labels:
+    app.kubernetes.io/name: {{ include "rocketchat.name" . }}
+    helm.sh/chart: {{ include "rocketchat.chart" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- if .Values.deploymentLabels }}
+      {{- toYaml .Values.deploymentLabels | nindent 4 }}
+    {{- end }}
+spec:
+  replicas: {{ .Values.microservices.account.replicas }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ .Release.Name }}-account
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  strategy:
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 1
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: {{ .Release.Name }}-account
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        {{- if .Values.podLabels }}
+          {{- toYaml .Values.podLabels | nindent 8 }}
+        {{- end }}
+      annotations:
+        {{ include "rocketchat.annotations" (dict "name" "account" "context" $) | indent 8 }}
+    spec:
+      tolerations:
+        {{ include "rocketchat.tolerations" (dict "name" "account" "context" $) | indent 8 }}
+      nodeSelector:
+        {{ include "rocketchat.nodeSelector" (dict "name" "account" "context" $) | indent 8 }}
+      affinity:
+        {{ include "rocketchat.nodeAffinity" (dict "name" "account" "context" $) | indent 8 }}
+      containers:
+      - name: account-service
+        image: "{{ .Values.microservices.account.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+        env:
+        {{- if .Values.existingMongodbSecret }}
+        - name: MONGO_URL
+          valueFrom:
+            secretKeyRef:
+              name: {{ .Values.existingMongodbSecret }}
+              key: mongo-uri
+        {{- else }}
+        - name: MONGO_URL
+          valueFrom:
+            secretKeyRef:
+              name: {{ template "rocketchat.fullname" . }}
+              key: mongo-uri
+        {{- end }}
+        - name: TRANSPORTER
+          value: nats://{{ .Release.Name }}-nats:4222
+        - name: MOLECULER_LOG_LEVEL
+          value: {{ .Values.microservices.logLevel | quote }}
+        - name: HEARTBEAT_INTERVAL
+          value: {{ .Values.microservices.heartbeatInterval | quote }}
+        - name: HEARTBEAT_TIMEOUT
+          value: {{ .Values.microservices.heartbeatTimeout | quote }}
+        - name: RETRY_ENABLED
+          value: 'yes'
+        - name: MS_METRICS
+          value: {{ .Values.prometheusScraping.enabled | default "false" | quote }}
+        volumeMounts: 
+        {{- if .Values.extraVolumeMounts }}
+        {{- include "common.tplvalues.render" (dict "value" .Values.extraVolumeMounts "context" $) | nindent 8 }}
+        {{- end }}   
+        securityContext:
+          {{- toYaml .Values.microservices.account.securityContext | nindent 10 }}
+        resources: {{- toYaml .Values.microservices.account.resources | nindent 10 }}
+      volumes:
+      {{- if .Values.extraVolumes }}
+      {{- include "common.tplvalues.render" (dict "value" .Values.extraVolumes "context" $) | nindent 6 }}
+      {{- end }}
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      terminationGracePeriodSeconds: 30
+{{- end }}
+
+# vi: ts=8 et sw=2 smarttab
--- a/deploy/rocket-chat/templates/microservices-account-service.yaml
+++ b/deploy/rocket-chat/templates/microservices-account-service.yaml
@@ -0,0 +1,26 @@
+{{- if .Values.microservices.enabled }}
+  {{- if .Values.prometheusScraping.enabled }}
+    {{- $service := .Values.service -}}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}-account
+  annotations:
+    prometheus.io/path: "/metrics"
+    prometheus.io/scrape: "true"
+    prometheus.io/port: "{{ .Values.prometheusScraping.port }}"
+    {{- with $service.annotations }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  type: ClusterIP
+  ports:
+  - name: metrics
+    targetPort: 9458
+    port: 9458
+    protocol: TCP
+  selector:
+      app.kubernetes.io/name: {{ .Release.Name }}-account
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  {{- end }}
+{{- end }}
--- a/deploy/rocket-chat/templates/microservices-authorization-deployment.yaml
+++ b/deploy/rocket-chat/templates/microservices-authorization-deployment.yaml
@@ -0,0 +1,91 @@
+{{- if .Values.microservices.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}-authorization
+  labels:
+    app.kubernetes.io/name: {{ include "rocketchat.name" . }}
+    helm.sh/chart: {{ include "rocketchat.chart" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- if .Values.deploymentLabels }}
+      {{- toYaml .Values.deploymentLabels | nindent 4 }}
+    {{- end }}
+spec:
+  replicas: {{ .Values.microservices.authorization.replicas }}
+  revisionHistoryLimit: 0
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ .Release.Name }}-authorization
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  strategy:
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 1
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: {{ .Release.Name }}-authorization
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        {{- if .Values.podLabels }}
+          {{- toYaml .Values.podLabels | nindent 8 }}
+        {{- end }}
+      annotations:
+        {{ include "rocketchat.annotations" (dict "name" "authorization" "context" $) | indent 8 }}
+   
+    spec:
+      tolerations:
+        {{ include "rocketchat.tolerations" (dict "name" "authorization" "context" $) | indent 8 }}
+      nodeSelector:
+        {{ include "rocketchat.nodeSelector" (dict "name" "authorization" "context" $) | indent 8 }}
+      affinity:
+        {{ include "rocketchat.nodeAffinity" (dict "name" "authorization" "context" $) | indent 8 }}      
+      containers:
+      - name: authorization-service
+        image: "{{ .Values.microservices.authorization.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+        env:
+        {{- if .Values.existingMongodbSecret }}
+        - name: MONGO_URL
+          valueFrom:
+            secretKeyRef:
+              name: {{ .Values.existingMongodbSecret }}
+              key: mongo-uri
+        {{- else }}
+        - name: MONGO_URL
+          valueFrom:
+            secretKeyRef:
+              name: {{ template "rocketchat.fullname" . }}
+              key: mongo-uri
+        {{- end }}
+        - name: TRANSPORTER
+          value: nats://{{ .Release.Name }}-nats:4222
+        - name: MOLECULER_LOG_LEVEL
+          value: {{ .Values.microservices.logLevel | quote }}
+        - name: HEARTBEAT_INTERVAL
+          value: {{ .Values.microservices.heartbeatInterval | quote }}
+        - name: HEARTBEAT_TIMEOUT
+          value: {{ .Values.microservices.heartbeatTimeout | quote }}
+        - name: RETRY_ENABLED
+          value: 'yes'
+        - name: MS_METRICS
+          value: {{ .Values.prometheusScraping.enabled | default "false" | quote }}
+        volumeMounts: 
+        {{- if .Values.extraVolumeMounts }}
+        {{- include "common.tplvalues.render" (dict "value" .Values.extraVolumeMounts "context" $) | nindent 8 }}
+        {{- end }}   
+        securityContext:
+          {{- toYaml .Values.microservices.authorization.securityContext | nindent 10 }}
+        resources: {{- toYaml .Values.microservices.authorization.resources | nindent 10 }}
+      volumes:
+      {{- if .Values.extraVolumes }}
+      {{- include "common.tplvalues.render" (dict "value" .Values.extraVolumes "context" $) | nindent 6 }}
+      {{- end }}
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      terminationGracePeriodSeconds: 30
+{{- end }}
+
+{{/* vi: ts=8 et sw=2 smarttab */}}
--- a/deploy/rocket-chat/templates/microservices-authorization-service.yaml
+++ b/deploy/rocket-chat/templates/microservices-authorization-service.yaml
@@ -0,0 +1,26 @@
+{{- if .Values.microservices.enabled }}
+  {{- if .Values.prometheusScraping.enabled }}
+    {{- $service := .Values.service -}}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}-authorization
+  annotations:
+    prometheus.io/path: "/metrics"
+    prometheus.io/scrape: "true"
+    prometheus.io/port: "{{ .Values.prometheusScraping.port }}"
+    {{- with $service.annotations }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  type: ClusterIP
+  ports:
+  - name: metrics
+    targetPort: 9458
+    port: 9458
+    protocol: TCP
+  selector:
+    app.kubernetes.io/name: {{ .Release.Name }}-authorization
+    app.kubernetes.io/instance: {{ .Release.Name }}
+  {{- end }}
+{{- end }}
--- a/deploy/rocket-chat/templates/microservices-ddp-streamer-deployment.yaml
+++ b/deploy/rocket-chat/templates/microservices-ddp-streamer-deployment.yaml
@@ -0,0 +1,91 @@
+{{- if .Values.microservices.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}-ddp-streamer
+  labels:
+    app.kubernetes.io/name: {{ include "rocketchat.name" . }}
+    helm.sh/chart: {{ include "rocketchat.chart" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- if .Values.deploymentLabels }}
+      {{- toYaml .Values.deploymentLabels | nindent 4 }}
+    {{- end }}
+spec:
+  replicas: {{ .Values.microservices.ddpStreamer.replicas }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ .Release.Name }}-ddp-streamer
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  strategy:
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 1
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: {{ .Release.Name }}-ddp-streamer
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        {{- if .Values.podLabels }}
+          {{- toYaml .Values.podLabels | nindent 8 }}
+        {{- end }}
+      annotations:
+        {{ include "rocketchat.annotations" (dict "name" "ddpStreamer" "context" $) | indent 8 }}
+    spec:
+      tolerations:
+        {{ include "rocketchat.tolerations" (dict "name" "ddpStreamer" "context" $) | indent 8 }}
+      nodeSelector:
+        {{ include "rocketchat.nodeSelector" (dict "name" "ddpStreamer" "context" $) | indent 8 }}      
+      affinity:
+        {{ include "rocketchat.nodeAffinity" (dict "name" "ddpStreamer" "context" $) | indent 8 }}         
+      containers:
+      - name: ddp-streamer
+        image: "{{ .Values.microservices.ddpStreamer.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+        env:
+        {{- if .Values.existingMongodbSecret }}
+        - name: MONGO_URL
+          valueFrom:
+            secretKeyRef:
+              name: {{ .Values.existingMongodbSecret }}
+              key: mongo-uri
+        {{- else }}
+        - name: MONGO_URL
+          valueFrom:
+            secretKeyRef:
+              name: {{ template "rocketchat.fullname" . }}
+              key: mongo-uri
+        {{- end }}
+        - name: TRANSPORTER
+          value: nats://{{ .Release.Name }}-nats:4222
+        - name: MOLECULER_LOG_LEVEL
+          value: {{ .Values.microservices.logLevel | quote }}
+        - name: PORT
+          value: '3000'
+        - name: HEARTBEAT_INTERVAL
+          value: {{ .Values.microservices.heartbeatInterval | quote }}
+        - name: HEARTBEAT_TIMEOUT
+          value: {{ .Values.microservices.heartbeatTimeout | quote }}
+        - name: RETRY_ENABLED
+          value: 'yes'
+        - name: MS_METRICS
+          value: {{ .Values.prometheusScraping.enabled | default "false" | quote }}
+        volumeMounts: 
+        {{- if .Values.extraVolumeMounts }}
+        {{- include "common.tplvalues.render" (dict "value" .Values.extraVolumeMounts "context" $) | nindent 8 }}
+        {{- end }}   
+        securityContext:
+          {{- toYaml .Values.microservices.ddpStreamer.securityContext | nindent 10 }}
+        resources: {{- toYaml .Values.microservices.ddpStreamer.resources | nindent 10 }}
+      volumes:
+      {{- if .Values.extraVolumes }}
+      {{- include "common.tplvalues.render" (dict "value" .Values.extraVolumes "context" $) | nindent 6 }}
+      {{- end }}
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      terminationGracePeriodSeconds: 30
+{{- end }}
+
+{{/* vi: ts=8 et sw=2 smarttab */}}
--- a/deploy/rocket-chat/templates/microservices-ddp-streamer-service.yaml
+++ b/deploy/rocket-chat/templates/microservices-ddp-streamer-service.yaml
@@ -0,0 +1,33 @@
+{{- if .Values.microservices.enabled }}
+{{- $service := .Values.service -}}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}-ddp-streamer
+  annotations:
+    {{- if .Values.prometheusScraping.enabled }}
+    prometheus.io/path: "/metrics"
+    prometheus.io/scrape: "true"
+    prometheus.io/port: "{{ .Values.prometheusScraping.port }}"
+    {{- end }}
+    {{- with $service.annotations }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  type: ClusterIP
+  sessionAffinity: None
+  ports:
+  - name: http
+    targetPort: 3000
+    port: 3000
+    protocol: TCP
+  {{- if .Values.prometheusScraping.enabled }}
+  - name: metrics
+    targetPort: 9458
+    port: 9458
+    protocol: TCP
+  {{- end }}
+  selector:
+    app.kubernetes.io/name: {{ .Release.Name }}-ddp-streamer
+    app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
--- a/deploy/rocket-chat/templates/microservices-presence-deployment.yaml
+++ b/deploy/rocket-chat/templates/microservices-presence-deployment.yaml
@@ -0,0 +1,90 @@
+{{- if .Values.microservices.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}-presence
+  labels:
+    app.kubernetes.io/name: {{ include "rocketchat.name" . }}
+    helm.sh/chart: {{ include "rocketchat.chart" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- if .Values.deploymentLabels }}
+      {{- toYaml .Values.deploymentLabels | nindent 4 }}
+    {{- end }}
+spec:
+  replicas: {{ .Values.microservices.presence.replicas }}
+  revisionHistoryLimit: 0
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ .Release.Name }}-presence
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  strategy:
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 1
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: {{ .Release.Name }}-presence
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        {{- if .Values.podLabels }}
+          {{- toYaml .Values.podLabels | nindent 8 }}
+        {{- end }}
+      annotations:
+    {{ include "rocketchat.annotations" (dict "name" "presence" "context" $) | indent 8 }}
+    spec:
+      tolerations:
+        {{ include "rocketchat.tolerations" (dict "name" "presence" "context" $) | indent 8 }}
+      nodeSelector:
+        {{ include "rocketchat.nodeSelector" (dict "name" "presence" "context" $) | indent 8 }}      
+      affinity:
+        {{ include "rocketchat.nodeAffinity" (dict "name" "presence" "context" $) | indent 8 }}   
+      containers:
+      - name: presence-service
+        image: "{{ .Values.microservices.presence.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+        env:
+        {{- if .Values.existingMongodbSecret }}
+        - name: MONGO_URL
+          valueFrom:
+            secretKeyRef:
+              name: {{ .Values.existingMongodbSecret }}
+              key: mongo-uri
+        {{- else }}
+        - name: MONGO_URL
+          valueFrom:
+            secretKeyRef:
+              name: {{ template "rocketchat.fullname" . }}
+              key: mongo-uri
+        {{- end }}
+        - name: TRANSPORTER
+          value: nats://{{ .Release.Name }}-nats:4222
+        - name: MOLECULER_LOG_LEVEL
+          value: {{ .Values.microservices.logLevel | quote }}
+        - name: HEARTBEAT_INTERVAL
+          value: {{ .Values.microservices.heartbeatInterval | quote }}
+        - name: HEARTBEAT_TIMEOUT
+          value: {{ .Values.microservices.heartbeatTimeout | quote }}
+        - name: RETRY_ENABLED
+          value: 'yes'
+        - name: MS_METRICS
+          value: {{ .Values.prometheusScraping.enabled | default "false" | quote }}
+        volumeMounts: 
+        {{- if .Values.extraVolumeMounts }}
+        {{- include "common.tplvalues.render" (dict "value" .Values.extraVolumeMounts "context" $) | nindent 8 }}
+        {{- end }}   
+        securityContext:
+          {{- toYaml .Values.microservices.presence.securityContext | nindent 10 }}
+        resources: {{- toYaml .Values.microservices.presence.resources | nindent 10 }}
+      volumes:
+      {{- if .Values.extraVolumes }}
+      {{- include "common.tplvalues.render" (dict "value" .Values.extraVolumes "context" $) | nindent 6 }}
+      {{- end }}
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      terminationGracePeriodSeconds: 30
+{{- end }}
+
+{{/* vi: ts=8 et sw=2 smarttab */}}
--- a/deploy/rocket-chat/templates/microservices-presence-service.yaml
+++ b/deploy/rocket-chat/templates/microservices-presence-service.yaml
@@ -0,0 +1,26 @@
+{{- if .Values.microservices.enabled }}
+  {{- if .Values.prometheusScraping.enabled }}
+    {{- $service := .Values.service -}}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}-presence
+  annotations:
+    prometheus.io/path: "/metrics"
+    prometheus.io/scrape: "true"
+    prometheus.io/port: "{{ .Values.prometheusScraping.port }}"
+    {{- with $service.annotations }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  type: ClusterIP
+  ports:
+  - name: metrics
+    targetPort: 9458
+    port: 9458
+    protocol: TCP
+  selector:
+    app.kubernetes.io/name: {{ .Release.Name }}-presence
+    app.kubernetes.io/instance: {{ .Release.Name }}
+  {{- end }}
+{{- end }}
--- a/deploy/rocket-chat/templates/microservices-stream-hub-deployment.yaml
+++ b/deploy/rocket-chat/templates/microservices-stream-hub-deployment.yaml
@@ -0,0 +1,100 @@
+{{- if .Values.microservices.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}-stream-hub
+  labels:
+    app.kubernetes.io/name: {{ include "rocketchat.name" . }}
+    helm.sh/chart: {{ include "rocketchat.chart" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- if .Values.deploymentLabels }}
+      {{- toYaml .Values.deploymentLabels | nindent 4 }}
+    {{- end }}
+spec:
+  replicas: 1
+  revisionHistoryLimit: 0
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ .Release.Name }}-stream-hub
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  strategy:
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: {{ .Release.Name }}-stream-hub
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        {{- if .Values.podLabels }}
+          {{- toYaml .Values.podLabels | nindent 8 }}
+        {{- end }}
+      annotations:
+       {{ include "rocketchat.annotations" (dict "name" "streamHub" "context" $) | indent 8 }}
+    spec:
+      tolerations:
+        {{ include "rocketchat.tolerations" (dict "name" "streamHub" "context" $) | indent 8 }}
+      nodeSelector:
+        {{ include "rocketchat.nodeSelector" (dict "name" "streamHub" "context" $) | indent 8 }}      
+      affinity:
+        {{ include "rocketchat.nodeAffinity" (dict "name" "streamHub" "context" $) | indent 8 }}   
+      containers:
+      - name: stream-hub
+        image: "{{ .Values.microservices.streamHub.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+        env:
+        {{- if .Values.existingMongodbSecret }}
+        - name: MONGO_URL
+          valueFrom:
+            secretKeyRef:
+              name: {{ .Values.existingMongodbSecret }}
+              key: mongo-uri
+        - name: MONGO_OPLOG_URL
+          valueFrom:
+            secretKeyRef:
+              name: {{ .Values.existingMongodbSecret }}
+              key: mongo-oplog-uri
+        {{- else }}
+        - name: MONGO_URL
+          valueFrom:
+            secretKeyRef:
+              name: {{ template "rocketchat.fullname" . }}
+              key: mongo-uri
+        - name: MONGO_OPLOG_URL
+          valueFrom:
+            secretKeyRef:
+              name: {{ template "rocketchat.fullname" . }}
+              key: mongo-oplog-uri
+        {{- end }}
+        - name: TRANSPORTER
+          value: nats://{{ .Release.Name }}-nats:4222
+        - name: MOLECULER_LOG_LEVEL
+          value: {{ .Values.microservices.logLevel | quote }}
+        - name: HEARTBEAT_INTERVAL
+          value: {{ .Values.microservices.heartbeatInterval | quote }}
+        - name: HEARTBEAT_TIMEOUT
+          value: {{ .Values.microservices.heartbeatTimeout | quote }}
+        - name: RETRY_ENABLED
+          value: 'yes'
+        - name: MS_METRICS
+          value: {{ .Values.prometheusScraping.enabled | default "false" | quote }}
+        volumeMounts: 
+        {{- if .Values.extraVolumeMounts }}
+        {{- include "common.tplvalues.render" (dict "value" .Values.extraVolumeMounts "context" $) | nindent 8 }}
+        {{- end }}   
+        securityContext:
+          {{- toYaml .Values.microservices.streamHub.securityContext | nindent 10 }}
+        resources: {{- toYaml .Values.microservices.streamHub.resources | nindent 10 }}
+      volumes:
+      {{- if .Values.extraVolumes }}
+      {{- include "common.tplvalues.render" (dict "value" .Values.extraVolumes "context" $) | nindent 6 }}
+      {{- end }}
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      terminationGracePeriodSeconds: 30
+{{- end }}
+
+{{/* vi: ts=8 et sw=2 smarttab */}}
--- a/deploy/rocket-chat/templates/microservices-stream-hub-service.yaml
+++ b/deploy/rocket-chat/templates/microservices-stream-hub-service.yaml
@@ -0,0 +1,26 @@
+{{- if .Values.microservices.enabled }}
+  {{- if .Values.prometheusScraping.enabled }}
+    {{- $service := .Values.service -}}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}-stream-hub
+  annotations:
+    prometheus.io/path: "/metrics"
+    prometheus.io/scrape: "true"
+    prometheus.io/port: "{{ .Values.prometheusScraping.port }}"
+    {{- with $service.annotations }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  type: ClusterIP
+  ports:
+  - name: metrics
+    targetPort: 9458
+    port: 9458
+    protocol: TCP
+  selector:
+    app.kubernetes.io/name: {{ .Release.Name }}-stream-hub
+    app.kubernetes.io/instance: {{ .Release.Name }}
+  {{- end }}
+{{- end }}
--- a/deploy/rocket-chat/templates/mongodb-init-configmap.yaml
+++ b/deploy/rocket-chat/templates/mongodb-init-configmap.yaml
@@ -0,0 +1,62 @@
+{{- if .Values.mongodb.enabled }}
+---
+{{/* {{ $config := lookup "v1" "ConfigMap" .Release.Namespace "rocketchat-mongodb-fix-clustermonitor-role-configmap" }} */}}
+{{/*   {{ if not $config }} */}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: rocketchat-mongodb-fix-clustermonitor-role-configmap
+  labels:
+    app.kubernetes.io/name: {{ include "rocketchat.name" . }}
+    helm.sh/chart: {{ include "rocketchat.chart" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+
+data:
+  user_set_role_clusterMonitor.sh: |
+    #! /bin/bash
+
+    # #include <everything>
+    source /opt/bitnami/scripts/libmongodb.sh
+
+    error_and_abort() {
+      error "$@"
+      exit 1
+    }
+
+    main() {
+      # mongodb_wait_for_primary_node "$MONGODB_INITIAL_PRIMARY_HOST" "$MONGODB_INITIAL_PRIMARY_PORT_NUMBER" "$MONGODB_INITIAL_PRIMARY_ROOT_USER" "$MONGODB_INITIAL_PRIMARY_ROOT_PASSWORD"
+      # Shouldn't be looping over all dbs, but currently no way of knowing which db is for rocketchat
+      # and which might not be.
+      # Either way, having clusterMonitor role shouldn't hurt 
+      local databases=(${MONGODB_EXTRA_DATABASES/,/ })
+      local usernames+=(${MONGODB_EXTRA_USERNAMES/,/ })
+      # each array should be of the same length
+      local database username last=$((${#databases[@]}-1))
+      for idx in $(seq 0 $last); do
+        database=${databases[$idx]}
+        username=${usernames[$idx]}
+        info "attempting to add clusterMonitor role to user $username"
+        local cmd="
+            db.getSiblingDB('$database').grantRolesToUser(
+            '$username',
+            [
+                {
+                role: 'clusterMonitor',
+                db: 'admin'
+                }
+            ]
+            )
+        "
+        debug "Executing: ${cmd:5:-1}"
+        local out=$(mongodb_execute_print_output "$MONGODB_ROOT_USER" "$MONGODB_ROOT_PASSWORD" "admin" "" "" "--quiet" <<< "$cmd")
+        # local ok=$(perl -MJSON -0ne 'print decode_json($_)->{"ok"}' <<< "$out")
+        local ok=$(awk '/ok:/ { print $2 }' <<< ${out/,/})
+        { [[ -n $out ]] && ! ((ok)); } && error_and_abort "failed to add role clusterMonitor to user \"$username\"; Error: $out"
+        info "clusterMonitor role added to $username"
+      done
+    }
+
+    main
+  {{/* {{end}} */}}
+{{- end }}
--- a/deploy/rocket-chat/templates/poddisruptionbudget.yaml
+++ b/deploy/rocket-chat/templates/poddisruptionbudget.yaml
@@ -0,0 +1,17 @@
+{{- if and (.Values.podDisruptionBudget.enabled) (gt ( .Values.replicaCount | int ) 1) }}
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  labels:
+    app.kubernetes.io/name: {{ include "rocketchat.name" . }}
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+  name: {{ template "rocketchat.fullname" . }}
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ include "rocketchat.name" . }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  minAvailable: {{ .Values.minAvailable }}
+{{- end }}
--- a/deploy/rocket-chat/templates/pvc.yaml
+++ b/deploy/rocket-chat/templates/pvc.yaml
@@ -0,0 +1,26 @@
+{{- if .Values.persistence.enabled -}}
+{{- if not .Values.persistence.existingClaim -}}
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: {{ template "rocketchat.fullname" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "rocketchat.name" . }}
+    helm.sh/chart: {{ include "rocketchat.chart" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+spec:
+  accessModes:
+    - {{ .Values.persistence.accessMode | quote }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.size | quote }}
+{{- if .Values.persistence.storageClass }}
+{{- if (eq "-" .Values.persistence.storageClass) }}
+  storageClassName: ""
+{{- else }}
+  storageClassName: "{{ .Values.persistence.storageClass }}"
+{{- end }}
+{{- end }}
+{{- end -}}
+{{- end -}}
--- a/deploy/rocket-chat/templates/scripts-configmap.yaml
+++ b/deploy/rocket-chat/templates/scripts-configmap.yaml
@@ -0,0 +1,148 @@
+{{- if .Values.mongodb.enabled }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: "{{ template "rocketchat.fullname" . }}-scripts"
+  labels:
+    app.kubernetes.io/name: {{ include "rocketchat.name" . }}
+    helm.sh/chart: {{ include "rocketchat.chart" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+
+data:
+  verifyMongodb.js: |
+    const versions = [
+      "4.0",
+      "4.2",
+      "4.4",
+      "5.0",
+      "6.0"
+    ];
+    // [0]=mongosh path, [1]=mongosh path, [2]=connection string, [3]=script path, [4]=new tag
+    const newVersion = process.argv[4].split('.').splice(0, 2).join('.');
+    const currentVersion = db.version().split('.').splice(0, 2).join('.');
+    if (currentVersion === newVersion) quit(0);
+    const featureCompatibilityVersionResp = db.adminCommand({ getParameter:
+      1, featureCompatibilityVersion: 1 });
+    if (!featureCompatibilityVersionResp.ok) {
+      print("failed to read current feature compatibility version");
+      quit(1);
+    }
+    const featureCompatibilityVersion = featureCompatibilityVersionResp.featureCompatibilityVersion.version;
+    if (featureCompatibilityVersion !== currentVersion) {
+      print("current feature compatibility version is incompatible with the mongodb version you're trying to update to");
+      quit(1);
+    }
+    if (versions.indexOf(newVersion) - versions.indexOf(currentVersion) !== 1) {
+      print("you can't skip a mongodb version while updating, please read our update documentation for more information");
+      quit(1);
+    }
+    quit(0);
+  updateSynapseHomeserverConfig.sh: |
+    [[ $(basename $SHELL) != "bash" ]] && {
+      echo "must be run in bash"
+      exit 1
+    } || :
+
+    set -x
+    _data_dir="${SYNAPSE_DATA_DIR:-/data}"
+    _data_dir="${_data_dir%/}"
+    _config_dir="${SYNAPSE_CONFIG_DIR:-/data}"
+    _config_dir="${_config_dir%/}"
+
+    start_or_exit() {
+      if [ "$1" = "--start" ]; then
+        exec /start.py
+      fi
+
+      exit 0
+    }
+
+    _remove_block() {
+      local type="${1^^}"
+      #local type="$(printf "%s" "$1" | tr '[[:lower:]]' '[[:upper:]]')"
+      local file="$2"
+      local start="@@@ $type ($(basename $HOMESERVER_EXTRA_CONFIG)) START @@@"
+      local end="@@@ $type ($(basename $HOMESERVER_EXTRA_CONFIG)) END @@@"
+
+      local l1="$(awk "/$start/ {print NR; exit}" "$file")"
+      local l2="$(awk "/$end/ {print NR; exit}" "$file")"
+
+      if [ -z "$l1" -o -z "$l2" ]; then
+        return
+      fi
+
+      sed -i "${l1},${l2}d" $file
+    }
+
+    remove_extra_config() {
+      _remove_block "extra config" "$HOMESERVER"
+    }
+
+    add_extra_config() {
+      if [ "$(tail -n 1 "$HOMESERVER" | base64)" != "Cg==" ]; then # `echo | base64`
+        printf "\n" >> "$HOMESERVER" 
+      fi
+
+      echo "# @@@ EXTRA CONFIG START ($(basename $HOMESERVER_EXTRA_CONFIG)) @@@" >>"$HOMESERVER"
+      cat "$HOMESERVER_EXTRA_CONFIG" >> "$HOMESERVER"
+      echo "# @@@ EXTRA CONFIG END ($(basename $HOMESERVER_EXTRA_CONFIG)) @@@" >>"$HOMESERVER"
+    }
+
+    hash() {
+      sha256sum "$1" | awk '{ print $1 }'
+    }
+
+    hash_file() {
+      local basename \
+            name \
+      basename="$(basename "$1")"
+      name=".${basename%.*}_hash"
+      echo -n "${_config_dir}/${name}"
+    }
+
+    extra_config_hash() {
+      hash "$HOMESERVER_EXTRA_CONFIG"
+    }
+
+    extra_config_current_hash() {
+      [[ -f "$(hash_file "$HOMESERVER_EXTRA_CONFIG")" ]] || return ""
+      cat "$(hash_file "$HOMESERVER_EXTRA_CONFIG")"
+    }
+
+    _save_hash() {
+      hash "$1" > "$(hash_file "$1")"
+    }
+
+    save_extra_config_hash() {
+      _save_hash "$HOMESERVER_EXTRA_CONFIG"
+    }
+
+    HOMESERVER="${SYNAPSE_CONFIG_PATH:-$(ls "$_config_dir"/homeserver.y{a,}ml 2>/dev/null)}"
+
+    if [ -z "$HOMESERVER" -o ! -f "$HOMESERVER" ]; then
+      echo "homeserver config not found: \"$HOMESERVER\"" >&2
+      exit 1
+    fi
+
+    if [ -z "$HOMESERVER_EXTRA_CONFIG" ]; then
+      start_or_exit
+    fi
+
+    current_hash="$(extra_config_hash)"
+    expected_hash="$(extra_config_current_hash)"
+
+    if [ "$expected_hash" = "$current_hash" ]; then
+      echo "extra config hashes matched, ignoring append op."
+      exit 0
+    fi
+
+    echo "extra config hashes mismatch, re-setting extra config" >&2
+    remove_extra_config
+    add_extra_config
+    save_extra_config_hash
+
+    start_or_exit
+
+{{- end }}
--- a/deploy/rocket-chat/templates/service.yaml
+++ b/deploy/rocket-chat/templates/service.yaml
@@ -0,0 +1,72 @@
+{{- $service := .Values.service -}}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "rocketchat.fullname" . }}
+  annotations:
+    {{- if .Values.prometheusScraping.enabled }}
+    prometheus.io/path: "/metrics"
+    prometheus.io/scrape: "true"
+    prometheus.io/port: "{{ .Values.prometheusScraping.port }}"
+    {{- end }}
+{{- with $service.annotations }}
+{{ toYaml . | indent 4 }}
+{{- end }}
+  labels:
+    app.kubernetes.io/name: {{ include "rocketchat.name" . }}
+    helm.sh/chart: {{ include "rocketchat.chart" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- with $service.labels }}
+{{ toYaml . | indent 4 }}
+{{- end }}
+spec:
+  type: {{ $service.type }}
+  {{- if eq .Values.service.type "LoadBalancer" }}
+  loadBalancerIP: {{ .Values.service.loadBalancerIP }}
+  {{- end }}
+  ports:
+  - name: http
+    port: {{ $service.port }}
+    targetPort: http
+    {{- if and (eq "NodePort" $service.type) $service.nodePort }}
+    nodePort: {{ $service.nodePort }}
+    {{- end }}
+    protocol: TCP
+{{- if .Values.prometheusScraping.enabled }}
+  {{- if .Values.microservices.enabled }}
+  - name: moleculer-metrics
+    port: 9458
+    targetPort: 9458
+    protocol: TCP
+  {{- end }}
+  - name: metrics
+    port: {{ .Values.prometheusScraping.port }}
+    targetPort: {{ .Values.prometheusScraping.port }}
+    protocol: TCP
+{{- end }}
+  selector:
+    app.kubernetes.io/name: {{ include "rocketchat.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+---
+{{ if .Values.federation.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "rocketchat.fullname" . }}-bridge
+  labels:
+    app.kubernetes.io/name: {{ include "rocketchat.fullname" . }}-bridge
+    helm.sh/chart: {{ include "rocketchat.chart" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+spec:
+  type: ClusterIP
+  ports:
+  - name: http
+    port: 3300
+    targetPort: 3300
+    protocol: TCP
+  selector:
+    app.kubernetes.io/name: {{ include "rocketchat.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+{{end}}
--- a/deploy/rocket-chat/templates/serviceaccount.yaml
+++ b/deploy/rocket-chat/templates/serviceaccount.yaml
@@ -0,0 +1,15 @@
+{{ if .Values.serviceAccount.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app.kubernetes.io/name: {{ include "rocketchat.name" . }}
+    helm.sh/chart: {{ include "rocketchat.chart" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  name: {{ template "rocketchat.serviceAccountName" . }}
+{{- end -}}
--- a/deploy/rocket-chat/templates/servicemonitor.yaml
+++ b/deploy/rocket-chat/templates/servicemonitor.yaml
@@ -0,0 +1,38 @@
+{{- if and .Values.serviceMonitor.enabled .Values.prometheusScraping.enabled}}
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: {{ template "rocketchat.fullname" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "rocketchat.name" . }}
+    helm.sh/chart: {{ include "rocketchat.chart" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+spec:
+  endpoints:
+    {{- $ports := .Values.serviceMonitor.ports -}}
+    {{- $intervals := .Values.serviceMonitor.intervals -}}
+    {{- with .Values.serviceMonitor.port -}}
+    {{- if not (has . $ports) -}}
+    {{- $ports = append $ports . -}}
+    {{- end -}}
+    {{- end -}}
+    {{- with .Values.serviceMonitor.interval -}}
+    {{- if not (has . $intervals) -}}
+    {{- $intervals = append $intervals . -}}
+    {{- end -}}
+    {{- end -}}
+    {{- if not (eq (len $ports) (len $intervals)) -}}
+    {{- fail "servicemonitor ports and intervals lengths must be equal" -}}
+    {{- end -}}
+
+    {{- range $index := len $ports | until }}
+    - port: {{ index $ports $index }}
+      interval: {{ index $intervals $index }}
+    {{- end }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ include "rocketchat.name" . }}
+      helm.sh/chart: {{ include "rocketchat.chart" . }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
--- a/deploy/rocket-chat/templates/synapse.yaml
+++ b/deploy/rocket-chat/templates/synapse.yaml
@@ -0,0 +1,230 @@
+{{- if .Values.federation.enabled }}
+{{- if not .Values.federation.ignoreRocketChatVersion }} {{/* this can be removed at any point, used just for testing */}}
+{{- if (eq (semver "6.6.4" | (semver .Chart.AppVersion).Compare) -1) }}
+{{- fail "federation must be used with rocket.chat version >= 6.6.4" }}
+{{- end }}
+{{- end }}
+{{- $secret := include "rocketchat.fullname" . | printf "%s-synapse" | lookup "v1" "Secret" .Release.Namespace }}
+{{- $hs_token := "" }}
+{{- $as_token := "" }}
+{{- $bridge_url :=  printf "http://%s-bridge:3300" (include "rocketchat.fullname" .) -}}
+{{- $id := "" }}
+{{- if $secret }}
+{{- $hs_token = $secret.data.hs_token | b64dec -}}
+{{- $as_token = $secret.data.as_token | b64dec -}}
+{{- $id = $secret.data.appservice_id | b64dec -}}
+{{- else }}
+{{- $hs_token = randAlphaNum 26 | b64enc | quote -}}
+{{- $as_token = randAlphaNum 24 | b64enc | quote -}}
+{{- $id = randAlphaNum 14 | b64enc | printf "rocketchat_%s" -}}
+{{- end }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "rocketchat.fullname" . }}-synapse
+  labels:
+    app.kubernetes.io/name: {{ include "rocketchat.name" . }}-synapse
+    helm.sh/chart: {{ include "rocketchat.chart" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+
+stringData:
+  as_token: {{ $as_token }}
+  hs_token: {{ $hs_token }}
+  bridge_url: {{ $bridge_url }}
+  appservice_id: {{ $id }}
+  homeserver.append.yaml: |
+    app_service_config_files:
+      - /registration.yaml
+
+    retention:
+      enabled: true
+
+    enable_registration: true
+    enable_registration_without_verification: true
+    suppress_key_server_warning: true
+
+    allow_public_rooms_without_auth: true
+    allow_public_rooms_over_federation: true
+
+    use_appservice_legacy_authorization: true
+
+  {{- if .Values.postgresql.enabled }}
+
+  {{- if (not (or (include "postgresql.v1.createSecret" .Subcharts.postgresql) .Values.federation.extraConfigSecret)) }}
+  {{- fail "postgres password must be in values.yaml or passed through federation.extraConfigSecretName" }}
+  {{- end }}
+
+    database:
+      name: psycopg2
+      args:
+        user: {{ include "postgresql.v1.username" .Subcharts.postgresql }}
+        password: {{ .Values.postgresql.auth.password }} {{/* FIXME(debdut): this needs to be better, https://github.com/bitnami/charts/blob/8edf559ce9db3515aad61f5c8cb261b1c19bc93a/bitnami/postgresql/templates/secrets.yaml#L23 */}}
+        database: {{ include "postgresql.v1.database" .Subcharts.postgresql }}
+        host: {{ include "postgresql.v1.primary.svc.headless" .Subcharts.postgresql }} 
+        cp_min: 5
+        cp_max: 10
+      allow_unsafe_locale: true
+
+  {{- end }}
+
+  registration.yaml: |
+    id: {{ $id }}
+    hs_token: {{ $hs_token }}
+    as_token: {{ $as_token }}
+    url: {{ $bridge_url }}
+    sender_localpart: rocket.cat
+    namespaces:
+      users:
+        - exclusive: false
+          regex: .*
+      rooms:
+        - exclusive: false
+          regex: .*
+      aliases:
+        - exclusive: false
+          regex: .*
+    de.sorunome.msc2409.push_ephemeral: false
+---
+apiVersion: {{ template "deployment.apiVersion" . }}
+kind: Deployment
+metadata:
+  name: {{ template "rocketchat.fullname" . }}-synapse
+  labels:
+    app.kubernetes.io/name: {{ include "rocketchat.fullname" . }}-synapse
+    helm.sh/chart: {{ include "rocketchat.chart" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ include "rocketchat.fullname" . }}-synapse
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: {{ include "rocketchat.fullname" . }}-synapse
+        app.kubernetes.io/instance: {{ .Release.Name }}
+    spec:
+      initContainers:
+        - name: generate
+          image: {{ .Values.federation.image.registry }}/{{ .Values.federation.image.repository }}:{{ .Values.federation.image.tag }}
+          volumeMounts:
+          - name: data
+            mountPath: /data
+          command: ["/start.py", 'generate']
+          env:
+            - name: SYNAPSE_SERVER_NAME
+              value: {{ .Values.host }}
+            - name: SYNAPSE_REPORT_STATS
+              value: 'no'
+        - name: append
+          image: {{ .Values.federation.image.registry }}/{{ .Values.federation.image.repository }}:{{ .Values.federation.image.tag }} 
+          env:
+            - name: HOMESERVER_EXTRA_CONFIG
+              value: /__homeserver.append.yaml
+          volumeMounts:
+          - name: scripts
+            mountPath: /scripts
+          - name: data
+            mountPath: /data
+          - name: config
+            mountPath: /__homeserver.append.yaml
+            subPath: homeserver.append.yaml
+          command:
+            - bash
+            - /scripts/updateSynapseHomeserverConfig.sh
+      containers:
+      - image: {{ .Values.federation.image.registry }}/{{ .Values.federation.image.repository }}:{{ .Values.federation.image.tag }} 
+        name: synapse
+        env:
+          {{- if .Values.federation.extraConfigSecret }}
+          - name: HOMESERVER_EXTRA_CONFIG
+            value: /homeserver.extra.yaml
+        command:
+          - bash
+          - /scripts/updateSynapseHomeserverConfig.sh
+          - --start
+          {{- end }}
+        volumeMounts:
+        - name: data
+          mountPath: /data
+        - name: config
+          mountPath: /registration.yaml
+          subPath: registration.yaml
+        - name: scripts
+          mountPath: /scripts
+        {{- with .Values.federation.extraConfigSecret }}
+        - name: extraConfig
+          mountPath: /homeserver.extra.yaml
+          subPath: {{ .key | quote }}
+        {{- end }}
+        ports:
+          - containerPort: 8008
+      volumes:
+      - name: scripts
+        configMap:
+          name: {{ template "rocketchat.fullname" . }}-scripts
+      - name: config
+        secret:
+          secretName: {{ template "rocketchat.fullname" . }}-synapse
+      {{- with .Values.federation.extraConfigSecret }}
+      - name: extraConfig
+        secret:
+          secretName: {{ .name | quote }}
+      {{- end }}
+      - name: data
+        {{- if .Values.federation.persistence.enabled }}
+        persistentVolumeClaim:
+          claimName: {{ if .Values.federation.persistence.existingClaim }}{{ .Values.federation.persistence.existingClaim }}{{- else }}{{ template "rocketchat.fullname" . }}-synapse {{- end }} 
+        {{- else }}
+        emptyDir: {}
+        {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "rocketchat.fullname" . }}-synapse
+  labels:
+    app.kubernetes.io/name: {{ include "rocketchat.fullname" . }}-synapse
+    helm.sh/chart: {{ include "rocketchat.chart" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+spec:
+  type: ClusterIP
+  ports:
+  - name: http
+    port: 8008
+    targetPort: 8008
+    protocol: TCP
+  selector:
+    app.kubernetes.io/name: {{ include "rocketchat.fullname" . }}-synapse
+    app.kubernetes.io/instance: {{ .Release.Name }}
+---
+{{- if (and .Values.federation.persistence.enabled (not .Values.federation.persistence.existingClaim)) }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+
+metadata:
+  name: {{ template "rocketchat.fullname" . }}-synapse
+  labels:
+    app.kubernetes.io/name: {{ include "rocketchat.fullname" . }}-synapse
+    helm.sh/chart: {{ include "rocketchat.chart" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+
+spec:
+  {{- if .Values.federation.persistence.storageClassName }}
+  storageClassName: {{ .Values.federation.persistence.storageClassName }}
+  {{ end }}
+  accessModes:
+    {{- range .Values.federation.persistence.accessModes }}
+    - {{ . }}
+    {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.federation.persistence.resources.requests.storage | default "10Gi" }}
+{{- end -}}
+{{ end }}
--- a/deploy/rocket-chat/templates/tests/test-rocketchat-startup.yaml
+++ b/deploy/rocket-chat/templates/tests/test-rocketchat-startup.yaml
@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "{{ .Release.Name }}-startup-test"
+  annotations:
+    "helm.sh/hook": test
+spec:
+  containers:
+    - name: {{ .Release.Name }}-startup-test
+      image: r0zbot/rocketchat-test-utils
+      imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
+      {{- if .Values.securityContext.enabled }}
+      securityContext:
+        runAsUser: {{ .Values.securityContext.runAsUser }}
+      {{- end }}
+      env:
+        - name: ROCKETCHAT_HOST
+          value: http://{{ template "rocketchat.fullname" . }}.{{ .Release.Namespace }}
+      command:
+        - /bin/bash
+        - -ec
+        - echo "testing host $ROCKETCHAT_HOST" && ./wait_http.sh "$ROCKETCHAT_HOST" && ./basic_test.sh "$ROCKETCHAT_HOST"
+  restartPolicy: Never