skip to content
xmsg

Kubernetes & Helm

In Kubernetes clusters (including gVisor-sandboxed pods), xmsg runs either as a central federated hub or as an in-pod --leaf sidecar alongside a service worker (genie-guard, matrix-xmsg, or xmsg-mcp-gateway):

  • Pod node identity: A pod certificate carrying SPIFFE URI SAN spiffe://<trust-domain>/ns/<ns>/sa/<sa> derives the canonical node name <sa>.<ns> (see Federation).
  • Leaf sidecar mode (--leaf): Share an emptyDir volume mounted at $XDG_RUNTIME_DIR/xmsg between the service container and an xmsg container running under the same UID (10001). Leaf mode requires --listen, even when the service uses the shared Unix sockets: xmsg serve --leaf --leaf-principal svc:<name> --listen 127.0.0.1:7787 (or set XMSG_LISTEN). Keep the listener inside the pod’s isolated loopback namespace. See Hubs, Leaves & Gateways.
  • Secret rotation: xmsg serve polls --fed-cert, --fed-key, --peers-file, and ca bundles by SHA-256 content hash every 30 seconds (--fed-reload-interval-secs), picking up Kubernetes Secret symlink (..data) rotations automatically without restarting the pod.
palette
dark
light
↑↓ select↵ apply esc close

Palettes adapted from Catppuccin (Macchiato) (MIT), Tokyo Night (Apache-2.0), gruvbox (MIT), Catppuccin (Latte) (MIT), Rosé Pine (Dawn) (MIT).