c09109a61a
Edge + serverless + model-serving batch (W2.5.C) — three upstream- subchart umbrella Blueprints completing the bootstrap-kit slots for WebRTC media relay (bp-relay → bp-stunner) and the AI/ML serving stack (bp-cortex → bp-kserve → bp-knative). Each chart follows the canonical umbrella pattern from docs/BLUEPRINT-AUTHORING.md §11.1: Chart.yaml declares the upstream chart under `dependencies:` so `helm dependency build` bundles the upstream payload into the OCI artifact, and Catalyst-curated overlay values + templates sit alongside in chart/values.yaml + chart/templates/. Per-chart highlights: - bp-stunner/1.0.0 — wraps stunner/stunner-gateway-operator 1.1.0. Ships a Cilium-native GatewayClass (Capabilities-gated on gateway.networking.k8s.io/v1) so bp-relay (LiveKit / SFU) can claim Gateway CRs without an operator-ordering dance. Default UDP TURN port range 30000-32767 matches the range opened at the Sovereign edge firewall (Crossplane bp-firewall composition). - bp-knative/1.0.0 — wraps knative-operator v1.21.1. Ships a KnativeServing CR pre-configured for **istio-less mode** (ingress.istio.enabled=false, ingress.contour.enabled=false, ingress.kourier.enabled=false; config.network.ingress-class=cilium). Sovereign FQDN sourced from values, no hardcoded fallback per inviolable principle #4 — render fails loudly if cluster overlay doesn't set knativeOverlay.knativeServing.sovereignFqdn. - bp-kserve/1.0.0 — wraps kserve/kserve v0.16.0 (latest version published on the official OCI registry as of 2026-04-30). Default deploymentMode=RawDeployment (no Knative hop on the hot path) but bp-knative is still installed (declared as a hard dep) so per-IS annotation `serving.kserve.io/deploymentMode: Serverless` opts in to scale-to-zero per tenant. Cilium native Gateway-API ingress (enableGatewayApi=true, className=cilium, disableIstioVirtualHost= true). Observability discipline (issue #182): every observability toggle (ServiceMonitor, HPA, GatewayClass) defaults false and is operator- tunable via per-cluster overlay once bp-kube-prometheus-stack reconciles. Each chart ships tests/observability-toggle.sh covering default-off, opt-in (with `--api-versions monitoring.coreos.com/v1` to simulate Prometheus Operator CRDs), and explicit-off cases. Per-chart kind summary (helm template default render): bp-stunner: ClusterRole, ClusterRoleBinding, ConfigMap, Dataplane, Deployment, Role, RoleBinding, Service, ServiceAccount. (+ GatewayClass when --api-versions gateway.networking.k8s.io/v1 is passed.) bp-knative: ClusterRole, ClusterRoleBinding, ConfigMap, CustomResourceDefinition, Deployment, KnativeServing, Role, RoleBinding, Secret, Service, ServiceAccount. bp-kserve: Certificate, ClusterRole, ClusterRoleBinding, ClusterServingRuntime, ClusterStorageContainer, ConfigMap, Deployment, Gateway, Issuer, MutatingWebhookConfiguration, Role, RoleBinding, Service, ServiceAccount, ValidatingWebhookConfiguration. `helm lint` clean for all three (single INFO on missing icon — icons land with marketplace card work). `bash tests/observability-toggle.sh` green for all three (3 cases each: default-off, opt-in, explicit-off). Closes #263 #264 #265 Co-authored-by: hatiyildiz <hatice.yildiz@openova.io> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
37 lines
1.6 KiB
YAML
37 lines
1.6 KiB
YAML
apiVersion: v2
|
|
name: bp-stunner
|
|
version: 1.0.0
|
|
description: |
|
|
Catalyst-curated Blueprint umbrella chart for STUNner — the K8s-native
|
|
TURN/STUN media gateway used by bp-relay (LiveKit) for WebRTC NAT
|
|
traversal. Depends on the upstream `stunner-gateway-operator` chart as
|
|
a Helm subchart so `helm dependency build` pulls the upstream payload
|
|
into this artifact; the Catalyst overlay templates in templates/
|
|
(NetworkPolicy guard, ServiceMonitor toggle, HPA toggle) sit alongside
|
|
the upstream subchart and Helm renders both at install time. Catalyst-
|
|
curated values flow into the upstream subchart under the
|
|
`stunner-gateway-operator:` key in values.yaml.
|
|
|
|
Cilium-native Gateway integration: STUNner registers a GatewayClass
|
|
(`stunner.l7mp.io/v1`) and the operator dynamically materializes
|
|
dataplane Deployments backing each Gateway CR. UDP port range default
|
|
30000-32767 matches the range opened at the Sovereign edge firewall
|
|
(bp-firewall Crossplane composition).
|
|
type: application
|
|
appVersion: "1.1.0"
|
|
keywords: [catalyst, blueprint, stunner, turn, stun, webrtc, gateway-api]
|
|
maintainers:
|
|
- name: OpenOva Catalyst
|
|
email: catalyst@openova.io
|
|
|
|
# Upstream chart pulled in as a Helm subchart so `helm dependency build`
|
|
# bundles it into the OCI artifact. Pinned to stunner/stunner-gateway-
|
|
# operator 1.1.0 (matches platform/stunner/blueprint.yaml +
|
|
# values.yaml `catalystBlueprint.upstream.version`). Per
|
|
# docs/INVIOLABLE-PRINCIPLES.md #4 (never hardcode) the version is
|
|
# operator-bumpable via PR + Blueprint release.
|
|
dependencies:
|
|
- name: stunner-gateway-operator
|
|
version: "1.1.0"
|
|
repository: "https://l7mp.io/stunner"
|