openova/openova
1
0
Fork 0
Code Issues Pull Requests Actions 4 Packages Projects Releases Wiki Activity
362a377dc3
openova/platform/livekit
History
e3mrah 782d8015c5
feat(charts): bp-openmeter (CH-less) + bp-livekit + bp-matrix wrapper charts (closes #272 #273 #274) (#289) 
W2.5.F — three Catalyst Blueprint umbrella charts at platform/{openmeter,
livekit,matrix}/, each declaring its upstream chart under Chart.yaml
`dependencies:` so `helm dependency build` bundles the upstream payload
into the published OCI artifact (per docs/BLUEPRINT-AUTHORING.md §11.1
— hollow charts forbidden, CI-enforced by issue #181).

Per-chart kind summary
======================

bp-openmeter (closes #272)
  default `helm template` kinds: ConfigMap, Deployment, Service, ServiceAccount
  upstream chart: openmeter 1.0.0-beta.213 (oci://ghcr.io/openmeterio/helm-charts)

  ClickHouse-less profile per docs/BOOTSTRAP-KIT-EXPANSION-PLAN.md §6.4.
  The upstream chart's bundled clickhouse / kafka / postgresql / redis /
  svix subcharts are all DISABLED — Catalyst supplies CNPG (postgres),
  JetStream (event bus), and Valkey (redis-compat) at the platform tier.
  Chart-level toggle `catalystBlueprint.backend.kind` (default `cnpg`,
  alt `clickhouse`) records the active profile so observability/audit
  pipelines can report it. The OpenMeter binary's
  `aggregation.clickhouse.address` is left blank — per-Sovereign overlay
  supplies it once a host cluster adds bp-clickhouse and the operator
  re-rolls with `backend.kind: clickhouse`. Catalyst overlay templates
  (NetworkPolicy / ServiceMonitor / HPA) all default OFF per
  docs/BLUEPRINT-AUTHORING.md §11.2.

bp-livekit (closes #273)
  default `helm template` kinds: ConfigMap, Deployment, Service, ServiceAccount
  upstream chart: livekit-server 1.9.0 (https://helm.livekit.io)

  WebRTC SFU. Powers the Huawei iFlytek voice demo. Catalyst defaults
  pair LiveKit with bp-stunner (the upstream chart's bundled co-located
  TURN server is OFF; per-Sovereign overlay points the LiveKit TURN
  config at the stunner UDP-gateway Service). RTC UDP port range is
  50000-60000 (matches the Hetzner firewall rule the per-Sovereign
  overlay opens). Catalyst overlay templates (NetworkPolicy /
  ServiceMonitor / HPA) all default OFF; the chart's NetworkPolicy
  template documents that LiveKit's hostNetwork mode means pod-level
  policies do NOT cover the SFU port range — the firewall rule is the
  load-bearing control. blueprint.yaml `depends:` declares bp-stunner +
  bp-cert-manager + bp-valkey.

bp-matrix (closes #274)
  default `helm template` kinds: ConfigMap, Deployment, Ingress, Job,
  PersistentVolumeClaim, Pod, Role, RoleBinding, Secret, Service,
  ServiceAccount
  upstream chart: matrix-synapse 3.12.25 (https://ananace.gitlab.io/charts)

  Synapse (the Matrix server implementation, NOT the retired OpenOva
  product noun). Federation OFF by default (Catalyst per-Sovereign
  tenancy default — operator overlays flip it on per-Organization).
  Postgres backend via bp-cnpg externalPostgresql; OIDC SSO via
  bp-keycloak; bundled bitnami postgresql + redis subcharts both
  disabled. Catalyst overlay NetworkPolicy gates the federation port
  (8448) on `federation.enabled` — verified by Case 5 of the
  observability-toggle test. Catalyst-overlay ServiceMonitor (upstream
  chart has none) + HPA both default OFF.

Lint
====
All three charts pass `helm lint` clean (only the noisy "icon is
recommended" INFO message).

Observability tests
===================
Each chart's `tests/observability-toggle.sh` enforces the Catalyst
contract from docs/BLUEPRINT-AUTHORING.md §11.2:
  Case 1: default render produces zero monitoring.coreos.com/v1
          resources (no ServiceMonitor / PrometheusRule).
  Case 2: opt-in (--set serviceMonitor.enabled=true --api-versions
          monitoring.coreos.com/v1) renders a ServiceMonitor.
  Case 3: explicit-off render is clean.
  Case 4 (per chart):
    - openmeter: ClickHouse-less profile asserts no
      clickhouse.altinity.com / Kafka subchart resources leak into the
      default render.
    - livekit:   asserts upstream livekit-server.serviceMonitor.create
      defaults false.
    - matrix:    asserts default render carries an empty
      federation_domain_whitelist (the per-Sovereign tenancy default).
  Case 5 (matrix only): `--set federation.enabled=true networkPolicy
          .enabled=true` opens port 8448 in the Catalyst NetworkPolicy.

All gates green for all three charts.

Closes #272 #273 #274

Co-authored-by: hatiyildiz <hatice.yildiz@openova.io>
2026-04-30 19:37:28 +04:00
..
chart feat(charts): bp-openmeter (CH-less) + bp-livekit + bp-matrix wrapper charts (closes #272 #273 #274) (#289) 2026-04-30 19:37:28 +04:00
blueprint.yaml feat(charts): bp-openmeter (CH-less) + bp-livekit + bp-matrix wrapper charts (closes #272 #273 #274) (#289) 2026-04-30 19:37:28 +04:00
README.md feat(charts): bp-openmeter (CH-less) + bp-livekit + bp-matrix wrapper charts (closes #272 #273 #274) (#289) 2026-04-30 19:37:28 +04:00

README.md

bp-livekit

WebRTC SFU. Catalyst Application Blueprint. Real-time video, audio, and data routing — powers the Huawei iFlytek voice demo and any Application that needs sub-second media. Pairs with bp-stunner for K8s-native TURN/STUN. See docs/PLATFORM-TECH-STACK.md §4.5 (Communication).

Status: Accepted | Updated: 2026-04-30

Overview

LiveKit is the WebRTC Selective Forwarding Unit (SFU). Catalyst pairs it with bp-stunner so NAT traversal works without exposing a TURN server's UDP port to the public internet.

Catalyst integration

Component Integration
bp-stunner K8s-native TURN/STUN — Catalyst routes LiveKit's TURN config at the stunner UDP-gateway Service
bp-cert-manager TLS via cluster Issuer
bp-valkey Signaling-state store when replicaCount > 1
bp-keycloak (Optional) JWT identity for WebRTC participants

Hetzner firewall

LiveKit binds the UDP port range 50000-60000 for RTC traffic. The per-Sovereign Hetzner firewall rule (Tofu-managed) opens this range to the world. Pod-level NetworkPolicies do NOT cover host-network pods — the firewall rule is the load-bearing control. See docs/SECURITY.md §4.

Chart shape

platform/livekit/
├── blueprint.yaml                     # Catalyst Blueprint CRD
├── chart/
│   ├── Chart.yaml                     # umbrella; deps: livekit-server (Helm)
│   ├── values.yaml                    # Catalyst defaults; bundled TURN OFF
│   └── templates/
│       ├── _helpers.tpl
│       ├── networkpolicy.yaml         # default OFF (host-network caveat noted)
│       ├── servicemonitor.yaml        # default OFF (CRD-gated)
│       └── hpa.yaml                   # default OFF
├── chart/tests/observability-toggle.sh
└── README.md

Dependencies

Blueprint Purpose
bp-stunner K8s-native TURN/STUN (required for NAT traversal)
bp-cert-manager Ingress TLS via ClusterIssuer
bp-valkey Signaling-state store (only when scaling beyond a single replica)

Observability toggles (all default OFF)

Per docs/BLUEPRINT-AUTHORING.md §11.2.

Toggle Default Why
serviceMonitor.enabled false monitoring.coreos.com/v1 CRD ships with kube-prometheus-stack
livekit-server.serviceMonitor.create false upstream toggle — Catalyst restates the contract
networkPolicy.enabled false Operator supplies consumer-namespace selectors per-Sovereign
hpa.enabled false One LiveKit pod per node (port-range exclusivity)
livekit-server.autoscaling.enabled false Same — upstream HPA off

Verification

helm dependency update platform/livekit/chart
helm template platform/livekit/chart | grep -E "^kind:" | sort -u
helm lint platform/livekit/chart
bash platform/livekit/chart/tests/observability-toggle.sh

Part of OpenOva. Closes #273.