782d8015c5
W2.5.F — three Catalyst Blueprint umbrella charts at platform/{openmeter,
livekit,matrix}/, each declaring its upstream chart under Chart.yaml
`dependencies:` so `helm dependency build` bundles the upstream payload
into the published OCI artifact (per docs/BLUEPRINT-AUTHORING.md §11.1
— hollow charts forbidden, CI-enforced by issue #181).
Per-chart kind summary
======================
bp-openmeter (closes #272)
default `helm template` kinds: ConfigMap, Deployment, Service, ServiceAccount
upstream chart: openmeter 1.0.0-beta.213 (oci://ghcr.io/openmeterio/helm-charts)
ClickHouse-less profile per docs/BOOTSTRAP-KIT-EXPANSION-PLAN.md §6.4.
The upstream chart's bundled clickhouse / kafka / postgresql / redis /
svix subcharts are all DISABLED — Catalyst supplies CNPG (postgres),
JetStream (event bus), and Valkey (redis-compat) at the platform tier.
Chart-level toggle `catalystBlueprint.backend.kind` (default `cnpg`,
alt `clickhouse`) records the active profile so observability/audit
pipelines can report it. The OpenMeter binary's
`aggregation.clickhouse.address` is left blank — per-Sovereign overlay
supplies it once a host cluster adds bp-clickhouse and the operator
re-rolls with `backend.kind: clickhouse`. Catalyst overlay templates
(NetworkPolicy / ServiceMonitor / HPA) all default OFF per
docs/BLUEPRINT-AUTHORING.md §11.2.
bp-livekit (closes #273)
default `helm template` kinds: ConfigMap, Deployment, Service, ServiceAccount
upstream chart: livekit-server 1.9.0 (https://helm.livekit.io)
WebRTC SFU. Powers the Huawei iFlytek voice demo. Catalyst defaults
pair LiveKit with bp-stunner (the upstream chart's bundled co-located
TURN server is OFF; per-Sovereign overlay points the LiveKit TURN
config at the stunner UDP-gateway Service). RTC UDP port range is
50000-60000 (matches the Hetzner firewall rule the per-Sovereign
overlay opens). Catalyst overlay templates (NetworkPolicy /
ServiceMonitor / HPA) all default OFF; the chart's NetworkPolicy
template documents that LiveKit's hostNetwork mode means pod-level
policies do NOT cover the SFU port range — the firewall rule is the
load-bearing control. blueprint.yaml `depends:` declares bp-stunner +
bp-cert-manager + bp-valkey.
bp-matrix (closes #274)
default `helm template` kinds: ConfigMap, Deployment, Ingress, Job,
PersistentVolumeClaim, Pod, Role, RoleBinding, Secret, Service,
ServiceAccount
upstream chart: matrix-synapse 3.12.25 (https://ananace.gitlab.io/charts)
Synapse (the Matrix server implementation, NOT the retired OpenOva
product noun). Federation OFF by default (Catalyst per-Sovereign
tenancy default — operator overlays flip it on per-Organization).
Postgres backend via bp-cnpg externalPostgresql; OIDC SSO via
bp-keycloak; bundled bitnami postgresql + redis subcharts both
disabled. Catalyst overlay NetworkPolicy gates the federation port
(8448) on `federation.enabled` — verified by Case 5 of the
observability-toggle test. Catalyst-overlay ServiceMonitor (upstream
chart has none) + HPA both default OFF.
Lint
====
All three charts pass `helm lint` clean (only the noisy "icon is
recommended" INFO message).
Observability tests
===================
Each chart's `tests/observability-toggle.sh` enforces the Catalyst
contract from docs/BLUEPRINT-AUTHORING.md §11.2:
Case 1: default render produces zero monitoring.coreos.com/v1
resources (no ServiceMonitor / PrometheusRule).
Case 2: opt-in (--set serviceMonitor.enabled=true --api-versions
monitoring.coreos.com/v1) renders a ServiceMonitor.
Case 3: explicit-off render is clean.
Case 4 (per chart):
- openmeter: ClickHouse-less profile asserts no
clickhouse.altinity.com / Kafka subchart resources leak into the
default render.
- livekit: asserts upstream livekit-server.serviceMonitor.create
defaults false.
- matrix: asserts default render carries an empty
federation_domain_whitelist (the per-Sovereign tenancy default).
Case 5 (matrix only): `--set federation.enabled=true networkPolicy
.enabled=true` opens port 8448 in the Catalyst NetworkPolicy.
All gates green for all three charts.
Closes #272 #273 #274
Co-authored-by: hatiyildiz <hatice.yildiz@openova.io>
98 lines
3.4 KiB
YAML
98 lines
3.4 KiB
YAML
apiVersion: catalyst.openova.io/v1alpha1
|
|
kind: Blueprint
|
|
metadata:
|
|
name: bp-openmeter
|
|
labels:
|
|
catalyst.openova.io/category: application
|
|
catalyst.openova.io/section: pts-4-8-identity-and-metering
|
|
spec:
|
|
version: 1.0.0
|
|
card:
|
|
title: OpenMeter
|
|
summary: |
|
|
Real-time usage metering. CloudEvents ingestion, deterministic
|
|
per-subject aggregation, OpenAPI Query endpoint. Used by
|
|
bp-fingate (Open Banking) to meter API calls per TPP for
|
|
monetization, and available to any Application that needs
|
|
per-event usage tracking. omantel-1 ships the ClickHouse-less
|
|
profile per docs/BOOTSTRAP-KIT-EXPANSION-PLAN.md §6.4 — backend
|
|
writes go to bp-cnpg (PostgreSQL) and bp-nats-jetstream (event
|
|
bus). Re-roll with backend.kind=clickhouse once a host cluster
|
|
adds bp-clickhouse.
|
|
icon: openmeter.svg
|
|
category: application
|
|
tags: [metering, usage, billing, cloudevents, application]
|
|
documentation: https://openmeter.io/docs
|
|
license: Apache-2.0
|
|
visibility: listed
|
|
owner:
|
|
team: platform
|
|
contact: platform@openova.io
|
|
configSchema:
|
|
type: object
|
|
properties:
|
|
backend:
|
|
type: object
|
|
description: |
|
|
Aggregation backend selector. Catalyst defaults to `cnpg` —
|
|
the ClickHouse-less profile (CNPG materialized views + a
|
|
JetStream subject for raw events) per
|
|
docs/BOOTSTRAP-KIT-EXPANSION-PLAN.md §6.4. Re-roll with
|
|
`clickhouse` once a host cluster adds bp-clickhouse.
|
|
properties:
|
|
kind:
|
|
type: string
|
|
enum: [cnpg, clickhouse]
|
|
default: cnpg
|
|
description: |
|
|
`cnpg` (default): aggregate via CNPG materialized views,
|
|
raw events on a JetStream subject. `clickhouse`: route
|
|
aggregation to an external ClickHouse cluster supplied
|
|
by bp-clickhouse.
|
|
eventBus:
|
|
type: object
|
|
properties:
|
|
kind:
|
|
type: string
|
|
enum: [jetstream, kafka]
|
|
default: jetstream
|
|
description: |
|
|
Catalyst defaults to NATS JetStream (bp-nats-jetstream).
|
|
The upstream OpenMeter binary speaks Kafka natively;
|
|
Catalyst routes via the OpenTelemetry Collector or the
|
|
JetStream→Kafka shim documented at
|
|
docs/PLATFORM-TECH-STACK.md §4.8.
|
|
replicas:
|
|
type: integer
|
|
default: 1
|
|
minimum: 1
|
|
maximum: 10
|
|
serviceMonitor:
|
|
type: object
|
|
properties:
|
|
enabled:
|
|
type: boolean
|
|
default: false
|
|
description: |
|
|
monitoring.coreos.com/v1 ServiceMonitor — requires the
|
|
Prometheus Operator CRDs from kube-prometheus-stack.
|
|
Per docs/BLUEPRINT-AUTHORING.md §11.2 default false;
|
|
operator opts in via per-cluster overlay (issue #182).
|
|
placementSchema:
|
|
modes: [single-region, active-active]
|
|
default: single-region
|
|
manifests:
|
|
chart: ./chart
|
|
depends:
|
|
- blueprint: bp-cnpg # aggregation backend (ClickHouse-less profile)
|
|
version: ^1
|
|
- blueprint: bp-nats-jetstream # raw-event subject (ClickHouse-less profile)
|
|
version: ^1
|
|
- blueprint: bp-cert-manager # ingress TLS
|
|
version: ^1
|
|
upgrades:
|
|
from: ["0.x"]
|
|
observability:
|
|
metrics: prometheus
|
|
logs: stdout
|