openova/openova
1
0
Fork 0
Code Issues Pull Requests Actions 4 Packages Projects Releases Wiki Activity
d519dc8ba2
openova/platform/openmeter
History
e3mrah 782d8015c5
feat(charts): bp-openmeter (CH-less) + bp-livekit + bp-matrix wrapper charts (closes #272 #273 #274) (#289) 
W2.5.F — three Catalyst Blueprint umbrella charts at platform/{openmeter,
livekit,matrix}/, each declaring its upstream chart under Chart.yaml
`dependencies:` so `helm dependency build` bundles the upstream payload
into the published OCI artifact (per docs/BLUEPRINT-AUTHORING.md §11.1
— hollow charts forbidden, CI-enforced by issue #181).

Per-chart kind summary
======================

bp-openmeter (closes #272)
  default `helm template` kinds: ConfigMap, Deployment, Service, ServiceAccount
  upstream chart: openmeter 1.0.0-beta.213 (oci://ghcr.io/openmeterio/helm-charts)

  ClickHouse-less profile per docs/BOOTSTRAP-KIT-EXPANSION-PLAN.md §6.4.
  The upstream chart's bundled clickhouse / kafka / postgresql / redis /
  svix subcharts are all DISABLED — Catalyst supplies CNPG (postgres),
  JetStream (event bus), and Valkey (redis-compat) at the platform tier.
  Chart-level toggle `catalystBlueprint.backend.kind` (default `cnpg`,
  alt `clickhouse`) records the active profile so observability/audit
  pipelines can report it. The OpenMeter binary's
  `aggregation.clickhouse.address` is left blank — per-Sovereign overlay
  supplies it once a host cluster adds bp-clickhouse and the operator
  re-rolls with `backend.kind: clickhouse`. Catalyst overlay templates
  (NetworkPolicy / ServiceMonitor / HPA) all default OFF per
  docs/BLUEPRINT-AUTHORING.md §11.2.

bp-livekit (closes #273)
  default `helm template` kinds: ConfigMap, Deployment, Service, ServiceAccount
  upstream chart: livekit-server 1.9.0 (https://helm.livekit.io)

  WebRTC SFU. Powers the Huawei iFlytek voice demo. Catalyst defaults
  pair LiveKit with bp-stunner (the upstream chart's bundled co-located
  TURN server is OFF; per-Sovereign overlay points the LiveKit TURN
  config at the stunner UDP-gateway Service). RTC UDP port range is
  50000-60000 (matches the Hetzner firewall rule the per-Sovereign
  overlay opens). Catalyst overlay templates (NetworkPolicy /
  ServiceMonitor / HPA) all default OFF; the chart's NetworkPolicy
  template documents that LiveKit's hostNetwork mode means pod-level
  policies do NOT cover the SFU port range — the firewall rule is the
  load-bearing control. blueprint.yaml `depends:` declares bp-stunner +
  bp-cert-manager + bp-valkey.

bp-matrix (closes #274)
  default `helm template` kinds: ConfigMap, Deployment, Ingress, Job,
  PersistentVolumeClaim, Pod, Role, RoleBinding, Secret, Service,
  ServiceAccount
  upstream chart: matrix-synapse 3.12.25 (https://ananace.gitlab.io/charts)

  Synapse (the Matrix server implementation, NOT the retired OpenOva
  product noun). Federation OFF by default (Catalyst per-Sovereign
  tenancy default — operator overlays flip it on per-Organization).
  Postgres backend via bp-cnpg externalPostgresql; OIDC SSO via
  bp-keycloak; bundled bitnami postgresql + redis subcharts both
  disabled. Catalyst overlay NetworkPolicy gates the federation port
  (8448) on `federation.enabled` — verified by Case 5 of the
  observability-toggle test. Catalyst-overlay ServiceMonitor (upstream
  chart has none) + HPA both default OFF.

Lint
====
All three charts pass `helm lint` clean (only the noisy "icon is
recommended" INFO message).

Observability tests
===================
Each chart's `tests/observability-toggle.sh` enforces the Catalyst
contract from docs/BLUEPRINT-AUTHORING.md §11.2:
  Case 1: default render produces zero monitoring.coreos.com/v1
          resources (no ServiceMonitor / PrometheusRule).
  Case 2: opt-in (--set serviceMonitor.enabled=true --api-versions
          monitoring.coreos.com/v1) renders a ServiceMonitor.
  Case 3: explicit-off render is clean.
  Case 4 (per chart):
    - openmeter: ClickHouse-less profile asserts no
      clickhouse.altinity.com / Kafka subchart resources leak into the
      default render.
    - livekit:   asserts upstream livekit-server.serviceMonitor.create
      defaults false.
    - matrix:    asserts default render carries an empty
      federation_domain_whitelist (the per-Sovereign tenancy default).
  Case 5 (matrix only): `--set federation.enabled=true networkPolicy
          .enabled=true` opens port 8448 in the Catalyst NetworkPolicy.

All gates green for all three charts.

Closes #272 #273 #274

Co-authored-by: hatiyildiz <hatice.yildiz@openova.io>
2026-04-30 19:37:28 +04:00
..
chart feat(charts): bp-openmeter (CH-less) + bp-livekit + bp-matrix wrapper charts (closes #272 #273 #274) (#289) 2026-04-30 19:37:28 +04:00
blueprint.yaml feat(charts): bp-openmeter (CH-less) + bp-livekit + bp-matrix wrapper charts (closes #272 #273 #274) (#289) 2026-04-30 19:37:28 +04:00
README.md feat(charts): bp-openmeter (CH-less) + bp-livekit + bp-matrix wrapper charts (closes #272 #273 #274) (#289) 2026-04-30 19:37:28 +04:00

README.md

bp-openmeter

Real-time CloudEvents usage metering. Catalyst Application Blueprint — slot 45 of the omantel-1 bootstrap-kit. See docs/PLATFORM-TECH-STACK.md §4.8 (Identity & metering).

Status: Accepted | Updated: 2026-04-30

Overview

OpenMeter ingests CloudEvents, deterministically aggregates per-subject usage, and exposes an OpenAPI Query endpoint for downstream billing. Used by bp-fingate (Open Banking) to meter API calls per TPP for monetization, and available to any Application that needs per-event usage tracking.

Catalyst profile (omantel-1) — ClickHouse-less

Per docs/BOOTSTRAP-KIT-EXPANSION-PLAN.md §6.4, omantel-1 ships OpenMeter without the bundled ClickHouse cluster:

  • Aggregation backend: bp-cnpg (PostgreSQL materialized views)
  • Event bus: bp-nats-jetstream (raw event subject)
  • Cache: bp-valkey (Redis-compatible) — operator overlay supplies the connection string

The chart-level toggle that records the active profile is catalystBlueprint.backend.kind in chart/values.yaml (default cnpg). On a host cluster that later adds bp-clickhouse, the operator re-rolls the Application with backend.kind: clickhouse plus a per-Sovereign overlay supplying openmeter.config.aggregation.clickhouse.address.

Chart shape

platform/openmeter/
├── blueprint.yaml                     # Catalyst Blueprint CRD
├── chart/
│   ├── Chart.yaml                     # umbrella; deps: openmeter (OCI)
│   ├── values.yaml                    # ClickHouse-less profile defaults
│   └── templates/
│       ├── _helpers.tpl
│       ├── networkpolicy.yaml         # default OFF
│       ├── servicemonitor.yaml        # default OFF (CRD-gated)
│       └── hpa.yaml                   # default OFF
├── chart/tests/observability-toggle.sh
└── README.md

Dependencies

Blueprint Purpose
bp-cnpg aggregation backend (CNPG materialized views)
bp-nats-jetstream raw event subject
bp-cert-manager ingress TLS via ClusterIssuer

Observability toggles (all default OFF)

Per docs/BLUEPRINT-AUTHORING.md §11.2, every observability surface defaults false. Operator opts in via per-cluster overlay once bp-kube-prometheus-stack reconciles.

Toggle Default Why
serviceMonitor.enabled false monitoring.coreos.com/v1 CRD ships with kube-prometheus-stack
networkPolicy.enabled false Operator supplies consumer-namespace selectors per-Sovereign
hpa.enabled false Solo-Sovereign baseline is a single API replica

Verification

helm dependency update platform/openmeter/chart
helm template platform/openmeter/chart | grep -E "^kind:" | sort -u
helm lint platform/openmeter/chart
bash platform/openmeter/chart/tests/observability-toggle.sh

Part of OpenOva. Closes #272.