c09109a61a
Edge + serverless + model-serving batch (W2.5.C) — three upstream- subchart umbrella Blueprints completing the bootstrap-kit slots for WebRTC media relay (bp-relay → bp-stunner) and the AI/ML serving stack (bp-cortex → bp-kserve → bp-knative). Each chart follows the canonical umbrella pattern from docs/BLUEPRINT-AUTHORING.md §11.1: Chart.yaml declares the upstream chart under `dependencies:` so `helm dependency build` bundles the upstream payload into the OCI artifact, and Catalyst-curated overlay values + templates sit alongside in chart/values.yaml + chart/templates/. Per-chart highlights: - bp-stunner/1.0.0 — wraps stunner/stunner-gateway-operator 1.1.0. Ships a Cilium-native GatewayClass (Capabilities-gated on gateway.networking.k8s.io/v1) so bp-relay (LiveKit / SFU) can claim Gateway CRs without an operator-ordering dance. Default UDP TURN port range 30000-32767 matches the range opened at the Sovereign edge firewall (Crossplane bp-firewall composition). - bp-knative/1.0.0 — wraps knative-operator v1.21.1. Ships a KnativeServing CR pre-configured for **istio-less mode** (ingress.istio.enabled=false, ingress.contour.enabled=false, ingress.kourier.enabled=false; config.network.ingress-class=cilium). Sovereign FQDN sourced from values, no hardcoded fallback per inviolable principle #4 — render fails loudly if cluster overlay doesn't set knativeOverlay.knativeServing.sovereignFqdn. - bp-kserve/1.0.0 — wraps kserve/kserve v0.16.0 (latest version published on the official OCI registry as of 2026-04-30). Default deploymentMode=RawDeployment (no Knative hop on the hot path) but bp-knative is still installed (declared as a hard dep) so per-IS annotation `serving.kserve.io/deploymentMode: Serverless` opts in to scale-to-zero per tenant. Cilium native Gateway-API ingress (enableGatewayApi=true, className=cilium, disableIstioVirtualHost= true). Observability discipline (issue #182): every observability toggle (ServiceMonitor, HPA, GatewayClass) defaults false and is operator- tunable via per-cluster overlay once bp-kube-prometheus-stack reconciles. Each chart ships tests/observability-toggle.sh covering default-off, opt-in (with `--api-versions monitoring.coreos.com/v1` to simulate Prometheus Operator CRDs), and explicit-off cases. Per-chart kind summary (helm template default render): bp-stunner: ClusterRole, ClusterRoleBinding, ConfigMap, Dataplane, Deployment, Role, RoleBinding, Service, ServiceAccount. (+ GatewayClass when --api-versions gateway.networking.k8s.io/v1 is passed.) bp-knative: ClusterRole, ClusterRoleBinding, ConfigMap, CustomResourceDefinition, Deployment, KnativeServing, Role, RoleBinding, Secret, Service, ServiceAccount. bp-kserve: Certificate, ClusterRole, ClusterRoleBinding, ClusterServingRuntime, ClusterStorageContainer, ConfigMap, Deployment, Gateway, Issuer, MutatingWebhookConfiguration, Role, RoleBinding, Service, ServiceAccount, ValidatingWebhookConfiguration. `helm lint` clean for all three (single INFO on missing icon — icons land with marketplace card work). `bash tests/observability-toggle.sh` green for all three (3 cases each: default-off, opt-in, explicit-off). Closes #263 #264 #265 Co-authored-by: hatiyildiz <hatice.yildiz@openova.io> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
84 lines
2.8 KiB
YAML
84 lines
2.8 KiB
YAML
apiVersion: catalyst.openova.io/v1alpha1
|
|
kind: Blueprint
|
|
metadata:
|
|
name: bp-stunner
|
|
labels:
|
|
catalyst.openova.io/section: pts-4-5-communication
|
|
spec:
|
|
version: 1.0.0
|
|
card:
|
|
title: STUNner
|
|
summary: |
|
|
K8s-native TURN/STUN media gateway for WebRTC NAT traversal. Wraps
|
|
the upstream `stunner/stunner-gateway-operator` chart and ships
|
|
Catalyst-curated NetworkPolicy + ServiceMonitor + HPA overlays.
|
|
Used by bp-relay (LiveKit) so WebRTC clients behind NATs reach the
|
|
in-cluster SFU. Cilium-native Gateway integration (no separate
|
|
Envoy/NGINX hop) — STUNner registers a GatewayClass + manages a
|
|
UDP-listening Gateway whose backing Service is exposed on the
|
|
Sovereign's UDP allocation port range (default 30000-32767, opened
|
|
at the Hetzner firewall by the Sovereign's bp-firewall composition).
|
|
icon: stunner.svg
|
|
category: communication
|
|
visibility: unlisted # bootstrap-kit infrastructure component
|
|
configSchema:
|
|
type: object
|
|
properties:
|
|
udpPortRange:
|
|
type: object
|
|
properties:
|
|
start:
|
|
type: integer
|
|
default: 30000
|
|
minimum: 1024
|
|
maximum: 65535
|
|
end:
|
|
type: integer
|
|
default: 32767
|
|
minimum: 1024
|
|
maximum: 65535
|
|
description: |
|
|
UDP port range allocated for TURN media relay. Must match the
|
|
range opened at the Sovereign's edge firewall. Default 30000-
|
|
32767 mirrors Hetzner Cloud Firewall convention.
|
|
dataplane:
|
|
type: object
|
|
properties:
|
|
mode:
|
|
type: string
|
|
enum: [legacy, managed]
|
|
default: managed
|
|
description: |
|
|
`managed` lets the gateway-operator dynamically render
|
|
dataplane Deployments per Gateway CR (recommended).
|
|
`legacy` runs a single static dataplane.
|
|
replicas:
|
|
type: integer
|
|
default: 1
|
|
minimum: 1
|
|
maximum: 10
|
|
gatewayClass:
|
|
type: object
|
|
properties:
|
|
create:
|
|
type: boolean
|
|
default: true
|
|
description: |
|
|
Render a `stunner.l7mp.io/v1` GatewayClass referencing
|
|
this operator. Cluster overlays MAY set false and ship
|
|
their own GatewayClass pointing at a different operator.
|
|
placementSchema:
|
|
modes: [single-region, active-active]
|
|
default: single-region
|
|
minRegions: 1
|
|
maxRegions: 3
|
|
manifests:
|
|
chart: ./chart
|
|
depends:
|
|
- blueprint: bp-cilium # Cilium GatewayClass / Gateway-API CRDs underpin the L4 path
|
|
version: ^1
|
|
- blueprint: bp-cert-manager # TURN-DTLS termination cert (per-Sovereign overlay)
|
|
version: ^1
|
|
upgrades:
|
|
from: ["0.x"]
|