Skip to content

Commit ed20ace

Browse files
dom38dom38
committed
feat: add helm chart to deploy cortexflow
1 parent 00781f0 commit ed20ace

10 files changed

Lines changed: 600 additions & 0 deletions

File tree

‎helm/Chart.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
apiVersion: v2
2+
name: CortexBrain
3+
version: 0.1.0
4+
description: |
5+
This chart installs CortexFlow to a kubernetes cluster, instead of using the cli installation method.

‎helm/README.md‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
# CortexBrain
2+
3+
![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square)
4+
5+
This chart installs CortexFlow to a kubernetes cluster, instead of using the cli installation method.
6+
7+
## Values
8+
9+
| Key | Type | Default | Description |
10+
|-----|------|---------|-------------|
11+
| agent.image.repository | string | `"ghcr.io/cortexflow/agent"` | |
12+
| agent.image.version | string | `"latest"` | |
13+
| agent.priorityClassName | string | `""` | |
14+
| agent.resources.limits.memory | string | `"200Mi"` | |
15+
| agent.resources.requests.cpu | string | `"100m"` | |
16+
| agent.resources.requests.memory | string | `"100Mi"` | |
17+
| agent.securityContext.allowPrivilegeEscalation | bool | `true` | |
18+
| agent.securityContext.capabilities.add[0] | string | `"SYS_ADMIN"` | |
19+
| agent.securityContext.capabilities.add[1] | string | `"NET_ADMIN"` | |
20+
| agent.securityContext.capabilities.add[2] | string | `"SYS_RESOURCE"` | |
21+
| agent.securityContext.capabilities.add[3] | string | `"BPF"` | |
22+
| agent.securityContext.capabilities.add[4] | string | `"SYS_PTRACE"` | |
23+
| agent.securityContext.privileged | bool | `true` | |
24+
| agent.tolerations | list | `[]` | |
25+
| blocklist | string | `""` | |
26+
| bpfMapPermissions.image.repository | string | `"ubuntu"` | |
27+
| bpfMapPermissions.image.version | string | `"24.04"` | |
28+
| bpfMapPermissions.securityContext.allowPrivilegeEscalation | bool | `true` | |
29+
| bpfMapPermissions.securityContext.capabilities.add[0] | string | `"SYS_ADMIN"` | |
30+
| bpfMapPermissions.securityContext.capabilities.add[1] | string | `"NET_ADMIN"` | |
31+
| bpfMapPermissions.securityContext.capabilities.add[2] | string | `"SYS_RESOURCE"` | |
32+
| bpfMapPermissions.securityContext.capabilities.add[3] | string | `"BPF"` | |
33+
| bpfMapPermissions.securityContext.capabilities.add[4] | string | `"SYS_PTRACE"` | |
34+
| bpfMapPermissions.securityContext.privileged | bool | `true` | |
35+
| bpfMapPermissions.securityContext.runAsUser | int | `0` | |
36+
| bpfTool.image.repository | string | `"danielpacak/bpftool-runner"` | |
37+
| bpfTool.image.version | string | `"latest"` | |
38+
| bpfTool.resources.limits.cpu | string | `"1"` | |
39+
| bpfTool.resources.limits.memory | string | `"200Mi"` | |
40+
| bpfTool.resources.requests.cpu | string | `"1"` | |
41+
| bpfTool.resources.requests.memory | string | `"100Mi"` | |
42+
| bpfTool.securityContext.allowPrivilegeEscalation | bool | `true` | |
43+
| bpfTool.securityContext.capabilities.add[0] | string | `"SYS_ADMIN"` | |
44+
| bpfTool.securityContext.capabilities.add[1] | string | `"NET_ADMIN"` | |
45+
| bpfTool.securityContext.capabilities.add[2] | string | `"SYS_RESOURCE"` | |
46+
| bpfTool.securityContext.capabilities.add[3] | string | `"BPF"` | |
47+
| bpfTool.securityContext.capabilities.add[4] | string | `"SYS_PTRACE"` | |
48+
| bpfTool.securityContext.privileged | bool | `true` | |
49+
| global.otel.endpoint | string | `"http://localhost:4317"` | |
50+
| global.otel.protocol | string | `"grpc"` | |
51+
| global.priorityClassName | string | `""` | |
52+
| global.tolerations | list | `[]` | |
53+
| identity.image.repository | string | `"ghcr.io/cortexflow/identity"` | |
54+
| identity.image.version | string | `"latest"` | |
55+
| identity.priorityClassName | string | `""` | |
56+
| identity.resources.limits.memory | string | `"200Mi"` | |
57+
| identity.resources.requests.cpu | string | `"100m"` | |
58+
| identity.resources.requests.memory | string | `"100Mi"` | |
59+
| identity.securityContext.allowPrivilegeEscalation | bool | `true` | |
60+
| identity.securityContext.capabilities.add[0] | string | `"SYS_ADMIN"` | |
61+
| identity.securityContext.capabilities.add[1] | string | `"NET_ADMIN"` | |
62+
| identity.securityContext.capabilities.add[2] | string | `"SYS_RESOURCE"` | |
63+
| identity.securityContext.capabilities.add[3] | string | `"BPF"` | |
64+
| identity.securityContext.capabilities.add[4] | string | `"SYS_PTRACE"` | |
65+
| identity.securityContext.privileged | bool | `true` | |
66+
| identity.tolerations | list | `[]` | |
67+
| metrics.image.repository | string | `"ghcr.io/cortexflow/metrics"` | |
68+
| metrics.image.version | string | `"latest"` | |
69+
| metrics.priorityClassName | string | `""` | |
70+
| metrics.resources.limits.cpu | string | `"1"` | |
71+
| metrics.resources.limits.memory | string | `"200Mi"` | |
72+
| metrics.resources.requests.cpu | string | `"1"` | |
73+
| metrics.resources.requests.memory | string | `"100Mi"` | |
74+
| metrics.securityContext.allowPrivilegeEscalation | bool | `true` | |
75+
| metrics.securityContext.capabilities.add[0] | string | `"SYS_ADMIN"` | |
76+
| metrics.securityContext.capabilities.add[1] | string | `"NET_ADMIN"` | |
77+
| metrics.securityContext.capabilities.add[2] | string | `"SYS_RESOURCE"` | |
78+
| metrics.securityContext.capabilities.add[3] | string | `"BPF"` | |
79+
| metrics.securityContext.capabilities.add[4] | string | `"SYS_PTRACE"` | |
80+
| metrics.securityContext.privileged | bool | `true` | |
81+
| metrics.tolerations | list | `[]` | |
82+
| serviceAccountName | string | `"cortexflow-sa"` | |
83+
84+
----------------------------------------------
85+
Autogenerated from chart metadata using [helm-docs v1.14.2](https://github.com/norwoodj/helm-docs/releases/v1.14.2)

‎helm/templates/_helper.tpl‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{{/*
2+
Sets tolerations for daemonsets either from the global var or from individual values
3+
*/}}
4+
{{- define "common.tolerations" }}
5+
{{- $ctx := .context }}
6+
{{- $component := .component }}
7+
{{- $local := index $ctx.Values $component "tolerations" }}
8+
{{- $global := $ctx.Values.global.tolerations }}
9+
{{- if and (not (empty $local)) }}
10+
tolerations:
11+
{{ toYaml $local | indent 2 }}
12+
{{- else if and (not (empty $global)) }}
13+
tolerations:
14+
{{ toYaml $global | indent 2 }}
15+
{{- end }}
16+
{{- end }}
17+
18+
{{/*
19+
Sets priorityClassName for daemonsets either from the global var or from individual values
20+
*/}}
21+
{{- define "common.priorityClassName" }}
22+
{{- $ctx := .context }}
23+
{{- $component := .component }}
24+
{{- $local := index $ctx.Values $component "priorityClassName" }}
25+
{{- $global := $ctx.Values.global.priorityClassName }}
26+
{{- if and (not (empty $local)) }}
27+
priorityClassName: {{ toYaml $local }}
28+
{{- else if and (not (empty $global)) }}
29+
priorityClassName: {{ toYaml $global }}
30+
{{- end }}
31+
{{- end }}

‎helm/templates/agent.yaml‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
apiVersion: apps/v1
2+
kind: DaemonSet
3+
metadata:
4+
name: cortexflow-agent
5+
labels:
6+
app: cortexflow-agent
7+
spec:
8+
selector:
9+
matchLabels:
10+
app: cortexflow-agent
11+
template:
12+
metadata:
13+
labels:
14+
app: cortexflow-agent
15+
annotations:
16+
checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
17+
spec:
18+
serviceAccountName: {{ .Values.serviceAccountName }}
19+
hostPID: true
20+
hostNetwork: true
21+
{{- include "common.tolerations" (dict "context" . "component" "agent") | indent 6 }}
22+
{{- include "common.priorityClassName" (dict "context" . "component" "agent") | indent 6 }}
23+
containers:
24+
- name: agent
25+
image: "{{ .Values.agent.image.repository }}:{{ .Values.agent.image.version }}"
26+
command: ["/bin/bash", "-c"]
27+
args:
28+
- |
29+
echo "Running on kernel $(uname -r)"
30+
if [ ! -d "/sys/fs/bpf" ]; then
31+
echo "ERROR: BPF filesystem not mounted"
32+
exit 1
33+
else
34+
echo "Checking ebpf path..."
35+
ls -l /sys/fs/bpf
36+
fi
37+
echo "checking privileges"
38+
ls -ld /sys/fs/bpf
39+
40+
echo "checking if conntracker path"
41+
ls -l /usr/src/cortexbrain-agent/conntracker
42+
43+
echo "checking if the bpf maps are reachable"
44+
ls -l /sys/fs/bpf/maps
45+
46+
echo "Running application..."
47+
exec /usr/local/bin/agent-api || echo "Application exited with code $?"
48+
env:
49+
- name: OTEL_SERVICE_NAME
50+
value: cortexflow-agent
51+
- name: OTEL_EXPORTER_OTLP_ENDPOINT
52+
value: {{ .Values.global.otel.endpoint }}
53+
- name: OTEL_EXPORTER_OTLP_PROTOCOL
54+
value: {{ .Values.global.otel.protocol }}
55+
- name: OTEL_RESOURCE_ATTRIBUTES
56+
value: service.namespace=cortexflow,service.version=0.1.5
57+
- name: AGENT_API_ENABLE_REFLECTION
58+
value: "true"
59+
volumeMounts:
60+
- name: bpf
61+
mountPath: /sys/fs/bpf
62+
mountPropagation: Bidirectional
63+
readOnly: false
64+
- name: proc
65+
mountPath: /host/proc
66+
readOnly: false
67+
- name: kernel-dev
68+
mountPath: /lib/modules
69+
readOnly: false
70+
resources:
71+
{{- .Values.identity.resources | toYaml | nindent 12 }}
72+
securityContext:
73+
{{- .Values.agent.securityContext | toYaml | nindent 12 }}
74+
volumes:
75+
- name: bpf
76+
hostPath:
77+
path: /sys/fs/bpf
78+
type: Directory
79+
- name: proc
80+
hostPath:
81+
path: /proc
82+
type: Directory
83+
- name: kernel-dev
84+
hostPath:
85+
path: /lib/modules
86+
type: Directory
87+
88+
---
89+
90+
apiVersion: v1
91+
kind: Service
92+
metadata:
93+
name: cortexflow-agent
94+
namespace: cortexflow
95+
spec:
96+
selector:
97+
app: cortexflow-agent
98+
ports:
99+
- protocol: TCP
100+
name: agent-server-port
101+
port: 9090
102+
targetPort: 9090
103+
appProtocol: grpc
104+
type: ClusterIP
105+
106+
---

‎helm/templates/configmap-role.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: Role
3+
metadata:
4+
name: configmap-reader
5+
rules:
6+
- apiGroups: [""]
7+
resources: ["configmaps","services"]
8+
verbs: ["get", "list","watch"]
9+
---
10+
apiVersion: rbac.authorization.k8s.io/v1
11+
kind: RoleBinding
12+
metadata:
13+
name: configmap-reader-binding
14+
subjects:
15+
- kind: ServiceAccount
16+
name: {{ .Values.serviceAccountName }}
17+
namespace: {{ .Release.Namespace }}
18+
roleRef:
19+
kind: Role
20+
name: configmap-reader
21+
apiGroup: rbac.authorization.k8s.io

‎helm/templates/configmap.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: cortexbrain-client-config
5+
data:
6+
blocklist: {{ .Values.blocklist | quote }}

‎helm/templates/identity.yaml‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
apiVersion: apps/v1
2+
kind: DaemonSet
3+
metadata:
4+
name: cortexflow-identity
5+
labels:
6+
app: cortexflow-identity
7+
spec:
8+
selector:
9+
matchLabels:
10+
app: cortexflow-identity
11+
template:
12+
metadata:
13+
labels:
14+
app: cortexflow-identity
15+
annotations:
16+
checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
17+
spec:
18+
serviceAccountName: {{ .Values.serviceAccountName }}
19+
hostPID: true
20+
hostNetwork: true
21+
{{- include "common.tolerations" (dict "context" . "component" "identity") | indent 6 }}
22+
{{- include "common.priorityClassName" (dict "context" . "component" "identity") | indent 6 }}
23+
initContainers:
24+
- name: bpf-map-permissions
25+
image: "{{ .Values.bpfMapPermissions.image.repository }}:{{ .Values.bpfMapPermissions.image.version }}"
26+
command: ["/bin/bash","-c"]
27+
args:
28+
- |
29+
echo "mounting the bpf path "
30+
mount -t bpf bpf /sys/fs/bpf
31+
32+
echo "checking permissions"
33+
ls -ld /sys/fs/bpf
34+
volumeMounts:
35+
- name: bpf
36+
mountPath: /sys/fs/bpf
37+
mountPropagation: Bidirectional
38+
readOnly: false
39+
- name: kernel-dev
40+
mountPath: /lib/modules
41+
readOnly: false
42+
- name: cgroup
43+
mountPath: /sys/fs/cgroup
44+
readOnly: true
45+
securityContext:
46+
{{- .Values.bpfMapPermissions.securityContext | toYaml | nindent 12}}
47+
containers:
48+
- name: identity
49+
image: "{{ .Values.identity.image.repository }}:{{ .Values.identity.image.version }}"
50+
command: ["/bin/bash", "-c"]
51+
args:
52+
- |
53+
echo "Running on kernel $(uname -r)"
54+
if [ ! -d "/sys/fs/bpf" ]; then
55+
echo "ERROR: BPF filesystem not mounted"
56+
exit 1
57+
else
58+
echo "Checking ebpf path..."
59+
ls -l /sys/fs/bpf
60+
fi
61+
echo "checking privileges"
62+
ls -ld /sys/fs/bpf
63+
64+
echo "Running application..."
65+
exec /usr/local/bin/cortexflow-identity-service || echo "Application exited with code $?"
66+
env:
67+
- name: OTEL_SERVICE_NAME
68+
value: cortexflow-identity
69+
- name: OTEL_EXPORTER_OTLP_ENDPOINT
70+
value: {{ .Values.global.otel.endpoint }}
71+
- name: OTEL_EXPORTER_OTLP_PROTOCOL
72+
value: {{ .Values.global.otel.protocol }}
73+
- name: OTEL_RESOURCE_ATTRIBUTES
74+
value: service.namespace=cortexflow,service.version=0.1.5
75+
resources:
76+
{{- .Values.identity.resources | toYaml | nindent 12 }}
77+
volumeMounts:
78+
- name: bpf
79+
mountPath: /sys/fs/bpf
80+
mountPropagation: Bidirectional
81+
readOnly: false
82+
- name: kernel-dev
83+
mountPath: /lib/modules
84+
readOnly: false
85+
- name: cgroup
86+
mountPath: /sys/fs/cgroup
87+
readOnly: true
88+
securityContext:
89+
{{- .Values.identity.securityContext | toYaml | nindent 12 }}
90+
- name: bpftool-control-manager
91+
image: "{{ .Values.bpfTool.image.repository }}:{{ .Values.bpfTool.image.version }}"
92+
command: ["/bin/bash", "-c","sleep infinity"]
93+
volumeMounts:
94+
- name: bpf
95+
mountPath: /sys/fs/bpf
96+
mountPropagation: Bidirectional
97+
readOnly: false
98+
- name: kernel-dev
99+
mountPath: /lib/modules
100+
readOnly: false
101+
- name: cgroup
102+
mountPath: /sys/fs/cgroup
103+
readOnly: true
104+
resources:
105+
{{- .Values.bpfTool.resources | toYaml | nindent 12 }}
106+
securityContext:
107+
{{- .Values.bpfTool.securityContext | toYaml | nindent 12 }}
108+
volumes:
109+
- name: bpf
110+
hostPath:
111+
path: /sys/fs/bpf
112+
type: Directory
113+
- name: kernel-dev
114+
hostPath:
115+
path: /lib/modules
116+
type: Directory
117+
- name: cgroup
118+
hostPath:
119+
path: /sys/fs/cgroup
120+
type: Directory

0 commit comments

Comments
 (0)