c09109a61a
Edge + serverless + model-serving batch (W2.5.C) — three upstream- subchart umbrella Blueprints completing the bootstrap-kit slots for WebRTC media relay (bp-relay → bp-stunner) and the AI/ML serving stack (bp-cortex → bp-kserve → bp-knative). Each chart follows the canonical umbrella pattern from docs/BLUEPRINT-AUTHORING.md §11.1: Chart.yaml declares the upstream chart under `dependencies:` so `helm dependency build` bundles the upstream payload into the OCI artifact, and Catalyst-curated overlay values + templates sit alongside in chart/values.yaml + chart/templates/. Per-chart highlights: - bp-stunner/1.0.0 — wraps stunner/stunner-gateway-operator 1.1.0. Ships a Cilium-native GatewayClass (Capabilities-gated on gateway.networking.k8s.io/v1) so bp-relay (LiveKit / SFU) can claim Gateway CRs without an operator-ordering dance. Default UDP TURN port range 30000-32767 matches the range opened at the Sovereign edge firewall (Crossplane bp-firewall composition). - bp-knative/1.0.0 — wraps knative-operator v1.21.1. Ships a KnativeServing CR pre-configured for **istio-less mode** (ingress.istio.enabled=false, ingress.contour.enabled=false, ingress.kourier.enabled=false; config.network.ingress-class=cilium). Sovereign FQDN sourced from values, no hardcoded fallback per inviolable principle #4 — render fails loudly if cluster overlay doesn't set knativeOverlay.knativeServing.sovereignFqdn. - bp-kserve/1.0.0 — wraps kserve/kserve v0.16.0 (latest version published on the official OCI registry as of 2026-04-30). Default deploymentMode=RawDeployment (no Knative hop on the hot path) but bp-knative is still installed (declared as a hard dep) so per-IS annotation `serving.kserve.io/deploymentMode: Serverless` opts in to scale-to-zero per tenant. Cilium native Gateway-API ingress (enableGatewayApi=true, className=cilium, disableIstioVirtualHost= true). Observability discipline (issue #182): every observability toggle (ServiceMonitor, HPA, GatewayClass) defaults false and is operator- tunable via per-cluster overlay once bp-kube-prometheus-stack reconciles. Each chart ships tests/observability-toggle.sh covering default-off, opt-in (with `--api-versions monitoring.coreos.com/v1` to simulate Prometheus Operator CRDs), and explicit-off cases. Per-chart kind summary (helm template default render): bp-stunner: ClusterRole, ClusterRoleBinding, ConfigMap, Dataplane, Deployment, Role, RoleBinding, Service, ServiceAccount. (+ GatewayClass when --api-versions gateway.networking.k8s.io/v1 is passed.) bp-knative: ClusterRole, ClusterRoleBinding, ConfigMap, CustomResourceDefinition, Deployment, KnativeServing, Role, RoleBinding, Secret, Service, ServiceAccount. bp-kserve: Certificate, ClusterRole, ClusterRoleBinding, ClusterServingRuntime, ClusterStorageContainer, ConfigMap, Deployment, Gateway, Issuer, MutatingWebhookConfiguration, Role, RoleBinding, Service, ServiceAccount, ValidatingWebhookConfiguration. `helm lint` clean for all three (single INFO on missing icon — icons land with marketplace card work). `bash tests/observability-toggle.sh` green for all three (3 cases each: default-off, opt-in, explicit-off). Closes #263 #264 #265 Co-authored-by: hatiyildiz <hatice.yildiz@openova.io> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
71 lines
2.5 KiB
YAML
71 lines
2.5 KiB
YAML
apiVersion: catalyst.openova.io/v1alpha1
|
|
kind: Blueprint
|
|
metadata:
|
|
name: bp-knative
|
|
labels:
|
|
catalyst.openova.io/section: pts-4-6-ai-ml
|
|
spec:
|
|
version: 1.0.0
|
|
card:
|
|
title: Knative
|
|
summary: |
|
|
Serverless platform for Kubernetes — scale-to-zero, request-driven
|
|
compute, traffic splitting. Wraps the upstream `knative-operator`
|
|
chart and ships a Catalyst-curated `KnativeServing` Custom Resource
|
|
configured for **istio-less** mode (Cilium native Gateway-API
|
|
ingress, no Istio sidecar). Foundation for bp-kserve model serving
|
|
and any application Blueprint that wants to run as a Knative
|
|
Service. Domain template per Sovereign FQDN.
|
|
icon: knative.svg
|
|
category: ai-ml
|
|
visibility: unlisted # bootstrap-kit infrastructure component
|
|
configSchema:
|
|
type: object
|
|
properties:
|
|
sovereignFqdn:
|
|
type: string
|
|
description: |
|
|
Domain root used by Knative Serving to template service URLs
|
|
(e.g. `<svc>.<ns>.<sovereign-fqdn>`). Required — Catalyst rule
|
|
per docs/INVIOLABLE-PRINCIPLES.md #4 forbids hardcoding a
|
|
fallback. Cluster overlays MUST set this to the Sovereign's
|
|
FQDN (matches `var.sovereign_fqdn` in the OpenTofu module).
|
|
ingressClass:
|
|
type: string
|
|
default: cilium
|
|
description: |
|
|
Knative ingress class. Catalyst defaults to Cilium native
|
|
Gateway-API (istio-less). Cluster overlays MAY switch to
|
|
another ingress class.
|
|
knativeServing:
|
|
type: object
|
|
properties:
|
|
create:
|
|
type: boolean
|
|
default: true
|
|
description: |
|
|
Render the `operator.knative.dev/v1beta1.KnativeServing`
|
|
CR alongside the operator. Cluster overlays MAY set false
|
|
and author their own KnativeServing CR with bespoke
|
|
high-availability / autoscaler tuning.
|
|
scaleToZero:
|
|
type: boolean
|
|
default: true
|
|
description: |
|
|
Enable scale-to-zero. Default true mirrors the value
|
|
proposition (cost savings on idle workloads).
|
|
placementSchema:
|
|
modes: [single-region, active-active]
|
|
default: single-region
|
|
minRegions: 1
|
|
maxRegions: 5
|
|
manifests:
|
|
chart: ./chart
|
|
depends:
|
|
- blueprint: bp-cilium # provides Gateway-API CRDs + native ingress class
|
|
version: ^1
|
|
- blueprint: bp-cert-manager # auto-TLS for Knative Serving routes
|
|
version: ^1
|
|
upgrades:
|
|
from: ["0.x"]
|