[#210]: add helm chart to deploy cortexflow

helm/Chart.yaml

@@ -0,0 +1,5 @@
+apiVersion: v2
+name: CortexBrain
+version: 0.1.0
+description: |
+  This chart installs CortexFlow to a kubernetes cluster, instead of using the cli installation method.

helm/README.md

@@ -0,0 +1,85 @@
+# CortexBrain
+
+![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square)
+
+This chart installs CortexFlow to a kubernetes cluster, instead of using the cli installation method.
+
+## Values
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| agent.image.repository | string | `"ghcr.io/cortexflow/agent"` |  |
+| agent.image.version | string | `"latest"` |  |
+| agent.priorityClassName | string | `""` |  |
+| agent.resources.limits.memory | string | `"200Mi"` |  |
+| agent.resources.requests.cpu | string | `"100m"` |  |
+| agent.resources.requests.memory | string | `"100Mi"` |  |
+| agent.securityContext.allowPrivilegeEscalation | bool | `true` |  |
+| agent.securityContext.capabilities.add[0] | string | `"SYS_ADMIN"` |  |
+| agent.securityContext.capabilities.add[1] | string | `"NET_ADMIN"` |  |
+| agent.securityContext.capabilities.add[2] | string | `"SYS_RESOURCE"` |  |
+| agent.securityContext.capabilities.add[3] | string | `"BPF"` |  |
+| agent.securityContext.capabilities.add[4] | string | `"SYS_PTRACE"` |  |
+| agent.securityContext.privileged | bool | `true` |  |
+| agent.tolerations | list | `[]` |  |
+| blocklist | string | `""` |  |
+| bpfMapPermissions.image.repository | string | `"ubuntu"` |  |
+| bpfMapPermissions.image.version | string | `"24.04"` |  |
+| bpfMapPermissions.securityContext.allowPrivilegeEscalation | bool | `true` |  |
+| bpfMapPermissions.securityContext.capabilities.add[0] | string | `"SYS_ADMIN"` |  |
+| bpfMapPermissions.securityContext.capabilities.add[1] | string | `"NET_ADMIN"` |  |
+| bpfMapPermissions.securityContext.capabilities.add[2] | string | `"SYS_RESOURCE"` |  |
+| bpfMapPermissions.securityContext.capabilities.add[3] | string | `"BPF"` |  |
+| bpfMapPermissions.securityContext.capabilities.add[4] | string | `"SYS_PTRACE"` |  |
+| bpfMapPermissions.securityContext.privileged | bool | `true` |  |
+| bpfMapPermissions.securityContext.runAsUser | int | `0` |  |
+| bpfTool.image.repository | string | `"danielpacak/bpftool-runner"` |  |
+| bpfTool.image.version | string | `"latest"` |  |
+| bpfTool.resources.limits.cpu | string | `"1"` |  |
+| bpfTool.resources.limits.memory | string | `"200Mi"` |  |
+| bpfTool.resources.requests.cpu | string | `"1"` |  |
+| bpfTool.resources.requests.memory | string | `"100Mi"` |  |
+| bpfTool.securityContext.allowPrivilegeEscalation | bool | `true` |  |
+| bpfTool.securityContext.capabilities.add[0] | string | `"SYS_ADMIN"` |  |
+| bpfTool.securityContext.capabilities.add[1] | string | `"NET_ADMIN"` |  |
+| bpfTool.securityContext.capabilities.add[2] | string | `"SYS_RESOURCE"` |  |
+| bpfTool.securityContext.capabilities.add[3] | string | `"BPF"` |  |
+| bpfTool.securityContext.capabilities.add[4] | string | `"SYS_PTRACE"` |  |
+| bpfTool.securityContext.privileged | bool | `true` |  |
+| global.otel.endpoint | string | `"http://localhost:4317"` |  |
+| global.otel.protocol | string | `"grpc"` |  |
+| global.priorityClassName | string | `""` |  |
+| global.tolerations | list | `[]` |  |
+| identity.image.repository | string | `"ghcr.io/cortexflow/identity"` |  |
+| identity.image.version | string | `"latest"` |  |
+| identity.priorityClassName | string | `""` |  |
+| identity.resources.limits.memory | string | `"200Mi"` |  |
+| identity.resources.requests.cpu | string | `"100m"` |  |
+| identity.resources.requests.memory | string | `"100Mi"` |  |
+| identity.securityContext.allowPrivilegeEscalation | bool | `true` |  |
+| identity.securityContext.capabilities.add[0] | string | `"SYS_ADMIN"` |  |
+| identity.securityContext.capabilities.add[1] | string | `"NET_ADMIN"` |  |
+| identity.securityContext.capabilities.add[2] | string | `"SYS_RESOURCE"` |  |
+| identity.securityContext.capabilities.add[3] | string | `"BPF"` |  |
+| identity.securityContext.capabilities.add[4] | string | `"SYS_PTRACE"` |  |
+| identity.securityContext.privileged | bool | `true` |  |
+| identity.tolerations | list | `[]` |  |
+| metrics.image.repository | string | `"ghcr.io/cortexflow/metrics"` |  |
+| metrics.image.version | string | `"latest"` |  |
+| metrics.priorityClassName | string | `""` |  |
+| metrics.resources.limits.cpu | string | `"1"` |  |
+| metrics.resources.limits.memory | string | `"200Mi"` |  |
+| metrics.resources.requests.cpu | string | `"1"` |  |
+| metrics.resources.requests.memory | string | `"100Mi"` |  |
+| metrics.securityContext.allowPrivilegeEscalation | bool | `true` |  |
+| metrics.securityContext.capabilities.add[0] | string | `"SYS_ADMIN"` |  |
+| metrics.securityContext.capabilities.add[1] | string | `"NET_ADMIN"` |  |
+| metrics.securityContext.capabilities.add[2] | string | `"SYS_RESOURCE"` |  |
+| metrics.securityContext.capabilities.add[3] | string | `"BPF"` |  |
+| metrics.securityContext.capabilities.add[4] | string | `"SYS_PTRACE"` |  |
+| metrics.securityContext.privileged | bool | `true` |  |
+| metrics.tolerations | list | `[]` |  |
+| serviceAccountName | string | `"cortexflow-sa"` |  |
+
+----------------------------------------------
+Autogenerated from chart metadata using [helm-docs v1.14.2](https://github.com/norwoodj/helm-docs/releases/v1.14.2)

helm/templates/_helper.tpl

@@ -0,0 +1,31 @@
+{{/*
+Sets tolerations for daemonsets either from the global var or from individual values
+*/}}
+{{- define "common.tolerations" }}
+{{- $ctx := .context }}
+{{- $component := .component }}
+{{- $local := index $ctx.Values $component "tolerations" }}
+{{- $global := $ctx.Values.global.tolerations }}
+{{- if and (not (empty $local)) }}
+tolerations:
+{{ toYaml $local | indent 2 }}
+{{- else if and (not (empty $global)) }}
+tolerations:
+{{ toYaml $global | indent 2 }}
+{{- end }}
+{{- end }}
+
+{{/*
+Sets priorityClassName for daemonsets either from the global var or from individual values
+*/}}
+{{- define "common.priorityClassName" }}
+{{- $ctx := .context }}
+{{- $component := .component }}
+{{- $local := index $ctx.Values $component "priorityClassName" }}
+{{- $global := $ctx.Values.global.priorityClassName }}
+{{- if and (not (empty $local)) }}
+priorityClassName: {{ toYaml $local }}
+{{- else if and (not (empty $global)) }}
+priorityClassName: {{ toYaml $global }}
+{{- end }}
+{{- end }}

helm/templates/agent.yaml

@@ -0,0 +1,106 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: cortexflow-agent
+  labels:
+    app: cortexflow-agent
+spec:
+  selector:
+    matchLabels:
+      app: cortexflow-agent
+  template:
+    metadata:
+      labels:
+        app: cortexflow-agent
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
+    spec:
+      serviceAccountName: {{ .Values.serviceAccountName }}
+      hostPID: true
+      hostNetwork: true
+      {{- include "common.tolerations" (dict "context" . "component" "agent") | indent 6 }}
+      {{- include "common.priorityClassName" (dict "context" . "component" "agent") | indent 6 }}
+      containers:
+        - name: agent
+          image: "{{ .Values.agent.image.repository }}:{{ .Values.agent.image.version }}"
+          command: ["/bin/bash", "-c"]
+          args:
+            - |
+              echo "Running on kernel $(uname -r)"
+              if [ ! -d "/sys/fs/bpf" ]; then
+                echo "ERROR: BPF filesystem not mounted"
+                exit 1
+              else
+                echo "Checking ebpf path..."
+                ls -l /sys/fs/bpf
+              fi
+              echo "checking privileges"
+              ls -ld /sys/fs/bpf
+
+              echo "checking if conntracker path"
+              ls -l /usr/src/cortexbrain-agent/conntracker
+
+              echo "checking if the bpf maps are reachable"
+              ls -l /sys/fs/bpf/maps
+
+              echo "Running application..."
+              exec /usr/local/bin/agent-api || echo "Application exited with code $?"
+          env:
+            - name: OTEL_SERVICE_NAME
+              value: cortexflow-agent
+            - name: OTEL_EXPORTER_OTLP_ENDPOINT
+              value: {{ .Values.global.otel.endpoint }}
+            - name: OTEL_EXPORTER_OTLP_PROTOCOL
+              value: {{ .Values.global.otel.protocol }}
+            - name: OTEL_RESOURCE_ATTRIBUTES
+              value: service.namespace=cortexflow,service.version=0.1.5
+            - name: AGENT_API_ENABLE_REFLECTION
+              value: "true"
+          volumeMounts:
+            - name: bpf
+              mountPath: /sys/fs/bpf
+              mountPropagation: Bidirectional
+              readOnly: false
+            - name: proc
+              mountPath: /host/proc
+              readOnly: false
+            - name: kernel-dev
+              mountPath: /lib/modules
+              readOnly: false
+          resources:
+            {{- .Values.identity.resources | toYaml | nindent 12 }}
+          securityContext:
+            {{- .Values.agent.securityContext | toYaml | nindent 12 }}
+      volumes:
+        - name: bpf
+          hostPath:
+            path: /sys/fs/bpf
+            type: Directory
+        - name: proc
+          hostPath:
+            path: /proc
+            type: Directory
+        - name: kernel-dev
+          hostPath:
+            path: /lib/modules
+            type: Directory
+
+---
+
+apiVersion: v1
+kind: Service
+metadata:
+  name: cortexflow-agent
+  namespace: cortexflow
+spec:
+  selector:
+    app: cortexflow-agent
+  ports:
+  - protocol: TCP
+    name: agent-server-port
+    port: 9090
+    targetPort: 9090
+    appProtocol: grpc
+  type: ClusterIP
+
+---

helm/templates/configmap-role.yaml

@@ -0,0 +1,21 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: configmap-reader
+rules:
+  - apiGroups: [""]
+    resources: ["configmaps","services"]
+    verbs: ["get", "list","watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: configmap-reader-binding
+subjects:
+  - kind: ServiceAccount
+    name: {{ .Values.serviceAccountName }}
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: Role
+  name: configmap-reader
+  apiGroup: rbac.authorization.k8s.io

helm/templates/configmap.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cortexbrain-client-config
+data:
+  blocklist: {{ .Values.blocklist | quote }}

helm/templates/identity.yaml

@@ -0,0 +1,120 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: cortexflow-identity
+  labels:
+    app: cortexflow-identity
+spec:
+  selector:
+    matchLabels:
+      app: cortexflow-identity
+  template:
+    metadata:
+      labels:
+        app: cortexflow-identity
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
+    spec:
+      serviceAccountName: {{ .Values.serviceAccountName }}
+      hostPID: true
+      hostNetwork: true
+      {{- include "common.tolerations" (dict "context" . "component" "identity") | indent 6 }}
+      {{- include "common.priorityClassName" (dict "context" . "component" "identity") | indent 6 }}
+      initContainers:
+        - name: bpf-map-permissions
+          image: "{{ .Values.bpfMapPermissions.image.repository }}:{{ .Values.bpfMapPermissions.image.version }}"
+          command: ["/bin/bash","-c"]
+          args: 
+            - |
+              echo "mounting the bpf path "
+              mount -t bpf bpf /sys/fs/bpf
+
+              echo "checking permissions"
+              ls -ld /sys/fs/bpf
+          volumeMounts:
+            - name: bpf
+              mountPath: /sys/fs/bpf
+              mountPropagation: Bidirectional
+              readOnly: false
+            - name: kernel-dev
+              mountPath: /lib/modules
+              readOnly: false
+            - name: cgroup
+              mountPath: /sys/fs/cgroup
+              readOnly: true
+          securityContext:
+            {{- .Values.bpfMapPermissions.securityContext | toYaml | nindent 12}}
+      containers:
+        - name: identity
+          image: "{{ .Values.identity.image.repository }}:{{ .Values.identity.image.version }}"
+          command: ["/bin/bash", "-c"]
+          args:
+            - |
+              echo "Running on kernel $(uname -r)"
+              if [ ! -d "/sys/fs/bpf" ]; then
+                echo "ERROR: BPF filesystem not mounted"
+                exit 1
+              else
+                echo "Checking ebpf path..."
+                ls -l /sys/fs/bpf
+              fi
+              echo "checking privileges"
+              ls -ld /sys/fs/bpf
+
+              echo "Running application..."
+              exec /usr/local/bin/cortexflow-identity-service || echo "Application exited with code $?"
+          env:
+            - name: OTEL_SERVICE_NAME
+              value: cortexflow-identity
+            - name: OTEL_EXPORTER_OTLP_ENDPOINT
+              value: {{ .Values.global.otel.endpoint }}
+            - name: OTEL_EXPORTER_OTLP_PROTOCOL
+              value: {{ .Values.global.otel.protocol }}
+            - name: OTEL_RESOURCE_ATTRIBUTES
+              value: service.namespace=cortexflow,service.version=0.1.5
+          resources:
+            {{- .Values.identity.resources | toYaml | nindent 12 }}
+          volumeMounts:
+            - name: bpf
+              mountPath: /sys/fs/bpf
+              mountPropagation: Bidirectional
+              readOnly: false
+            - name: kernel-dev
+              mountPath: /lib/modules
+              readOnly: false
+            - name: cgroup
+              mountPath: /sys/fs/cgroup
+              readOnly: true
+          securityContext:
+            {{- .Values.identity.securityContext | toYaml | nindent 12 }}
+        - name: bpftool-control-manager
+          image: "{{ .Values.bpfTool.image.repository }}:{{ .Values.bpfTool.image.version }}"
+          command: ["/bin/bash", "-c","sleep infinity"]
+          volumeMounts:
+            - name: bpf
+              mountPath: /sys/fs/bpf
+              mountPropagation: Bidirectional
+              readOnly: false
+            - name: kernel-dev
+              mountPath: /lib/modules
+              readOnly: false
+            - name: cgroup
+              mountPath: /sys/fs/cgroup
+              readOnly: true
+          resources:
+            {{- .Values.bpfTool.resources | toYaml | nindent 12 }}
+          securityContext:
+            {{- .Values.bpfTool.securityContext | toYaml | nindent 12 }}
+      volumes:
+        - name: bpf
+          hostPath:
+            path: /sys/fs/bpf
+            type: Directory
+        - name: kernel-dev
+          hostPath:
+            path: /lib/modules
+            type: Directory
+        - name: cgroup
+          hostPath:
+            path: /sys/fs/cgroup
+            type: Directory