ce7cb702218693d08ea6d83464d2457c9250027c

vendor/workloads/frigate/deployment.yaml

@@ -0,0 +1,165 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: frigate
+  namespace: frigate
+  labels:
+    app.kubernetes.io/name: frigate
+    app.kubernetes.io/instance: frigate
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: frigate
+      app.kubernetes.io/instance: frigate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: frigate
+        app.kubernetes.io/instance: frigate
+    spec:
+      automountServiceAccountToken: false
+      runtimeClassName: nvidia
+      imagePullSecrets:
+        - name: quay-cluster-pull
+      terminationGracePeriodSeconds: 30
+      nodeSelector:
+        kubernetes.io/hostname: ms2k-y520
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
+      initContainers:
+        - name: model
+          image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
+          imagePullPolicy: IfNotPresent
+          command: [/usr/share/dotnet/dotnet, /opt/fsi/fsi.dll, --exec, /installer/run.fsx]
+          env:
+            - name: SSL_CERT_FILE
+              value: /certs/ca.crt
+            - name: DOTNET_NOLOGO
+              value: "true"
+            - name: DOTNET_CLI_TELEMETRY_OPTOUT
+              value: "1"
+            - name: AWS_EC2_METADATA_DISABLED
+              value: "true"
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              memory: 512Mi
+          securityContext:
+            runAsUser: 0
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+          volumeMounts:
+            - name: config
+              mountPath: /config
+            - name: installer
+              mountPath: /installer
+              readOnly: true
+            - name: model-s3
+              mountPath: /s3
+              readOnly: true
+            - name: model-ca
+              mountPath: /certs
+              readOnly: true
+      containers:
+        - name: frigate
+          image: ghcr.io/blakeblackshear/frigate:0.18.2-tensorrt@sha256:1cafb6ebbaff0aaf275cc3f31951bcf7e29f3989f18a10ba9565091367d8736c
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: FRIGATE_RTSP_ADDRESS
+              valueFrom:
+                secretKeyRef:
+                  name: frigate-config
+                  key: FRIGATE_RTSP_ADDRESS
+            - name: FRIGATE_RTSP_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: frigate-config
+                  key: FRIGATE_RTSP_PASSWORD
+            - name: NVIDIA_VISIBLE_DEVICES
+              value: all
+            - name: NVIDIA_DRIVER_CAPABILITIES
+              value: compute,video,utility
+          ports:
+            - name: web
+              containerPort: 8971
+              protocol: TCP
+          resources:
+            requests:
+              cpu: 500m
+              memory: 2Gi
+              nvidia.com/gpu: "1"
+            limits:
+              memory: 8Gi
+              nvidia.com/gpu: "1"
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+              add: ["CHOWN", "FOWNER", "SETGID", "SETUID"]
+          startupProbe:
+            tcpSocket:
+              port: web
+            failureThreshold: 60
+            periodSeconds: 5
+          readinessProbe:
+            tcpSocket:
+              port: web
+            failureThreshold: 3
+            periodSeconds: 10
+            timeoutSeconds: 3
+          livenessProbe:
+            tcpSocket:
+              port: web
+            failureThreshold: 3
+            periodSeconds: 30
+            timeoutSeconds: 3
+          volumeMounts:
+            - name: config
+              mountPath: /config
+            - name: rendered-config
+              mountPath: /config/config.yaml
+              subPath: config.yaml
+              readOnly: true
+            - name: media
+              mountPath: /media/frigate
+            - name: cache
+              mountPath: /tmp/cache
+            - name: shm
+              mountPath: /dev/shm
+      volumes:
+        - name: installer
+          configMap:
+            name: frigate-model
+        - name: model-s3
+          secret:
+            secretName: model-s3
+        - name: model-ca
+          secret:
+            secretName: frigate-ca
+        - name: config
+          persistentVolumeClaim:
+            claimName: frigate-config
+        - name: rendered-config
+          secret:
+            secretName: frigate-config
+            items:
+              - key: config.yaml
+                path: config.yaml
+        - name: media
+          persistentVolumeClaim:
+            claimName: frigate-media
+        - name: cache
+          emptyDir:
+            medium: Memory
+            sizeLimit: 1Gi
+        - name: shm
+          emptyDir:
+            medium: Memory
+            sizeLimit: 512Mi

vendor/workloads/frigate/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../../services/frigate
+  - namespace.yaml
+  - vso.yaml
+  - storage.yaml
+  - deployment.yaml
+  - oauth2-proxy.yaml
+  - services.yaml
+  - route.yaml
+  - network-policies.yaml

vendor/workloads/frigate/namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: frigate
+  labels:
+    gateway.quorate.internal/allow-internal: "true"

vendor/workloads/frigate/network-policies.yaml

@@ -0,0 +1,204 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: frigate
+  namespace: frigate
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: frigate
+      app.kubernetes.io/instance: frigate
+  ingress:
+    - fromEntities:
+        - host
+      toPorts:
+        - ports:
+            - port: "8971"
+              protocol: TCP
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: frigate
+            app.kubernetes.io/name: oauth2-proxy
+            app.kubernetes.io/instance: frigate
+      toPorts:
+        - ports:
+            - port: "8971"
+              protocol: TCP
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+          rules:
+            dns:
+              - matchPattern: "*"
+    - toServices:
+        - k8sService:
+            namespace: kube-system
+            serviceName: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: versitygw
+            app.kubernetes.io/name: versitygw
+            app.kubernetes.io/instance: versitygw
+      toPorts:
+        - ports:
+            - port: "7070"
+              protocol: TCP
+    - toCIDR:
+        - 10.82.151.234/24
+      toPorts:
+        - ports:
+            - port: "554"
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: frigate-oauth2-proxy
+  namespace: frigate
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: oauth2-proxy
+      app.kubernetes.io/instance: frigate
+  ingress:
+    - fromEntities:
+        - host
+        - ingress
+      toPorts:
+        - ports:
+            - port: "4180"
+              protocol: TCP
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            gateway.networking.k8s.io/gateway-name: gateway-internal
+      toPorts:
+        - ports:
+            - port: "4180"
+              protocol: TCP
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+    - toServices:
+        - k8sService:
+            namespace: kube-system
+            serviceName: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: frigate
+            app.kubernetes.io/name: frigate
+            app.kubernetes.io/instance: frigate
+      toPorts:
+        - ports:
+            - port: "8971"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: zitadel
+            app.kubernetes.io/name: zitadel-oidc-internal
+            app.kubernetes.io/instance: zitadel
+      toPorts:
+        - ports:
+            - port: "8080"
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: gateway-internal-egress-frigate-oauth2-proxy
+spec:
+  endpointSelector:
+    matchLabels:
+      "reserved:ingress": ""
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: frigate
+            app.kubernetes.io/name: oauth2-proxy
+            app.kubernetes.io/instance: frigate
+      toPorts:
+        - ports:
+            - port: "4180"
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: host-egress-frigate
+spec:
+  nodeSelector: {}
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: frigate
+            app.kubernetes.io/name: frigate
+            app.kubernetes.io/instance: frigate
+      toPorts:
+        - ports:
+            - port: "8971"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: frigate
+            app.kubernetes.io/name: oauth2-proxy
+            app.kubernetes.io/instance: frigate
+      toPorts:
+        - ports:
+            - port: "4180"
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: host-ingress-frigate-replies
+spec:
+  nodeSelector: {}
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: frigate
+            app.kubernetes.io/name: frigate
+            app.kubernetes.io/instance: frigate
+      toPorts:
+        - ports:
+            - port: "32768"
+              endPort: 60999
+              protocol: TCP
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: frigate
+            app.kubernetes.io/name: oauth2-proxy
+            app.kubernetes.io/instance: frigate
+      toPorts:
+        - ports:
+            - port: "32768"
+              endPort: 60999
+              protocol: TCP

vendor/workloads/frigate/oauth2-proxy.yaml

@@ -0,0 +1,105 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: frigate-oauth2-proxy
+  namespace: frigate
+  labels:
+    app.kubernetes.io/name: oauth2-proxy
+    app.kubernetes.io/instance: frigate
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: oauth2-proxy
+      app.kubernetes.io/instance: frigate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: oauth2-proxy
+        app.kubernetes.io/instance: frigate
+        quorate.dev/zitadel-relay: "true"
+    spec:
+      automountServiceAccountToken: false
+      containers:
+        - name: oauth2-proxy
+          image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.5@sha256:8498b0d0ef0a7b29686414000a08aee467f02d0299c9ed1e006a8f33fc017916
+          imagePullPolicy: IfNotPresent
+          args:
+            - --http-address=0.0.0.0:4180
+            - --provider=oidc
+            - --oidc-issuer-url=https://auth.quorate.dev
+            - --redirect-url=https://frigate.quorate.internal/oauth2/callback
+            - --upstream=http://frigate.frigate.svc.cluster.local:8971
+            - --email-domain=*
+            - --scope=openid profile email groups
+            - --allowed-group=frigate_admin
+            - --allowed-group=frigate_viewer
+            - --reverse-proxy=true
+            - --skip-provider-button=true
+            - --cookie-secure=true
+            - --cookie-samesite=lax
+            - --cookie-refresh=1h
+            - --cookie-expire=8h
+            - --pass-user-headers=true
+          env:
+            - name: OAUTH2_PROXY_CLIENT_ID
+              value: "********"
+          envFrom:
+            - secretRef:
+                name: frigate-oauth2-proxy
+            - secretRef:
+                name: frigate-oauth2-proxy-cookie
+          ports:
+            - name: http
+              containerPort: 4180
+              protocol: TCP
+          readinessProbe:
+            httpGet:
+              path: /ready
+              port: http
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /ping
+              port: http
+            initialDelaySeconds: 30
+            periodSeconds: 30
+          startupProbe:
+            httpGet:
+              path: /ping
+              port: http
+            failureThreshold: 12
+            periodSeconds: 10
+          resources:
+            requests:
+              cpu: 25m
+              memory: 64Mi
+            limits:
+              memory: 256Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            seccompProfile:
+              type: RuntimeDefault
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: frigate-oauth2-proxy
+  namespace: frigate
+  labels:
+    app.kubernetes.io/name: oauth2-proxy
+    app.kubernetes.io/instance: frigate
+spec:
+  selector:
+    app.kubernetes.io/name: oauth2-proxy
+    app.kubernetes.io/instance: frigate
+  ports:
+    - name: http
+      port: 4180
+      targetPort: http
+      protocol: TCP
+      appProtocol: http

vendor/workloads/frigate/route.yaml

@@ -0,0 +1,16 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: frigate
+  namespace: frigate
+spec:
+  parentRefs:
+    - name: gateway-internal
+      namespace: kube-system
+      sectionName: https
+  hostnames:
+    - frigate.quorate.internal
+  rules:
+    - backendRefs:
+        - name: frigate-oauth2-proxy
+          port: 4180

vendor/workloads/frigate/services.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: frigate
+  namespace: frigate
+spec:
+  selector:
+    app.kubernetes.io/name: frigate
+    app.kubernetes.io/instance: frigate
+  ports:
+    - name: web
+      port: 8971
+      targetPort: web
+      protocol: TCP
+      appProtocol: http

vendor/workloads/frigate/storage.yaml

@@ -0,0 +1,25 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: frigate-config
+  namespace: frigate
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: openebs-hostpath
+  resources:
+    requests:
+      storage: 10Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: frigate-media
+  namespace: frigate
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: openebs-hostpath-hdd
+  resources:
+    requests:
+      storage: 100Gi

vendor/workloads/frigate/vso.yaml

@@ -0,0 +1,228 @@
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: model-s3
+  namespace: frigate
+spec:
+  type: kv-v2
+  mount: secret
+  path: versitygw/users/model-reader
+  destination:
+    name: model-s3
+    create: true
+  refreshAfter: 1h
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultDynamicSecret
+metadata:
+  name: frigate-ca
+  namespace: frigate
+spec:
+  mount: pki
+  path: cert/ca
+  requestHTTPMethod: GET
+  destination:
+    name: frigate-ca
+    create: true
+    transformation:
+      excludeRaw: true
+      excludes: [.*]
+      templates:
+        ca.crt:
+          text: '{{ get .Secrets "certificate" }}'
+  refreshAfter: 1h
+  vaultAuthRef: default
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: frigate-vso
+  namespace: frigate
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: default
+  namespace: frigate
+spec:
+  method: kubernetes
+  mount: kubernetes
+  kubernetes:
+    role: frigate
+    serviceAccount: frigate-vso
+  vaultConnectionRef: vault/vault
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: frigate-oauth2-proxy
+  namespace: frigate
+spec:
+  type: kv-v2
+  mount: secret
+  path: frigate/oauth2-proxy
+  destination:
+    name: frigate-oauth2-proxy
+    create: true
+    overwrite: true
+    transformation:
+      excludeRaw: true
+      excludes:
+        - .*
+      templates:
+        OAUTH2_PROXY_CLIENT_SECRET:
+          text: '{{ get .Secrets "client_secret" }}'
+  refreshAfter: 1h
+  rolloutRestartTargets:
+    - kind: Deployment
+      name: frigate-oauth2-proxy
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: frigate-oauth2-proxy-cookie
+  namespace: frigate
+spec:
+  type: kv-v2
+  mount: secret
+  path: frigate/oauth2-proxy-cookie
+  destination:
+    name: frigate-oauth2-proxy-cookie
+    create: true
+    overwrite: true
+    transformation:
+      excludeRaw: true
+      excludes:
+        - .*
+      templates:
+        OAUTH2_PROXY_COOKIE_SECRET:
+          text: '{{ get .Secrets "cookie_secret" }}'
+  refreshAfter: 1h
+  rolloutRestartTargets:
+    - kind: Deployment
+      name: frigate-oauth2-proxy
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: frigate-config
+  namespace: frigate
+spec:
+  type: kv-v2
+  mount: secret
+  path: frigate/rtsp
+  destination:
+    name: frigate-config
+    create: true
+    overwrite: true
+    transformation:
+      excludeRaw: true
+      excludes:
+        - .*
+      templates:
+        FRIGATE_RTSP_ADDRESS:
+          text: '{{ get .Secrets "address" }}'
+        FRIGATE_RTSP_PASSWORD:
+          text: '{{ get .Secrets "password" }}'
+        config.yaml:
+          text: |
+            mqtt:
+              enabled: false
+
+            audio:
+              enabled: false
+
+            tls:
+              enabled: false
+
+            auth:
+              enabled: false
+
+            proxy:
+              default_role: viewer
+              logout_url: /oauth2/sign_out
+              header_map:
+                user: x-forwarded-email
+                role: x-forwarded-groups
+                role_map:
+                  admin:
+                    - frigate_admin
+                  viewer:
+                    - frigate_viewer
+
+            ffmpeg:
+              hwaccel_args: preset-nvidia
+
+            cameras:
+              "********":
+                enabled: true
+                ffmpeg:
+                  inputs:
+                    - path: rtsp://********:{FRIGATE_RTSP_PASSWORD}@{FRIGATE_RTSP_ADDRESS}/stream1
+                      input_args: preset-rtsp-generic
+                      roles:
+                        - detect
+                        - record
+                detect:
+                  enabled: true
+                  width: 1280
+                  height: 720
+
+            record:
+              enabled: true
+              continuous:
+                days: 7
+
+            detect:
+              enabled: true
+
+            detectors:
+              onnx:
+                type: onnx
+
+            model:
+              model_type: yolo-generic
+              width: 320
+              height: 320
+              input_tensor: nchw
+              input_dtype: float
+              path: /config/model_cache/yolov9-t-320.onnx
+              labelmap_path: /labelmap/coco-80.txt
+
+            version: 0.18-0
+  refreshAfter: 1h
+  rolloutRestartTargets:
+    - kind: Deployment
+      name: frigate
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: quay-cluster-pull
+  namespace: frigate
+spec:
+  type: kv-v2
+  mount: secret
+  path: quay/robots/cluster_pull
+  destination:
+    name: quay-cluster-pull
+    create: true
+    overwrite: true
+    type: kubernetes.io/dockerconfigjson
+    transformation:
+      excludeRaw: true
+      excludes:
+        - .*
+      templates:
+        .dockerconfigjson:
+          text: >-
+            {"auths":{"registry.quorate.internal":{"auth":"{{ printf "%s:%s" (get .Secrets "username") (get .Secrets "token") | b64enc }}"}}}
+  refreshAfter: 1h
+  rolloutRestartTargets:
+    - kind: Deployment
+      name: frigate
+  vaultAuthRef: default