lotus bundle chart

charts/lotus-bundle/Chart.yaml

@@ -0,0 +1,6 @@
+apiVersion: v2
+name: lotus-bundle
+description: bundle your application with lotus
+type: application
+version: 0.0.1
+appVersion: 0.0.1

charts/lotus-bundle/README.md

@@ -0,0 +1,22 @@
+# Lotus Bundle
+
+If you are writing a lotus application, bundle your application with a lotus node.
+
+
+## Default behaviors:
+
+Lotus will run as a sidecar to your application. You can access lotus at 127.0.0.1:1234.
+There is no authentication, and lotus will not be accessible outside of your pod.
+
+Lotus wallets are managed by kubernetes secrets. Any lotus wallet found in the secret
+provided will be imported and available for use by your application.
+
+TODO: Configure lotus to use a wallet service.
+
+
+## Options:
+
+lite-mode:     Run lotus lite.
+lite-backend:  if running in lite-mode, use this service backend. By default, api.chain.love.
+
+See values.yaml for examples.

charts/lotus-bundle/templates/NOTES.txt

@@ -0,0 +1,11 @@
+{{ .Values.application.name }} with lotus sidecars
+
+Release ---------- {{ .Release.Name }}
+Namespace -------- {{ .Release.Namespace }}
+Application ------ {{ .Values.application.container.image }}
+
+The following following initial wallets will be imported:
+
+{{ range $wallet := .Values.wallets }}
+$wallet.address
+{{ end }}

charts/lotus-bundle/templates/configmaps.yaml

@@ -0,0 +1,10 @@
+{{- range $cm := .Values.application.configMaps }}
+{{- if not $cm.external }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ $.Release.Name }}-{{ $cm.name }}
+data:
+  {{ .toYaml .keys | nindent 2 }}
+{{- end }}
+{{- end }}

charts/lotus-bundle/templates/ingress.yaml

@@ -0,0 +1,23 @@
+{{- if .Values.application.ingress.enabled }}
+---
+apiVersion: networking.k8s.io/v1beta1
+kind: Ingress
+metadata:
+  name: {{ .Release.Name }}-{{ .Values.application.name }}
+  annotations:
+    kubernetes.io/ingress.class: {{ .Values.application.ingress.class }}
+    {{- with .Values.application.ingress.annotations }}
+    {{ toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  rules:
+  {{- range $rule := .Values.application.ingress.httpRules }}
+  - host: {{ $rule.host }}
+    http:
+      paths:
+      - path: {{ $rule.path }}
+        backend:
+          serviceName: {{ .Release.Name }}-{{ .Values.application.name }}
+          servicePort: $rule.servicePort 
+  {{- end }}
+{{- end }}

charts/lotus-bundle/templates/secrets.yaml

@@ -0,0 +1,10 @@
+{{- range $sec := .Values.application.secrets }}
+{{- if not $sec.external }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ $.Release.Name }}-{{ $sec.name }}
+data:
+  {{ toYaml .keys | nindent 2 }}
+{{- end }}
+{{- end }}

charts/lotus-bundle/templates/service-monitor.yaml

@@ -0,0 +1,20 @@
+{{- if .Values.prometheus.serviceMonitor }}
+---
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: {{ .Release.Name }}-{{ .Values.application.name }}
+  namespace: {{ .Release.Namespace }}
+spec:
+  namespaceSelector:
+    matchNames:
+      - {{ .Release.Namespace }}
+  selector:
+    matchLabels:
+      app: {{ .Values.application.name }}
+      release: {{ .Release.Name }}
+  endpoints:
+  - port: {{ .Values.prometheus.port }}
+    path: {{ .Values.prometheus.path }}
+    interval: 30s
+{{- end }}

charts/lotus-bundle/templates/service.yaml

@@ -0,0 +1,23 @@
+{{ if .Values.application.service.enabled }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}-{{ .Values.application.name }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ .Values.application.name }}
+    release: {{ .Release.Name }}
+    {{- with .Values.application.labels }}
+    {{ toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  type: {{ .Values.application.service.type }}
+  selector:
+    app: {{ .Values.application.name }}
+    release: {{ .Release.Name }}
+  ports:
+    {{- with .Values.application.service.ports }}
+    {{ toYaml . | nindent 4 }}
+    {{- end }}
+{{ end }}

charts/lotus-bundle/templates/statefulset.yaml

@@ -0,0 +1,170 @@
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ .Release.Name }}-{{ .Values.application.name }}
+  labels:
+    app: {{ .Values.application.name }}
+{{- with .Values.application.labels }}
+{{ toYaml . | indent 4 }}
+{{- end }}
+spec:
+  replicas: {{ .Values.application.replicas }}
+  serviceName: {{ .Values.application.name }}
+  selector:
+    matchLabels:
+      app: {{ .Values.application.name }}
+      release: {{ .Release.Name }}
+  volumeClaimTemplates:
+    - metadata:
+        name: lotus-path
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 2000Gi
+    - metadata:
+        name: parameter-cache
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 500Gi
+    - metadata:
+        name: shared-volume
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: {{ .Values.application.storage.size }}
+  template:
+    metadata:
+      labels:
+        app: {{ .Values.application.name }}
+        chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+        release: {{ .Release.Name }}
+{{- with .Values.application.labels }}
+{{ toYaml . | indent 8 }}
+{{- end }}
+    spec:
+      securityContext:
+        fsGroup: 532
+      volumes:
+        # The wallet, mounted by the wallet importer
+        - name: wallets-secret-volume
+          secret:
+            secretName: {{ .Release.Name }}-wallets
+            defaultMode: 0600
+        {{- range $sec := .Values.application.secrets }}
+        # secrets and configmaps, mounted by the application
+        - name: {{ $sec.name }}-volume
+          secret:
+            {{- if $sec.external }}
+            secretName: {{ $sec.name }}
+            {{- else }}
+            secretName: {{ $.Release.Name }}-{{ $sec.name }}
+            {{ end }}
+            defaultMode: 0600
+        {{- end }}
+        {{- range $cm := .Values.application.configMaps }}
+        - name: {{ $cm.name }}-volume
+          configMap:
+            {{- if $cm.external }}
+            name:  {{ $cm.name }}
+            {{- else }}
+            name: {{ .Release.Name }}-{{ $cm.name }}
+            {{- end }}
+        {{- end }}
+
+      containers:
+        - name: {{ .Values.application.container.name }}
+          image: {{ .Values.application.container.image }}
+          imagePullPolicy: {{ .Values.application.container.imagePullPolicy }}
+          command: {{ .Values.application.container.command }}
+          args: {{ .Values.application.container.args }}
+          env:
+            - name: FULLNODE_API_INFO
+              value: "/ip4/127.0.0.1/tcp/1234/http"
+            {{- with .Values.application.container.env }}
+            {{- toYaml . | nindent 10 }}
+            {{- end }}
+          volumeMounts:
+            {{- range $sec := .Values.application.secrets }}
+            - name: {{ $sec.name }}-volume
+              mountPath: {{ $sec.mount }}
+            {{- end }}
+            {{- range $cm := .Values.application.configMaps }}
+            - name: {{ $cm.name }}-volume
+              mountPath: {{ $cm.mount }}
+            {{- end }}
+            - name: shared-volume
+              mountPath: {{ .Values.application.storage.mount }}
+        # lotus sidecar
+        - name: lotus
+          image: {{ .Values.lotus.image }}
+          imagePullPolicy: IfNotPresent
+          args:
+            - daemon
+            {{- if .Values.lotus.lite.enabled }}
+            - "--lite"
+            {{- end }}
+          env:
+            - name: FILECOIN_PARAMETER_CACHE
+              value: /var/tmp/filecoin-proof-parameters
+            - name: LOTUS_PATH
+              value: /var/lib/lotus
+            - name: LOTUS_JAEGER_AGENT_HOST
+              value: 127.0.0.1
+            - name: LOTUS_JAEGER_AGENT_PORT
+              value: "6831"
+            {{- if .Values.lotus.lite.enabled }}
+            - name: FULLNODE_API_INFO
+              value: {{ .Values.lotus.lite.backend }}
+            - name: DOCKER_LOTUS_IMPORT_SNAPSHOT
+              value: ""
+            {{- else }}
+            - name: DOCKER_LOTUS_IMPORT_SNAPSHOT
+              value: https://fil-chain-snapshots-fallback.s3.amazonaws.com/mainnet/minimal_finality_stateroots_latest.car
+            {{- end }}
+          resources:
+            {{- if .Values.lotus.lite.enabled }}
+            requests:
+              memory: 16Gi
+              cpu: 8
+            limits:
+              memory: 32Gi
+              cpu: 16
+            {{- else }}
+            requests:
+              memory: 64Gi
+              cpu: 8
+            limits:
+              memory: 96Gi
+              cpu: 16
+            {{- end }}
+          volumeMounts:
+            - name: lotus-path
+              mountPath: /var/lib/lotus
+            - name: parameter-cache
+              mountPath: /var/tmp/filecoin-proof-parameters
+            - name: shared-volume
+              mountPath: {{ .Values.application.storage.mount }}
+              readOnly: true
+        # wallet importer
+        # TODO: switch to a wallet server
+        - name: wallet-importer
+          image: {{ .Values.lotus.image }}
+          imagePullPolicy: IfNotPresent
+          command: [ "bash", "-c" ]
+          args:
+            - 'while sleep 60; do for key in /wallets/*; do lotus wallet import "${key}" || true; done; done'
+          env:
+            - name: FULLNODE_API_INFO
+              value: "/ip4/127.0.0.1/tcp/1234/http"
+          volumeMounts:
+            - name: wallets-secret-volume
+              mountPath: /wallets
+              readOnly: true

charts/lotus-bundle/templates/wallets.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Release.Name }}-wallets
+data:
+  {{ range $sec := .Values.wallets }}
+  $sec.address: $sec.exported
+  {{ end }}

charts/lotus-bundle/values.yaml

@@ -0,0 +1,63 @@
+# required:
+# Your application. Replace with your own details.
+application:
+  name: "nginx-example"
+  labels: []
+  replicas: 
+  container:
+    name: application
+    image: "nginx"
+    imagePullPolicy: IfNotPresent
+    command: []
+    args: []
+    env: {}
+    resources: {}
+  secrets:
+    - name: example-secret # helm will create this secret
+      keys:
+        password: extraspecial
+      mount: /here
+    - name: external-secret # a pre-existing secret
+      external: true
+      mount: /there
+  configMaps: [] # same format as secrets
+  service:
+    enabled: true
+    type: ClusterIP
+    ports:
+      - protocol: TCP
+        port: 80
+        targetPort: 80
+        name: http
+  ingress:
+    enabled: false
+    class: nginx
+    annotations: {}
+    httpRules:
+      - host: example.com
+        path: /
+        servicePort: http
+  storage: # storage volume shared between application and lotus node
+    size: 1Gi
+    mount: /shared
+
+# Wallets are added to the wallet secret.
+# if you don't want to specify wallets in values.yaml,
+# you can add them later by editing the secret.
+# wallets:
+#   - address: f3xxxyyy
+#     exported: aabbccdd
+wallets: []
+
+# lotus configuration
+lotus:
+  image: filecoin/lotus:latest
+  lite:
+    enabled: false
+    backend: wss://api.chain.love
+
+# Do you want prometheus monitoring with prometheus-operator?
+prometheus:
+  serviceMonitor: false
+  path: /metrics
+  port: ""