DOCSEARCHbyAlgolia
Submit Docs

nxs-universal-chart

repository·main·Indexed 20 days ago

https://github.com/nixys/nxs-universal-chart

A flexible Helm chart for deploying applications into Kubernetes or OpenShift environments. It provides a unified interface for managing standard Kubernetes resources (Deployments, StatefulSets, Services, Ingress, etc.) and custom resources via a modular subchart system and the extraDeploy feature. It includes built-in support for GitOps metadata for Argo CD and Flux, global resource settings through a generic contract, and a hierarchical values model for managing workload families.

Tokens
25.5K
Snippets
54
Records
101
Agent score
66%

What's inside nxs-universal-chart

  1. Overview of the Istio Zero Trust sample

    main

    The istio-zero-trust sample demonstrates an Ingress authentication and authorization flow for a service mesh using Istio security Custom Resource Definitions (CRDs). It is designed to implement a Zero Trust security model by managing how requests are authenticated and authorized as they enter the mesh.

    This sample utilizes the following components:

    • nxs-universal-chart: The core universal chart.
    • nuc-istio: The Istio-specific chart.

    It leverages these Istio technologies:

    • Istio Gateway and VirtualService: For managing ingress traffic.
    • RequestAuthentication: To handle end-user authentication (e.g., JWT).
    • AuthorizationPolicy: To enforce fine-grained access control.
    • PeerAuthentication: To enforce mutual TLS (mTLS) between services.

  2. Overview of the AI Inference Mesh sample

    main
    The AI Inference Mesh sample demonstrates a complete inference setup. It integrates mesh ingress, KServe, Knative, Vault secrets management, and Prometheus monitoring. This sample is designed to show how multiple nxs-universal-chart instances and specialized nuc-* charts compose to create a production-ready AI inference environment.

  4. Overview of Envoy Gateway Policies

    main

    The envoy-gateway-policies sample demonstrates how to implement Envoy Gateway extension resources using the nuc-envoy-gateway chart. This setup specifically manages two types of resources:

    1. Backend: Defines the external backend service.
    2. BackendTrafficPolicy: Defines the traffic policy applied to that specific backend.

    This pattern is used to extend Envoy Gateway capabilities by associating specific traffic management behaviors with external backends.

  5. Overview of KServe Local Model Cache

    main

    The KServe Local Model Cache sample demonstrates how to place a model cache near inference nodes to optimize performance. This setup covers the deployment of LocalModelCache, management of trained model metadata, and the orchestration of inference workloads to ensure they are co-located with the prepared cache.

    This sample utilizes the following components:

    • nxs-universal-chart for universal chart orchestration.
    • nuc-kserve for KServe-specific resources.
    • KServe LocalModelCache for the caching layer.
    • KServe InferenceService for serving models.
    • Kubernetes Deployment for workload management.

  6. Overview of the Platform Baseline App sample

    main
    The Platform Baseline App is a reference implementation demonstrating a standard application platform architecture. It serves as a baseline case for deploying an application with a primary ingress endpoint via Istio Gateway, integrated security using Gateway certificates and Vault secrets, monitoring via Prometheus Operator, and autoscaling via KEDA.

  7. Overview of CloudNativePG Postgres sample

    main

    The cloudnativepg-postgres sample provides a complete deployment pattern for an application PostgreSQL cluster. It includes a PostgreSQL cluster managed by CloudNativePG, a connection pooler, a dedicated database, and a scheduled backup mechanism.

    This sample relies on the nuc-cloudnativepg chart from the NXS Universal Chart repository.

  8. Platform Baseline App architecture and dependencies

    main

    The Platform Baseline App demonstrates the integration of several NXS and NUC charts to provide a complete platform stack.

    Used Charts

    • nxs-universal-chart (Core application chart)
    • nuc-istio (Ingress and service mesh)
    • nuc-certificates (Certificate management)
    • nuc-vault-secret-operator (Secret management)
    • nuc-kube-prometheus-stack (Monitoring)
    • nuc-keda (Autoscaling)

    Integrated Technologies

    • Networking: Istio Gateway, VirtualService, and DestinationRule
    • Security: cert-manager Certificate and ClusterIssuer, Vault Static Secret
    • Monitoring: Prometheus ServiceMonitor and PrometheusRule
    • Scaling: KEDA ScaledObject
    • Workloads: Kubernetes Deployment and Service

  9. Use Go-templates in values

    main

    The chart supports Go-template syntax within your values files. This allows you to dynamically compute values, such as checksums or referencing other values via $.Values.

    Important: Always wrap template strings in single quotes (e.g., '{{ ... }}') to prevent manifest generation errors caused by special characters.

    # Example: Using a helper to add a checksum annotation
deployments:
  api:
    podAnnotations:
      checksum/app-cfg: '{{ include "helpers.workload.checksum" (index $.Values.configMaps "app-config") }}'

# Example: Referencing other values for image configuration
deployments:
  app1:
    containers:
    - name: app1
      image: '{{ $.Values.imageRepo1 }}/{{ $.Values.imageApp1 }}'
      imageTag: '{{ $.Values.imageTagApp1 }}'

  10. Components used in the AI Inference Mesh

    main

    The AI Inference Mesh is composed of the following Helm charts and technologies:

    Helm Charts

    • nxs-universal-chart: The core universal chart.
    • nuc-istio: For service mesh and ingress management.
    • nuc-kserve: For KServe inference services.
    • nuc-knative: For Knative serverless capabilities.
    • nuc-vault-secret-operator: For managing secrets via HashiCorp Vault.
    • nuc-kube-prometheus-stack: For monitoring and observability.

    Core Technologies

    • Istio: Uses Gateway, VirtualService, AuthorizationPolicy, and DestinationRule for traffic management and security.
    • KServe: Uses InferenceService for model serving.
    • Knative: Uses Service for serverless scaling.
    • Vault: Uses VaultConnection, VaultAuth, and VaultStaticSecret for secure secret injection.
    • Prometheus: Uses ServiceMonitor, PodMonitor, and PrometheusRule for metric collection and alerting.

  11. Configure workload families and general defaults

    main

    The NXS Universal Chart uses a hierarchical values model to manage Kubernetes workloads. You can define specific resources (e.g., deployments.api) or set shared defaults for an entire family of resources using a *General key (e.g., deploymentsGeneral).

    Fields set in a *General object act as fallbacks for every workload in that family. An individual workload entry overrides these general defaults.

    Supported workload families include:

    • deployments / deploymentsGeneral (supports strategy, progressDeadlineSeconds)
    • daemonSets / daemonSetsGeneral (supports strategy, minReadySeconds, revisionHistoryLimit)
    • pods / podsGeneral
    • statefulSets / statefulSetsGeneral (supports strategy, minReadySeconds, volumeClaimTemplates)
    • jobs / jobsGeneral (supports parallelism, completions, activeDeadlineSeconds, backoffLimit, ttlSecondsAfterFinished, restartPolicy, commandDurationAlert, commandDurationAlertNamespace)
    • cronJobs / cronJobsGeneral (supports all Job fields plus suspend, timeZone, singleOnly, startingDeadlineSeconds, successfulJobsHistoryLimit, failedJobsHistoryLimit)
    • hooks / hooksGeneral (supports all Job fields plus kind, weight, deletePolicy)

  12. How dependency subcharts are enabled

    main

    The chart uses several reusable dependency subcharts. Most are enabled by setting an enabled flag under their respective name in the .Values object.

    Note on nuc-envoy-gateway: Unlike other subcharts, nuc-envoy-gateway must be enabled using the global key global.nuc-envoy-gateway.enabled because its schema does not support a local enabled key.

    Common subcharts include:

    • nuc-traefik via nuc-traefik.enabled
    • nuc-istio via nuc-istio.enabled
    • nuc-argocd via nuc-argocd.enabled
    • nuc-external-secrets via nuc-external-secrets.enabled
    • (and many others listed in the documentation)