feat(event-ledger): add Helm chart for self-hosted stack

deploy/helm/cassandra/helm/values.yaml

@@ -189,7 +189,7 @@ cassandra:
       # repository: must be supplied in additional values
       registry: ""
       repository: ""
-      tag: 0.11.0
+      tag: 0.16.0
       pullPolicy: Always
 
   dbUser:

deploy/helm/event-ledger/Chart.yaml

@@ -0,0 +1,24 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: v2
+name: helm-nvcf-event-ledger
+description: A Helm chart for NVCF Event Ledger deployment
+
+type: application
+
+version: 0.0.0 # autoversioning enabled via release pipeline
+
+appVersion: "0.10.2"

deploy/helm/event-ledger/README.md

@@ -0,0 +1,71 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Event Ledger Helm Chart
+
+Helm chart for deploying the event-ledger service in a self-managed NVCF stack.
+
+## Prerequisites
+
+- Helm 3.x
+- OpenBao (Vault) with the `22_setup_event-ledger.sh` migration applied (`nvcf-openbao-migrations` >= `0.18.0`). This migration provisions the JWT auth role, the secret paths that the Vault Agent sidecar reads, and the ServiceAccount binding.
+- Cassandra with the `event_ledger` keyspace created by the `nvcf-cassandra-migrations` image (`>= 0.16.0`).
+- An api-keys-api policy evaluator reachable at the address configured in `eventLedger.config.auth.policy.policy-evaluator-addr`.
+
+## Image settings
+
+`eventLedger.image.registry` and `eventLedger.image.repository` are required and have no defaults. Supply them at install time:
+
+```yaml
+eventLedger:
+  image:
+    registry: <your-registry>
+    repository: <your-org>
+```
+
+`appVersion` in `Chart.yaml` tracks the image tag used in `values.yaml`. Update both together when bumping the image.
+
+## Namespace and service name
+
+`eventLedger.fullnameOverride` defaults to `event-ledger`. This fixes the in-cluster DNS name to `event-ledger.<namespace>.svc.cluster.local:8080` regardless of the Helm release name, matching the service contract defined in the SADD (section 3.1). Do not change this unless the rest of the stack is updated to match.
+
+The namespace defaults to the Helm release namespace. Set `eventLedger.namespace` to override.
+
+## Override points
+
+- `eventLedger.image.registry` and `eventLedger.image.repository`: required, no defaults
+- `eventLedger.replicaCount`: defaults to 1
+- `eventLedger.resources`: defaults are conservative; tune for your environment
+- `eventLedger.config.database.cassandra.hosts`: defaults to `localhost`; set to the Cassandra service address in your stack
+- `eventLedger.config.auth.policy.policy-evaluator-addr`: set to the api-keys-api address in your stack
+
+## API Keys policy evaluator
+
+In self-managed deployments, `EVENT_LEDGER_SELF_MANAGED=true` is set by default. This makes the service call the api-keys-api evaluation endpoint without a bearer token (the endpoint has no pre-authorize in self-managed mode). Set `eventLedger.config.auth.policy.policy-evaluator-addr` to the api-keys-api address.
+
+## Metrics
+
+Prometheus metrics are exposed on port 8081 at `/metrics`. The internal service port is always `8081`. To enable scraping, configure your Prometheus instance to scrape `event-ledger.<namespace>.svc.cluster.local:8081/metrics`.
+
+## Install example
+
+```bash
+helm install event-ledger deploy/helm/event-ledger \
+  --namespace event-ledger-system \
+  --values deploy/helm/event-ledger/values.yaml \
+  --set eventLedger.image.registry=<your-registry> \
+  --set eventLedger.image.repository=<your-org> \
+  --wait
+```

deploy/helm/event-ledger/files/secrets.json.tmpl

@@ -0,0 +1,7 @@
+{{- with secret "services/event-ledger/kv/data/cassandra/creds" }}
+{
+  "username": {{ .Data.data.username | toJSON }},
+  "password": {{ .Data.data.password | toJSON }},
+  "policy-bearer-token": "self-managed"
+}
+{{- end }}

deploy/helm/event-ledger/templates/NOTES.txt

@@ -0,0 +1,15 @@
+Event Ledger has been deployed.
+
+Service DNS (in-cluster):
+  {{ include "nvcf-event-ledger.fullname" . }}.{{ include "nvcf-event-ledger.namespace" . }}.svc.cluster.local:8080
+
+Health check:
+  kubectl -n {{ include "nvcf-event-ledger.namespace" . }} port-forward svc/{{ include "nvcf-event-ledger.fullname" . }} 8080
+  curl http://localhost:8080/health
+
+Metrics (Prometheus):
+  event-ledger.{{ include "nvcf-event-ledger.namespace" . }}.svc.cluster.local:8081
+
+The Vault Agent sidecar injects /vault/secrets/secrets.json at pod start.
+If the pod is stuck in Init:CrashLoopBackOff, check the Vault Agent sidecar
+logs — the OpenBao role or secret path is likely missing from the migration.

deploy/helm/event-ledger/templates/_helpers.tpl

@@ -0,0 +1,146 @@
+{{/*
+SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+SPDX-License-Identifier: Apache-2.0
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/}}
+
+{{/*
+Expand the name of the chart.
+
+Defaults to the literal "event-ledger" rather than .Chart.Name so the
+runtime service identity (resource names, selectors, container name) stays
+stable and matches the in-cluster DNS contract (event-ledger.nvcf.svc),
+independent of the OCI chart package name. Override via
+.Values.eventLedger.nameOverride.
+*/}}
+{{- define "nvcf-event-ledger.name" -}}
+{{- default "event-ledger" .Values.eventLedger.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "nvcf-event-ledger.fullname" -}}
+{{- if .Values.eventLedger.fullnameOverride }}
+{{- .Values.eventLedger.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default "event-ledger" .Values.eventLedger.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Allow the release namespace to be overridden via .Values.eventLedger.namespace,
+falling back to .Release.Namespace.
+*/}}
+{{- define "nvcf-event-ledger.namespace" -}}
+{{- default .Release.Namespace .Values.eventLedger.namespace -}}
+{{- end -}}
+
+{{/*
+Derive the full image reference. Fails the render if either image.registry
+or image.repository is missing so the chart cannot install a default/invalid
+image.
+*/}}
+{{- define "nvcf-event-ledger.image" -}}
+{{- $registry := required "A valid image registry (.Values.eventLedger.image.registry) is required!" .Values.eventLedger.image.registry -}}
+{{- $repository := required "A valid image repository (.Values.eventLedger.image.repository) is required!" .Values.eventLedger.image.repository -}}
+{{- $name := .Values.eventLedger.image.name | default "event-ledger" -}}
+{{- $tag := .Values.eventLedger.image.tag | default .Chart.AppVersion -}}
+{{- printf "%s/%s/%s:%s" $registry $repository $name $tag -}}
+{{- end -}}
+
+{{/*
+OpenBao projected service-account token helpers. These four helpers define
+the chart-owned contract for the Vault Agent Kubernetes auto-auth token volume.
+Use these in annotations and the workload template instead of repeating literals.
+*/}}
+{{- define "nvcf-event-ledger.openbaoTokenVolumeName" -}}
+openbao-token
+{{- end -}}
+
+{{- define "nvcf-event-ledger.openbaoTokenMountPath" -}}
+/var/run/secrets/openbao
+{{- end -}}
+
+{{- define "nvcf-event-ledger.openbaoTokenFileName" -}}
+token
+{{- end -}}
+
+{{- define "nvcf-event-ledger.openbaoTokenPath" -}}
+{{- printf "%s/%s" (include "nvcf-event-ledger.openbaoTokenMountPath" .) (include "nvcf-event-ledger.openbaoTokenFileName" .) -}}
+{{- end -}}
+
+{{/*
+Hashicorp Vault Agent Injector annotations. Always rendered onto the pod
+so the injector mints /vault/secrets/secrets.json at pod start from the
+OpenBao secret paths. The template content is rendered into a ConfigMap by
+templates/configmap-vault-agent-template.yaml and mounted into the pod at
+/vault/config/templates.
+*/}}
+{{- define "nvcf-event-ledger.vaultAnnotations" -}}
+{{- $role := required "A valid Vault auth role (.Values.eventLedger.vault.role) is required!" .Values.eventLedger.vault.role -}}
+vault.hashicorp.com/agent-inject: "true"
+vault.hashicorp.com/role: {{ $role | quote }}
+vault.hashicorp.com/auth-path: {{ .Values.eventLedger.vault.jwtAuthPath | default "auth/jwt" | quote }}
+vault.hashicorp.com/agent-service-account-token-volume-name: {{ include "nvcf-event-ledger.openbaoTokenVolumeName" . | quote }}
+vault.hashicorp.com/auth-config-token-path: {{ include "nvcf-event-ledger.openbaoTokenPath" . | quote }}
+vault.hashicorp.com/agent-copy-volume-mounts: {{ include "nvcf-event-ledger.fullname" . | quote }}
+vault.hashicorp.com/agent-inject-template-file-secrets.json: "/vault/config/templates/secrets.json.tmpl"
+vault.hashicorp.com/secret-volume-path: "/vault/secrets"
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "nvcf-event-ledger.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "nvcf-event-ledger.labels" -}}
+helm.sh/chart: {{ include "nvcf-event-ledger.chart" . }}
+{{ include "nvcf-event-ledger.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "nvcf-event-ledger.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "nvcf-event-ledger.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "nvcf-event-ledger.serviceAccountName" -}}
+{{- if .Values.eventLedger.serviceAccount.create }}
+{{- default (include "nvcf-event-ledger.fullname" .) .Values.eventLedger.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.eventLedger.serviceAccount.name }}
+{{- end }}
+{{- end }}

deploy/helm/event-ledger/templates/configmap-app.yaml

@@ -0,0 +1,29 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "nvcf-event-ledger.fullname" . }}-app-config
+  namespace: {{ include "nvcf-event-ledger.namespace" . }}
+  labels:
+    {{- include "nvcf-event-ledger.labels" . | nindent 4 }}
+data:
+  # Application YAML config mounted at /etc/event-ledger/config.yaml.
+  # The container reads it via EVENT_LEDGER_CONFIG env var (see deployment.yaml).
+  # Credentials (username, password, policy-bearer-token) are not here;
+  # they are injected by Vault Agent into /vault/secrets/secrets.json.
+  config.yaml: |
+    {{- toYaml .Values.eventLedger.config | nindent 4 }}

deploy/helm/event-ledger/templates/configmap-vault-agent-template.yaml

@@ -0,0 +1,29 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "nvcf-event-ledger.fullname" . }}-vault-agent-tpl
+  namespace: {{ include "nvcf-event-ledger.namespace" . }}
+  labels:
+    {{- include "nvcf-event-ledger.labels" . | nindent 4 }}
+data:
+  # Vault Agent template rendered into /vault/secrets/secrets.json on pod start.
+  # The service reads username/password for Cassandra and policy-bearer-token
+  # for the api-keys-api policy evaluator from this file (run_service.go).
+  # Secret paths match what 22_setup_event-ledger.sh provisions in OpenBao.
+  secrets.json.tmpl: |
+    {{- .Files.Get "files/secrets.json.tmpl" | nindent 4 }}