feat(event-ledger): add Helm chart for self-hosted stack

deploy/helm/cassandra/helm/values.yaml

@@ -189,7 +189,7 @@ cassandra:
       # repository: must be supplied in additional values
       registry: ""
       repository: ""
-      tag: 0.11.0
+      tag: 0.16.0
       pullPolicy: Always
 
   dbUser:

deploy/helm/event-ledger/Chart.yaml

@@ -0,0 +1,24 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: v2
+name: helm-event-ledger
+description: A Helm chart for NVCF Event Ledger deployment
+
+type: application
+
+version: 0.0.0 # autoversioning enabled via release pipeline
+
+appVersion: "1.0.0"

deploy/helm/event-ledger/files/secrets.json.tmpl

@@ -0,0 +1,7 @@
+{{- with secret "services/event-ledger/kv/data/cassandra/creds" }}
+{
+  "username": {{ .Data.data.username | toJSON }},
+  "password": {{ .Data.data.password | toJSON }},
+  "policy-bearer-token": "self-managed"
+}
+{{- end }}

deploy/helm/event-ledger/templates/NOTES.txt

@@ -0,0 +1,15 @@
+Event Ledger has been deployed.
+
+Service DNS (in-cluster):
+  {{ include "nvcf-event-ledger.fullname" . }}.{{ include "nvcf-event-ledger.namespace" . }}.svc.cluster.local:8080
+
+Health check:
+  kubectl -n {{ include "nvcf-event-ledger.namespace" . }} port-forward svc/{{ include "nvcf-event-ledger.fullname" . }} 8080
+  curl http://localhost:8080/health
+
+Metrics (Prometheus):
+  event-ledger.{{ include "nvcf-event-ledger.namespace" . }}.svc.cluster.local:8081
+
+The Vault Agent sidecar injects /vault/secrets/secrets.json at pod start.
+If the pod is stuck in Init:CrashLoopBackOff, check the Vault Agent sidecar
+logs — the OpenBao role or secret path is likely missing from the migration.

deploy/helm/event-ledger/templates/_helpers.tpl

@@ -0,0 +1,129 @@
+{{/*
+SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+SPDX-License-Identifier: Apache-2.0
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/}}
+
+{{/*
+Expand the name of the chart.
+
+Defaults to the literal "event-ledger" rather than .Chart.Name so the
+runtime service identity (resource names, selectors, container name) stays
+stable and matches the in-cluster DNS contract (event-ledger.nvcf.svc),
+independent of the OCI chart package name. Override via
+.Values.eventLedger.nameOverride.
+*/}}
+{{- define "nvcf-event-ledger.name" -}}
+{{- default "event-ledger" .Values.eventLedger.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "nvcf-event-ledger.fullname" -}}
+{{- if .Values.eventLedger.fullnameOverride }}
+{{- .Values.eventLedger.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default "event-ledger" .Values.eventLedger.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Allow the release namespace to be overridden via .Values.eventLedger.namespace,
+falling back to .Release.Namespace.
+*/}}
+{{- define "nvcf-event-ledger.namespace" -}}
+{{- default .Release.Namespace .Values.eventLedger.namespace -}}
+{{- end -}}
+
+{{/*
+Derive the full image reference. Fails the render if either image.registry
+or image.repository is missing so the chart cannot install a default/invalid
+image.
+*/}}
+{{- define "nvcf-event-ledger.image" -}}
+{{- $registry := required "A valid image registry (.Values.eventLedger.image.registry) is required!" .Values.eventLedger.image.registry -}}
+{{- $repository := required "A valid image repository (.Values.eventLedger.image.repository) is required!" .Values.eventLedger.image.repository -}}
+{{- $name := .Values.eventLedger.image.name | default "event-ledger" -}}
+{{- $tag := .Values.eventLedger.image.tag | default .Chart.AppVersion -}}
+{{- printf "%s/%s/%s:%s" $registry $repository $name $tag -}}
+{{- end -}}
+
+{{/*
+Hashicorp Vault Agent Injector annotations. Always rendered onto the pod
+so the injector mints /vault/secrets/secrets.json at pod start from the
+OpenBao secret paths. The template content is rendered into a ConfigMap by
+templates/configmap-vault-agent-template.yaml and mounted into the pod at
+/vault/config/templates.
+*/}}
+{{- define "nvcf-event-ledger.vaultAnnotations" -}}
+{{- $role := required "A valid Vault auth role (.Values.eventLedger.vault.role) is required!" .Values.eventLedger.vault.role -}}
+vault.hashicorp.com/agent-inject: "true"
+vault.hashicorp.com/role: {{ $role | quote }}
+vault.hashicorp.com/auth-path: {{ .Values.eventLedger.vault.jwtAuthPath | default "auth/jwt" | quote }}
+{{- /* Point the agent's kubernetes auto-auth at the OpenBao-audience token,
+       mounted off the standard SA path.
+       NOTE: this literal must stay in sync with eventLedger.volumeMounts for
+       the `openbao-token` volume in values.yaml (mountPath + projected path).
+       If you change that mount, change this annotation too. */}}
+vault.hashicorp.com/auth-config-token-path: "/var/run/secrets/openbao/token"
+vault.hashicorp.com/agent-copy-volume-mounts: {{ include "nvcf-event-ledger.fullname" . | quote }}
+vault.hashicorp.com/agent-inject-template-file-secrets.json: "/vault/config/templates/secrets.json.tmpl"
+vault.hashicorp.com/secret-volume-path: "/vault/secrets"
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "nvcf-event-ledger.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "nvcf-event-ledger.labels" -}}
+helm.sh/chart: {{ include "nvcf-event-ledger.chart" . }}
+{{ include "nvcf-event-ledger.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "nvcf-event-ledger.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "nvcf-event-ledger.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "nvcf-event-ledger.serviceAccountName" -}}
+{{- if .Values.eventLedger.serviceAccount.create }}
+{{- default (include "nvcf-event-ledger.fullname" .) .Values.eventLedger.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.eventLedger.serviceAccount.name }}
+{{- end }}
+{{- end }}

deploy/helm/event-ledger/templates/configmap-app.yaml

@@ -0,0 +1,29 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "nvcf-event-ledger.fullname" . }}-app-config
+  namespace: {{ include "nvcf-event-ledger.namespace" . }}
+  labels:
+    {{- include "nvcf-event-ledger.labels" . | nindent 4 }}
+data:
+  # Application YAML config mounted at /etc/event-ledger/config.yaml.
+  # The container reads it via EVENT_LEDGER_CONFIG env var (see deployment.yaml).
+  # Credentials (username, password, policy-bearer-token) are not here;
+  # they are injected by Vault Agent into /vault/secrets/secrets.json.
+  config.yaml: |
+    {{- toYaml .Values.eventLedger.config | nindent 4 }}

deploy/helm/event-ledger/templates/configmap-vault-agent-template.yaml

@@ -0,0 +1,29 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "nvcf-event-ledger.fullname" . }}-vault-agent-tpl
+  namespace: {{ include "nvcf-event-ledger.namespace" . }}
+  labels:
+    {{- include "nvcf-event-ledger.labels" . | nindent 4 }}
+data:
+  # Vault Agent template rendered into /vault/secrets/secrets.json on pod start.
+  # The service reads username/password for Cassandra and policy-bearer-token
+  # for the api-keys-api policy evaluator from this file (run_service.go).
+  # Secret paths match what 22_setup_event-ledger.sh provisions in OpenBao.
+  secrets.json.tmpl: |
+    {{- .Files.Get "files/secrets.json.tmpl" | nindent 4 }}

deploy/helm/event-ledger/templates/deployment.yaml

@@ -0,0 +1,113 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "nvcf-event-ledger.fullname" . }}
+  namespace: {{ include "nvcf-event-ledger.namespace" . }}
+  labels:
+    {{- include "nvcf-event-ledger.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.eventLedger.replicaCount }}
+  selector:
+    matchLabels:
+      {{- include "nvcf-event-ledger.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      annotations:
+        {{- include "nvcf-event-ledger.vaultAnnotations" . | nindent 8 }}
+        checksum/config-app: {{ toYaml .Values.eventLedger.config | sha256sum }}
+        checksum/vault-agent-template: {{ .Files.Get "files/secrets.json.tmpl" | sha256sum }}
+        {{- with .Values.eventLedger.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      labels:
+        {{- include "nvcf-event-ledger.selectorLabels" . | nindent 8 }}
+        {{- with .Values.eventLedger.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      {{- with .Values.eventLedger.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "nvcf-event-ledger.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.eventLedger.podSecurityContext | nindent 8 }}
+      volumes:
+        - name: vault-config-templates
+          configMap:
+            name: {{ include "nvcf-event-ledger.fullname" . }}-vault-agent-tpl
+            items:
+              - key: secrets.json.tmpl
+                path: secrets.json.tmpl
+        - name: app-config
+          configMap:
+            name: {{ include "nvcf-event-ledger.fullname" . }}-app-config
+            items:
+              - key: config.yaml
+                path: config.yaml
+        {{- with .Values.eventLedger.volumes }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      containers:
+        - name: {{ include "nvcf-event-ledger.fullname" . }}
+          securityContext:
+            {{- toYaml .Values.eventLedger.securityContext | nindent 12 }}
+          image: {{ include "nvcf-event-ledger.image" . | quote }}
+          imagePullPolicy: {{ .Values.eventLedger.image.pullPolicy }}
+          volumeMounts:
+            - name: vault-config-templates
+              mountPath: /vault/config/templates
+              readOnly: true
+            - name: app-config
+              mountPath: /etc/event-ledger
+              readOnly: true
+            {{- with .Values.eventLedger.volumeMounts }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          env:
+            # Point the service at the mounted config file.
+            - name: EVENT_LEDGER_CONFIG
+              value: /etc/event-ledger/config.yaml
+            {{- range $key, $value := .Values.eventLedger.env }}
+            - name: {{ $key }}
+              value: {{ $value | quote }}
+            {{- end }}
+          ports:
+            {{- range .Values.eventLedger.ports }}
+            - name: {{ .name }}
+              containerPort: {{ .containerPort }}
+              protocol: {{ .protocol }}
+            {{- end }}
+          livenessProbe:
+            {{- toYaml .Values.eventLedger.livenessProbe | nindent 12 }}
+          readinessProbe:
+            {{- toYaml .Values.eventLedger.readinessProbe | nindent 12 }}
+          resources:
+            {{- toYaml .Values.eventLedger.resources | nindent 12 }}
+      {{- with .Values.eventLedger.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.eventLedger.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.eventLedger.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}