CD/CD consolidation

2025-12-26 17:32:23 +02:00
parent a866eb6277
commit c786faae84
638 changed files with 3821 additions and 181 deletions
--- a/devops/helm/stellaops/templates/_helpers.tpl
+++ b/devops/helm/stellaops/templates/_helpers.tpl
@@ -0,0 +1,43 @@
+{{- define "stellaops.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{- define "stellaops.telemetryCollector.config" -}}
+{{- if .Values.telemetry.collector.config }}
+{{ tpl .Values.telemetry.collector.config . }}
+{{- else }}
+{{ tpl (.Files.Get "files/otel-collector-config.yaml") . }}
+{{- end }}
+{{- end -}}
+
+{{- define "stellaops.telemetryCollector.fullname" -}}
+{{- printf "%s-otel-collector" (include "stellaops.name" .) | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{- define "stellaops.fullname" -}}
+{{- $name := default .root.Chart.Name .root.Values.fullnameOverride -}}
+{{- printf "%s-%s" $name .name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{- define "stellaops.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "stellaops.name" .root | quote }}
+app.kubernetes.io/instance: {{ .root.Release.Name | quote }}
+app.kubernetes.io/component: {{ .name | quote }}
+{{- if .svc.class }}
+app.kubernetes.io/part-of: {{ printf "stellaops-%s" .svc.class | quote }}
+{{- else }}
+app.kubernetes.io/part-of: "stellaops-core"
+{{- end }}
+{{- end -}}
+
+{{- define "stellaops.labels" -}}
+{{ include "stellaops.selectorLabels" . }}
+helm.sh/chart: {{ printf "%s-%s" .root.Chart.Name .root.Chart.Version | quote }}
+app.kubernetes.io/version: {{ .root.Values.global.release.version | quote }}
+app.kubernetes.io/managed-by: {{ .root.Release.Service | quote }}
+stellaops.release/channel: {{ .root.Values.global.release.channel | quote }}
+stellaops.profile: {{ .root.Values.global.profile | quote }}
+{{- range $k, $v := .root.Values.global.labels }}
+{{ $k }}: {{ $v | quote }}
+{{- end }}
+{{- end -}}
--- a/devops/helm/stellaops/templates/configmap-release.yaml
+++ b/devops/helm/stellaops/templates/configmap-release.yaml
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "stellaops.fullname" (dict "root" . "name" "release") }}
+  labels:
+    {{- include "stellaops.labels" (dict "root" . "name" "release" "svc" (dict "class" "meta")) | nindent 4 }}
+data:
+  version: {{ .Values.global.release.version | quote }}
+  channel: {{ .Values.global.release.channel | quote }}
+  manifestSha256: {{ default "" .Values.global.release.manifestSha256 | quote }}
--- a/devops/helm/stellaops/templates/configmaps.yaml
+++ b/devops/helm/stellaops/templates/configmaps.yaml
@@ -0,0 +1,15 @@
+{{- $root := . -}}
+{{- range $name, $cfg := .Values.configMaps }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "stellaops.fullname" (dict "root" $root "name" $name) }}
+  labels:
+    {{- include "stellaops.labels" (dict "root" $root "name" $name "svc" (dict "class" "config")) | nindent 4 }}
+data:
+{{- range $fileName, $content := $cfg.data }}
+  {{ $fileName }}: |
+{{ tpl $content $root | nindent 4 }}
+{{- end }}
+---
+{{- end }}
--- a/devops/helm/stellaops/templates/console.yaml
+++ b/devops/helm/stellaops/templates/console.yaml
@@ -0,0 +1,108 @@
+{{- if .Values.console.enabled }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "stellaops.fullname" . }}-console
+  labels:
+    app.kubernetes.io/component: console
+    {{- include "stellaops.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.console.replicas | default 1 }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: console
+      {{- include "stellaops.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: console
+        {{- include "stellaops.selectorLabels" . | nindent 8 }}
+    spec:
+      securityContext:
+        {{- toYaml .Values.console.securityContext | nindent 8 }}
+      containers:
+        - name: console
+          image: {{ .Values.console.image }}
+          imagePullPolicy: {{ .Values.global.image.pullPolicy | default "IfNotPresent" }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.console.port | default 8080 }}
+              protocol: TCP
+          securityContext:
+            {{- toYaml .Values.console.containerSecurityContext | nindent 12 }}
+          livenessProbe:
+            {{- toYaml .Values.console.livenessProbe | nindent 12 }}
+          readinessProbe:
+            {{- toYaml .Values.console.readinessProbe | nindent 12 }}
+          resources:
+            {{- toYaml .Values.console.resources | nindent 12 }}
+          volumeMounts:
+            {{- toYaml .Values.console.volumeMounts | nindent 12 }}
+          env:
+            - name: APP_PORT
+              value: "{{ .Values.console.port | default 8080 }}"
+      volumes:
+        {{- toYaml .Values.console.volumes | nindent 8 }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "stellaops.fullname" . }}-console
+  labels:
+    app.kubernetes.io/component: console
+    {{- include "stellaops.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.console.service.type | default "ClusterIP" }}
+  ports:
+    - port: {{ .Values.console.service.port | default 80 }}
+      targetPort: {{ .Values.console.service.targetPort | default 8080 }}
+      protocol: TCP
+      name: http
+  selector:
+    app.kubernetes.io/component: console
+    {{- include "stellaops.selectorLabels" . | nindent 4 }}
+{{- if .Values.console.ingress.enabled }}
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "stellaops.fullname" . }}-console
+  labels:
+    app.kubernetes.io/component: console
+    {{- include "stellaops.labels" . | nindent 4 }}
+  {{- with .Values.console.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if .Values.console.ingress.className }}
+  ingressClassName: {{ .Values.console.ingress.className }}
+  {{- end }}
+  {{- if .Values.console.ingress.tls }}
+  tls:
+    {{- range .Values.console.ingress.tls }}
+    - hosts:
+        {{- range .hosts }}
+        - {{ . | quote }}
+        {{- end }}
+      secretName: {{ .secretName }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- range .Values.console.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            pathType: {{ .pathType | default "Prefix" }}
+            backend:
+              service:
+                name: {{ include "stellaops.fullname" $ }}-console
+                port:
+                  name: http
+          {{- end }}
+    {{- end }}
+{{- end }}
+{{- end }}
--- a/devops/helm/stellaops/templates/core.yaml
+++ b/devops/helm/stellaops/templates/core.yaml
@@ -0,0 +1,225 @@
+{{- $root := . -}}
+{{- $configMaps := default (dict) .Values.configMaps -}}
+{{- $hasPolicyActivationConfig := hasKey $configMaps "policy-engine-activation" -}}
+{{- $policyActivationConfigName := "" -}}
+{{- if $hasPolicyActivationConfig -}}
+{{- $policyActivationConfigName = include "stellaops.fullname" (dict "root" $root "name" "policy-engine-activation") -}}
+{{- end -}}
+{{- $policyActivationTargets := dict "policy-engine" true "policy-gateway" true -}}
+{{- range $name, $svc := .Values.services }}
+{{- $configMounts := (default (list) $svc.configMounts) }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "stellaops.fullname" (dict "root" $root "name" $name) }}
+  labels:
+    {{- include "stellaops.labels" (dict "root" $root "name" $name "svc" $svc) | nindent 4 }}
+spec:
+  replicas: {{ default 1 $svc.replicas }}
+  selector:
+    matchLabels:
+      {{- include "stellaops.selectorLabels" (dict "root" $root "name" $name "svc" $svc) | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "stellaops.selectorLabels" (dict "root" $root "name" $name "svc" $svc) | nindent 8 }}
+      {{- if $svc.podAnnotations }}
+      annotations:
+{{ toYaml $svc.podAnnotations | nindent 8 }}
+      {{- end }}
+      annotations:
+        stellaops.release/version: {{ $root.Values.global.release.version | quote }}
+        stellaops.release/channel: {{ $root.Values.global.release.channel | quote }}
+    spec:
+      {{- if $svc.podSecurityContext }}
+      securityContext:
+{{ toYaml $svc.podSecurityContext | nindent 6 }}
+      {{- end }}
+      containers:
+        - name: {{ $name }}
+          image: {{ $svc.image | quote }}
+          imagePullPolicy: {{ default $root.Values.global.image.pullPolicy $svc.imagePullPolicy }}
+{{- if $svc.securityContext }}
+          securityContext:
+{{ toYaml $svc.securityContext | nindent 12 }}
+{{- end }}
+{{- if $svc.command }}
+          command:
+{{- range $cmd := $svc.command }}
+            - {{ $cmd | quote }}
+{{- end }}
+{{- end }}
+{{- if $svc.args }}
+          args:
+{{- range $arg := $svc.args }}
+            - {{ $arg | quote }}
+{{- end }}
+{{- end }}
+{{- if $svc.env }}
+          env:
+{{- range $envName, $envValue := $svc.env }}
+            - name: {{ $envName }}
+              value: {{ $envValue | quote }}
+{{- end }}
+{{- end }}
+{{- $needsPolicyActivation := and $hasPolicyActivationConfig (hasKey $policyActivationTargets $name) }}
+{{- $envFrom := default (list) $svc.envFrom }}
+{{- if and (hasKey $root.Values.configMaps "surface-env") (or (hasPrefix "scanner-" $name) (hasPrefix "zastava-" $name)) }}
+  {{- $envFrom = append $envFrom (dict "configMapRef" (dict "name" (include "stellaops.fullname" (dict "root" $root "name" "surface-env")))) }}
+{{- end }}
+{{- if and $needsPolicyActivation (ne $policyActivationConfigName "") }}
+{{- $hasActivationReference := false }}
+{{- range $envFromEntry := $envFrom }}
+  {{- if and (hasKey $envFromEntry "configMapRef") (eq (index (index $envFromEntry "configMapRef") "name") $policyActivationConfigName) }}
+    {{- $hasActivationReference = true }}
+  {{- end }}
+{{- end }}
+{{- if not $hasActivationReference }}
+{{- $envFrom = append $envFrom (dict "configMapRef" (dict "name" $policyActivationConfigName)) }}
+{{- end }}
+{{- end }}
+{{- if $envFrom }}
+          envFrom:
+{{ toYaml $envFrom | nindent 12 }}
+{{- end }}
+{{- if $svc.ports }}
+          ports:
+{{- range $port := $svc.ports }}
+            - name: {{ default (printf "%s-%v" $name $port.containerPort) $port.name | trunc 63 | trimSuffix "-" }}
+              containerPort: {{ $port.containerPort }}
+              protocol: {{ default "TCP" $port.protocol }}
+{{- end }}
+{{- else if and $svc.service (hasKey $svc.service "port") }}
+          {{- $svcService := $svc.service }}
+          ports:
+            - name: {{ printf "%s-http" $name | trunc 63 | trimSuffix "-" }}
+              containerPort: {{ default (index $svcService "port") (index $svcService "targetPort") }}
+              protocol: {{ default "TCP" (index $svcService "protocol") }}
+{{- end }}
+{{- if $svc.resources }}
+          resources:
+{{ toYaml $svc.resources | nindent 12 }}
+{{- end }}
+{{- if $svc.securityContext }}
+          securityContext:
+{{ toYaml $svc.securityContext | nindent 12 }}
+{{- end }}
+{{- if $svc.securityContext }}
+          securityContext:
+{{ toYaml $svc.securityContext | nindent 12 }}
+{{- end }}
+{{- if $svc.livenessProbe }}
+          livenessProbe:
+{{ toYaml $svc.livenessProbe | nindent 12 }}
+{{- end }}
+{{- if $svc.readinessProbe }}
+          readinessProbe:
+{{ toYaml $svc.readinessProbe | nindent 12 }}
+{{- end }}
+{{- if $svc.prometheus }}
+          {{- $pr := $svc.prometheus }}
+          {{- if $pr.enabled }}
+          {{- if not $svc.podAnnotations }}
+          {{- $svc = merge $svc (dict "podAnnotations" (dict)) }}
+          {{- end }}
+          {{- $svc.podAnnotations = merge $svc.podAnnotations (dict "prometheus.io/scrape" "true" "prometheus.io/path" (default "/metrics" $pr.path) "prometheus.io/port" (toString (default 8080 $pr.port)) "prometheus.io/scheme" (default "http" $pr.scheme))) }}
+          {{- end }}
+{{- end }}
+{{- if or $svc.volumeMounts $configMounts }}
+          volumeMounts:
+{{- if $svc.volumeMounts }}
+{{ toYaml $svc.volumeMounts | nindent 12 }}
+{{- end }}
+{{- range $mount := $configMounts }}
+            - name: {{ $mount.name }}
+              mountPath: {{ $mount.mountPath }}
+{{- if $mount.subPath }}
+              subPath: {{ $mount.subPath }}
+{{- end }}
+{{- if hasKey $mount "readOnly" }}
+              readOnly: {{ $mount.readOnly }}
+{{- else }}
+              readOnly: true
+{{- end }}
+{{- end }}
+{{- end }}
+      {{- if or $svc.volumes (or $svc.volumeClaims $configMounts) }}
+      volumes:
+{{- if $svc.volumes }}
+{{ toYaml $svc.volumes | nindent 8 }}
+{{- end }}
+{{- if $svc.volumeClaims }}
+{{- range $claim := $svc.volumeClaims }}
+        - name: {{ $claim.name }}
+          persistentVolumeClaim:
+            claimName: {{ $claim.claimName }}
+{{- end }}
+{{- end }}
+{{- range $mount := $configMounts }}
+        - name: {{ $mount.name }}
+          configMap:
+            name: {{ include "stellaops.fullname" (dict "root" $root "name" $mount.configMap) }}
+{{- if $mount.items }}
+            items:
+{{ toYaml $mount.items | nindent 12 }}
+{{- else if $mount.subPath }}
+            items:
+              - key: {{ $mount.subPath }}
+                path: {{ $mount.subPath }}
+{{- end }}
+{{- end }}
+      {{- end }}
+      {{- if $svc.serviceAccount }}
+      serviceAccountName: {{ $svc.serviceAccount | quote }}
+      {{- end }}
+      {{- if $svc.nodeSelector }}
+      nodeSelector:
+{{ toYaml $svc.nodeSelector | nindent 8 }}
+      {{- end }}
+      {{- if $svc.affinity }}
+      affinity:
+{{ toYaml $svc.affinity | nindent 8 }}
+      {{- end }}
+{{- if $svc.tolerations }}
+      tolerations:
+{{ toYaml $svc.tolerations | nindent 8 }}
+      {{- end }}
+      {{- if $svc.pdb }}
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{ include "stellaops.fullname" (dict "root" $root "name" $name) }}
+  labels:
+    {{- include "stellaops.labels" (dict "root" $root "name" $name "svc" $svc) | nindent 4 }}
+spec:
+  {{- if $svc.pdb.minAvailable }}
+  minAvailable: {{ $svc.pdb.minAvailable }}
+  {{- end }}
+  {{- if $svc.pdb.maxUnavailable }}
+  maxUnavailable: {{ $svc.pdb.maxUnavailable }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "stellaops.selectorLabels" (dict "root" $root "name" $name "svc" $svc) | nindent 6 }}
+      {{- end }}
+---
+{{- if $svc.service }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "stellaops.fullname" (dict "root" $root "name" $name) }}
+  labels:
+    {{- include "stellaops.labels" (dict "root" $root "name" $name "svc" $svc) | nindent 4 }}
+spec:
+  type: {{ default "ClusterIP" $svc.service.type }}
+  selector:
+    {{- include "stellaops.selectorLabels" (dict "root" $root "name" $name "svc" $svc) | nindent 4 }}
+  ports:
+    - name: {{ default "http" $svc.service.portName }}
+      port: {{ $svc.service.port }}
+      targetPort: {{ $svc.service.targetPort | default $svc.service.port }}
+      protocol: {{ default "TCP" $svc.service.protocol }}
+---
+{{- end }}
+{{- end }}
--- a/devops/helm/stellaops/templates/externalsecrets.yaml
+++ b/devops/helm/stellaops/templates/externalsecrets.yaml
@@ -0,0 +1,28 @@
+{{- if and .Values.externalSecrets.enabled .Values.externalSecrets.secrets }}
+{{- range $secret := .Values.externalSecrets.secrets }}
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: {{ include "stellaops.fullname" $ }}-{{ $secret.name }}
+  labels:
+    {{- include "stellaops.labels" $ | nindent 4 }}
+spec:
+  refreshInterval: {{ default "1h" $secret.refreshInterval }}
+  secretStoreRef:
+    name: {{ $secret.storeRef.name }}
+    kind: {{ default "ClusterSecretStore" $secret.storeRef.kind }}
+  target:
+    name: {{ $secret.target.name | default (printf "%s-%s" (include "stellaops.fullname" $) $secret.name) }}
+    creationPolicy: {{ default "Owner" $secret.target.creationPolicy }}
+  data:
+    {{- range $secret.data }}
+    - secretKey: {{ .key }}
+      remoteRef:
+        key: {{ .remoteKey }}
+        {{- if .property }}
+        property: {{ .property }}
+        {{- end }}
+    {{- end }}
+---
+{{- end }}
+{{- end }}
--- a/devops/helm/stellaops/templates/hpa.yaml
+++ b/devops/helm/stellaops/templates/hpa.yaml
@@ -0,0 +1,39 @@
+{{- if and .Values.hpa.enabled .Values.services }}
+{{- range $name, $svc := .Values.services }}
+{{- if and $svc.hpa $svc.hpa.enabled }}
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{ include "stellaops.fullname" (dict "root" $ "name" $name) }}
+  labels:
+    {{- include "stellaops.labels" (dict "root" $ "name" $name "svc" $svc) | nindent 4 }}
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: {{ include "stellaops.fullname" (dict "root" $ "name" $name) }}
+  minReplicas: {{ default $.Values.hpa.minReplicas $svc.hpa.minReplicas }}
+  maxReplicas: {{ default $.Values.hpa.maxReplicas $svc.hpa.maxReplicas }}
+  metrics:
+    {{- $cpu := coalesce $svc.hpa.cpu.targetPercentage $.Values.hpa.cpu.targetPercentage -}}
+    {{- if $cpu }}
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: {{ $cpu }}
+    {{- end }}
+    {{- $mem := coalesce $svc.hpa.memory.targetPercentage $.Values.hpa.memory.targetPercentage -}}
+    {{- if $mem }}
+    - type: Resource
+      resource:
+        name: memory
+        target:
+          type: Utilization
+          averageUtilization: {{ $mem }}
+    {{- end }}
+---
+{{- end }}
+{{- end }}
+{{- end }}
--- a/devops/helm/stellaops/templates/ingress.yaml
+++ b/devops/helm/stellaops/templates/ingress.yaml
@@ -0,0 +1,32 @@
+{{- if and .Values.ingress.enabled .Values.ingress.hosts }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "stellaops.fullname" . }}
+  labels:
+    {{- include "stellaops.labels" . | nindent 4 }}
+  annotations:
+    {{- range $k, $v := .Values.ingress.annotations }}
+    {{ $k }}: {{ $v | quote }}
+    {{- end }}
+spec:
+  ingressClassName: {{ .Values.ingress.className | default "nginx" | quote }}
+  tls:
+    {{- range .Values.ingress.tls }}
+    - hosts: {{ toYaml .hosts | nindent 6 }}
+      secretName: {{ .secretName }}
+    {{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - host: {{ .host }}
+      http:
+        paths:
+          - path: {{ .path | default "/" }}
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ include "stellaops.fullname" $ }}-gateway
+                port:
+                  number: {{ .servicePort | default 80 }}
+    {{- end }}
+{{- end }}
--- a/devops/helm/stellaops/templates/migrations.yaml
+++ b/devops/helm/stellaops/templates/migrations.yaml
@@ -0,0 +1,50 @@
+{{- if and .Values.migrations.enabled .Values.migrations.jobs }}
+{{- range $job := .Values.migrations.jobs }}
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ include "stellaops.fullname" $ }}-migration-{{ $job.name | trunc 30 | trimSuffix "-" }}
+  labels:
+    {{- include "stellaops.labels" $ | nindent 4 }}
+    stellaops.io/component: migration
+    stellaops.io/migration-name: {{ $job.name | quote }}
+spec:
+  backoffLimit: {{ default 3 $job.backoffLimit }}
+  ttlSecondsAfterFinished: {{ default 3600 $job.ttlSecondsAfterFinished }}
+  template:
+    metadata:
+      labels:
+        {{- include "stellaops.selectorLabels" $ | nindent 8 }}
+        stellaops.io/component: migration
+        stellaops.io/migration-name: {{ $job.name | quote }}
+    spec:
+      restartPolicy: {{ default "Never" $job.restartPolicy }}
+      serviceAccountName: {{ default "default" $job.serviceAccountName }}
+      containers:
+        - name: {{ $job.name | trunc 50 | trimSuffix "-" }}
+          image: {{ $job.image | quote }}
+          imagePullPolicy: {{ default "IfNotPresent" $job.imagePullPolicy }}
+          command: {{- if $job.command }} {{ toJson $job.command }} {{- else }} null {{- end }}
+          args: {{- if $job.args }} {{ toJson $job.args }} {{- else }} null {{- end }}
+          env:
+            {{- if $job.env }}
+            {{- range $k, $v := $job.env }}
+            - name: {{ $k }}
+              value: {{ $v | quote }}
+            {{- end }}
+            {{- end }}
+          envFrom:
+            {{- if $job.envFrom }}
+            {{- toYaml $job.envFrom | nindent 12 }}
+            {{- end }}
+          resources:
+            {{- if $job.resources }}
+            {{- toYaml $job.resources | nindent 12 }}
+            {{- else }}{}
+            {{- end }}
+      imagePullSecrets:
+        {{- if $.Values.global.image.pullSecrets }}
+        {{- toYaml $.Values.global.image.pullSecrets | nindent 8 }}
+        {{- end }}
+{{- end }}
+{{- end }}
--- a/devops/helm/stellaops/templates/networkpolicy.yaml
+++ b/devops/helm/stellaops/templates/networkpolicy.yaml
@@ -0,0 +1,45 @@
+{{- if .Values.networkPolicy.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "stellaops.fullname" . }}-default
+  labels:
+    {{- include "stellaops.labels" . | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "stellaops.selectorLabelsRoot" . | nindent 6 }}
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    - from:
+        {{- if .Values.networkPolicy.ingressNamespaces }}
+        - namespaceSelector:
+            matchLabels:
+              {{- toYaml .Values.networkPolicy.ingressNamespaces | nindent 14 }}
+        {{- end }}
+        {{- if .Values.networkPolicy.ingressPods }}
+        - podSelector:
+            matchLabels:
+              {{- toYaml .Values.networkPolicy.ingressPods | nindent 14 }}
+        {{- end }}
+      ports:
+        - protocol: TCP
+          port: {{ default 80 .Values.networkPolicy.ingressPort }}
+  egress:
+    - to:
+        {{- if .Values.networkPolicy.egressNamespaces }}
+        - namespaceSelector:
+            matchLabels:
+              {{- toYaml .Values.networkPolicy.egressNamespaces | nindent 14 }}
+        {{- end }}
+        {{- if .Values.networkPolicy.egressPods }}
+        - podSelector:
+            matchLabels:
+              {{- toYaml .Values.networkPolicy.egressPods | nindent 14 }}
+        {{- end }}
+      ports:
+        - protocol: TCP
+          port: {{ default 443 .Values.networkPolicy.egressPort }}
+{{- end }}
--- a/devops/helm/stellaops/templates/orchestrator-mock.yaml
+++ b/devops/helm/stellaops/templates/orchestrator-mock.yaml
@@ -0,0 +1,22 @@
+{{- if .Values.mock.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: orchestrator-mock
+  annotations:
+    stellaops.dev/mock: "true"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: orchestrator-mock
+  template:
+    metadata:
+      labels:
+        app: orchestrator-mock
+    spec:
+      containers:
+        - name: orchestrator
+          image: "{{ .Values.mock.orchestrator.image }}"
+          args: ["dotnet", "StellaOps.Orchestrator.WebService.dll"]
+{{- end }}
--- a/devops/helm/stellaops/templates/otel-collector.yaml
+++ b/devops/helm/stellaops/templates/otel-collector.yaml
@@ -0,0 +1,121 @@
+{{- if .Values.telemetry.collector.enabled }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "stellaops.telemetryCollector.fullname" . }}
+  labels:
+    {{- include "stellaops.labels" (dict "root" . "name" "otel-collector" "svc" (dict "class" "telemetry")) | nindent 4 }}
+data:
+  config.yaml: |
+{{ include "stellaops.telemetryCollector.config" . | indent 4 }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "stellaops.telemetryCollector.fullname" . }}
+  labels:
+    {{- include "stellaops.labels" (dict "root" . "name" "otel-collector" "svc" (dict "class" "telemetry")) | nindent 4 }}
+spec:
+  replicas: {{ .Values.telemetry.collector.replicas | default 1 }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ include "stellaops.name" . | quote }}
+      app.kubernetes.io/component: "otel-collector"
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: {{ include "stellaops.name" . | quote }}
+        app.kubernetes.io/component: "otel-collector"
+        stellaops.profile: {{ .Values.global.profile | quote }}
+    spec:
+      containers:
+        - name: otel-collector
+          image: {{ .Values.telemetry.collector.image | default "otel/opentelemetry-collector:0.105.0" | quote }}
+          args:
+            - "--config=/etc/otel/config.yaml"
+          ports:
+            - name: otlp-grpc
+              containerPort: 4317
+            - name: otlp-http
+              containerPort: 4318
+            - name: metrics
+              containerPort: 9464
+            - name: health
+              containerPort: 13133
+            - name: pprof
+              containerPort: 1777
+          env:
+            - name: STELLAOPS_OTEL_TLS_CERT
+              value: {{ .Values.telemetry.collector.tls.certPath | default "/etc/otel/tls/tls.crt" | quote }}
+            - name: STELLAOPS_OTEL_TLS_KEY
+              value: {{ .Values.telemetry.collector.tls.keyPath | default "/etc/otel/tls/tls.key" | quote }}
+            - name: STELLAOPS_OTEL_TLS_CA
+              value: {{ .Values.telemetry.collector.tls.caPath | default "/etc/otel/tls/ca.crt" | quote }}
+            - name: STELLAOPS_OTEL_PROMETHEUS_ENDPOINT
+              value: {{ .Values.telemetry.collector.prometheusEndpoint | default "0.0.0.0:9464" | quote }}
+            - name: STELLAOPS_OTEL_REQUIRE_CLIENT_CERT
+              value: {{ .Values.telemetry.collector.requireClientCert | default true | quote }}
+            - name: STELLAOPS_TENANT_ID
+              value: {{ .Values.telemetry.collector.defaultTenant | default "unknown" | quote }}
+            - name: STELLAOPS_OTEL_LOG_LEVEL
+              value: {{ .Values.telemetry.collector.logLevel | default "info" | quote }}
+          volumeMounts:
+            - name: config
+              mountPath: /etc/otel/config.yaml
+              subPath: config.yaml
+              readOnly: true
+            - name: tls
+              mountPath: /etc/otel/tls
+              readOnly: true
+          livenessProbe:
+            httpGet:
+              scheme: HTTPS
+              port: health
+              path: /healthz
+            initialDelaySeconds: 10
+            periodSeconds: 30
+          readinessProbe:
+            httpGet:
+              scheme: HTTPS
+              port: health
+              path: /healthz
+            initialDelaySeconds: 5
+            periodSeconds: 15
+{{- with .Values.telemetry.collector.resources }}
+          resources:
+{{ toYaml . | indent 12 }}
+{{- end }}
+      volumes:
+        - name: config
+          configMap:
+            name: {{ include "stellaops.telemetryCollector.fullname" . }}
+        - name: tls
+          secret:
+            secretName: {{ .Values.telemetry.collector.tls.secretName | required "telemetry.collector.tls.secretName is required" }}
+{{- if .Values.telemetry.collector.tls.items }}
+            items:
+{{ toYaml .Values.telemetry.collector.tls.items | indent 14 }}
+{{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "stellaops.telemetryCollector.fullname" . }}
+  labels:
+    {{- include "stellaops.labels" (dict "root" . "name" "otel-collector" "svc" (dict "class" "telemetry")) | nindent 4 }}
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: {{ include "stellaops.name" . | quote }}
+    app.kubernetes.io/component: "otel-collector"
+  ports:
+    - name: otlp-grpc
+      port: {{ .Values.telemetry.collector.service.grpcPort | default 4317 }}
+      targetPort: otlp-grpc
+    - name: otlp-http
+      port: {{ .Values.telemetry.collector.service.httpPort | default 4318 }}
+      targetPort: otlp-http
+    - name: metrics
+      port: {{ .Values.telemetry.collector.service.metricsPort | default 9464 }}
+      targetPort: metrics
+{{- end }}
--- a/devops/helm/stellaops/templates/packs-mock.yaml
+++ b/devops/helm/stellaops/templates/packs-mock.yaml
@@ -0,0 +1,44 @@
+{{- if .Values.mock.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: packs-registry-mock
+  annotations:
+    stellaops.dev/mock: "true"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: packs-registry-mock
+  template:
+    metadata:
+      labels:
+        app: packs-registry-mock
+    spec:
+      containers:
+        - name: packs-registry
+          image: "{{ .Values.mock.packsRegistry.image }}"
+          args: ["dotnet", "StellaOps.PacksRegistry.dll"]
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: task-runner-mock
+  annotations:
+    stellaops.dev/mock: "true"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: task-runner-mock
+  template:
+    metadata:
+      labels:
+        app: task-runner-mock
+    spec:
+      containers:
+        - name: task-runner
+          image: "{{ .Values.mock.taskRunner.image }}"
+          args: ["dotnet", "StellaOps.TaskRunner.WebService.dll"]
+{{- end }}
--- a/devops/helm/stellaops/templates/policy-mock.yaml
+++ b/devops/helm/stellaops/templates/policy-mock.yaml
@@ -0,0 +1,22 @@
+{{- if .Values.mock.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: policy-registry-mock
+  annotations:
+    stellaops.dev/mock: "true"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: policy-registry-mock
+  template:
+    metadata:
+      labels:
+        app: policy-registry-mock
+    spec:
+      containers:
+        - name: policy-registry
+          image: "{{ .Values.mock.policyRegistry.image }}"
+          args: ["dotnet", "StellaOps.Policy.Engine.dll"]
+{{- end }}
--- a/devops/helm/stellaops/templates/vex-mock.yaml
+++ b/devops/helm/stellaops/templates/vex-mock.yaml
@@ -0,0 +1,22 @@
+{{- if .Values.mock.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: vex-lens-mock
+  annotations:
+    stellaops.dev/mock: "true"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: vex-lens-mock
+  template:
+    metadata:
+      labels:
+        app: vex-lens-mock
+    spec:
+      containers:
+        - name: vex-lens
+          image: "{{ .Values.mock.vexLens.image }}"
+          args: ["dotnet", "StellaOps.VexLens.dll"]
+{{- end }}
--- a/devops/helm/stellaops/templates/vuln-mock.yaml
+++ b/devops/helm/stellaops/templates/vuln-mock.yaml
@@ -0,0 +1,44 @@
+{{- if .Values.mock.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: findings-ledger-mock
+  annotations:
+    stellaops.dev/mock: "true"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: findings-ledger-mock
+  template:
+    metadata:
+      labels:
+        app: findings-ledger-mock
+    spec:
+      containers:
+        - name: findings-ledger
+          image: "{{ .Values.mock.findingsLedger.image }}"
+          args: ["dotnet", "StellaOps.Findings.Ledger.WebService.dll"]
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: vuln-explorer-api-mock
+  annotations:
+    stellaops.dev/mock: "true"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: vuln-explorer-api-mock
+  template:
+    metadata:
+      labels:
+        app: vuln-explorer-api-mock
+    spec:
+      containers:
+        - name: vuln-explorer-api
+          image: "{{ .Values.mock.vulnExplorerApi.image }}"
+          args: ["dotnet", "StellaOps.VulnExplorer.Api.dll"]
+{{- end }}