@mseep/open-computer-use 1.0.0

package/helm/computer-use-server/templates/deployment.yaml

@@ -0,0 +1,248 @@
+# SPDX-License-Identifier: FSL-1.1-Apache-2.0
+# Copyright (c) 2025 Open Computer Use Contributors
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "computer-use-server.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "computer-use-server.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.orchestrator.replicas }}
+  # Recreate — the orchestrator owns RWO PVCs and an inner dockerd that cannot
+  # safely overlap with itself during rollout.
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      {{- include "computer-use-server.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "computer-use-server.selectorLabels" . | nindent 8 }}
+        {{- with .Values.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
+        {{- if and .Values.secrets.create (not .Values.secrets.existingSecret) }}
+        checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
+        {{- end }}
+        {{- if .Values.dind.kataInit.enabled }}
+        checksum/dind-init: {{ include (print $.Template.BasePath "/configmap-dind-init.yaml") . | sha256sum }}
+        {{- end }}
+        {{- with .Values.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      serviceAccountName: {{ include "computer-use-server.serviceAccountName" . }}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.orchestrator.runtimeClassName }}
+      runtimeClassName: {{ . }}
+      {{- end }}
+      {{- with .Values.orchestrator.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.orchestrator.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.orchestrator.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      volumes:
+        # Socket the orchestrator and cleanup sidecar use to talk to inner dockerd,
+        # shared via an emptyDir.
+        - name: dind-socket
+          emptyDir: {}
+        # /var/lib/docker for the inner dockerd, mounted only into the dind
+        # container. Under Kata it is a Block-mode PVC (virtio-blk + ext4
+        # preserves xattrs); under the runc fallback it is an emptyDir.
+        - name: var-lib-docker
+          {{- if eq (include "computer-use-server.varLibDockerIsPVC" .) "true" }}
+          persistentVolumeClaim:
+            {{- if .Values.persistence.varLibDocker.persistentVolume.existingClaim }}
+            claimName: {{ .Values.persistence.varLibDocker.persistentVolume.existingClaim }}
+            {{- else }}
+            claimName: {{ include "computer-use-server.fullname" . }}-var-lib-docker
+            {{- end }}
+          {{- else }}
+          emptyDir:
+            sizeLimit: {{ .Values.persistence.varLibDocker.sizeLimit }}
+          {{- end }}
+        {{- if .Values.dind.kataInit.enabled }}
+        # Kata-guest init wrapper script — see configmap-dind-init.yaml.
+        - name: dind-init
+          configMap:
+            name: {{ include "computer-use-server.fullname" . }}-dind-init
+            defaultMode: 0755
+        {{- end }}
+        # PVCs follow the same enabled / existingClaim / emptyDir-fallback pattern
+        # so disabling any volume in values.yaml does not produce an unschedulable Pod.
+        - name: user-data
+          {{- if .Values.persistence.userData.existingClaim }}
+          persistentVolumeClaim:
+            claimName: {{ .Values.persistence.userData.existingClaim }}
+          {{- else if .Values.persistence.userData.enabled }}
+          persistentVolumeClaim:
+            claimName: {{ include "computer-use-server.fullname" . }}-user-data
+          {{- else }}
+          emptyDir: {}
+          {{- end }}
+        - name: data
+          {{- if .Values.persistence.data.existingClaim }}
+          persistentVolumeClaim:
+            claimName: {{ .Values.persistence.data.existingClaim }}
+          {{- else if .Values.persistence.data.enabled }}
+          persistentVolumeClaim:
+            claimName: {{ include "computer-use-server.fullname" . }}-data
+          {{- else }}
+          emptyDir: {}
+          {{- end }}
+        - name: skills-cache
+          {{- if .Values.persistence.skillsCache.existingClaim }}
+          persistentVolumeClaim:
+            claimName: {{ .Values.persistence.skillsCache.existingClaim }}
+          {{- else if .Values.persistence.skillsCache.enabled }}
+          persistentVolumeClaim:
+            claimName: {{ include "computer-use-server.fullname" . }}-skills-cache
+          {{- else }}
+          emptyDir: {}
+          {{- end }}
+      containers:
+        # ---------------------------------------------------------------------
+        # 1) Orchestrator (FastAPI app)
+        # ---------------------------------------------------------------------
+        - name: orchestrator
+          image: {{ include "computer-use-server.image" . | quote }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - name: mcp
+              containerPort: 8081
+              protocol: TCP
+          envFrom:
+            - configMapRef:
+                name: {{ include "computer-use-server.fullname" . }}
+            - secretRef:
+                name: {{ include "computer-use-server.secretName" . }}
+            {{- with .Values.orchestrator.envFrom }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          {{- with .Values.orchestrator.extraEnv }}
+          env:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          volumeMounts:
+            - name: dind-socket
+              mountPath: /var/run
+            - name: user-data
+              mountPath: /tmp/computer-use-data
+            - name: data
+              mountPath: /data
+            - name: skills-cache
+              mountPath: /data/skills-cache
+          {{- if .Values.orchestrator.probes.readiness.enabled }}
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: mcp
+            initialDelaySeconds: {{ .Values.orchestrator.probes.readiness.initialDelaySeconds }}
+            periodSeconds: {{ .Values.orchestrator.probes.readiness.periodSeconds }}
+            timeoutSeconds: {{ .Values.orchestrator.probes.readiness.timeoutSeconds }}
+            failureThreshold: {{ .Values.orchestrator.probes.readiness.failureThreshold }}
+          {{- end }}
+          {{- if .Values.orchestrator.probes.liveness.enabled }}
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: mcp
+            initialDelaySeconds: {{ .Values.orchestrator.probes.liveness.initialDelaySeconds }}
+            periodSeconds: {{ .Values.orchestrator.probes.liveness.periodSeconds }}
+            timeoutSeconds: {{ .Values.orchestrator.probes.liveness.timeoutSeconds }}
+            failureThreshold: {{ .Values.orchestrator.probes.liveness.failureThreshold }}
+          {{- end }}
+          resources:
+            {{- toYaml .Values.orchestrator.resources | nindent 12 }}
+          {{- with .Values.orchestrator.securityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+        # ---------------------------------------------------------------------
+        # 2) Inner Docker daemon (DinD)
+        # ---------------------------------------------------------------------
+        - name: dind
+          image: "{{ .Values.dind.image.repository }}:{{ .Values.dind.image.tag }}"
+          imagePullPolicy: {{ .Values.dind.image.pullPolicy }}
+          {{- if .Values.dind.kataInit.enabled }}
+          # Kata path: run the chart-managed init wrapper, which prepares the
+          # guest (fuse-overlayfs, /dev/fuse, Block PVC, cgroup shim) then
+          # exec's dockerd with the args below. See configmap-dind-init.yaml.
+          command:
+            - /usr/local/bin/dind-entrypoint.sh
+          {{- else }}
+          # Default path: the docker:dind entrypoint runs dockerd directly.
+          command:
+            - dockerd
+          {{- end }}
+          # Pin the socket location so the orchestrator (and the cleanup
+          # sidecar) can talk to it over the shared emptyDir at
+          # /var/run/docker.sock.
+          args:
+            - --host=unix:///var/run/docker.sock
+            - --storage-driver={{ .Values.dind.storageDriver }}
+          securityContext:
+            privileged: {{ eq (include "computer-use-server.dindPrivileged" .) "true" }}
+          volumeMounts:
+            - name: dind-socket
+              mountPath: /var/run
+            {{- if .Values.dind.kataInit.enabled }}
+            - name: dind-init
+              mountPath: /usr/local/bin/dind-entrypoint.sh
+              subPath: dind-entrypoint.sh
+            {{- end }}
+            {{- if ne (include "computer-use-server.varLibDockerIsPVC" .) "true" }}
+            - name: var-lib-docker
+              mountPath: /var/lib/docker
+            {{- end }}
+            # The inner dockerd needs access to /tmp/computer-use-data so the
+            # bind mounts it creates for workspace containers resolve to real
+            # files (same path inside the pod and inside spawned containers).
+            - name: user-data
+              mountPath: /tmp/computer-use-data
+          {{- if eq (include "computer-use-server.varLibDockerIsPVC" .) "true" }}
+          # Block-mode PVC — exposed as a raw device; the init wrapper formats
+          # it ext4 and mounts it at /var/lib/docker inside the guest.
+          volumeDevices:
+            - name: var-lib-docker
+              devicePath: /dev/var-lib-docker
+          {{- end }}
+          resources:
+            {{- toYaml .Values.dind.resources | nindent 12 }}
+        {{- if .Values.cleanup.enabled }}
+        # ---------------------------------------------------------------------
+        # 3) Cleanup sidecar — runs the same cron schedules as docker-compose.
+        # ---------------------------------------------------------------------
+        - name: cleanup
+          image: {{ include "computer-use-server.cleanupImage" . | quote }}
+          imagePullPolicy: {{ .Values.cleanup.image.pullPolicy }}
+          env:
+            - name: CONTAINER_MAX_AGE_HOURS
+              value: {{ .Values.cleanup.containerMaxAgeHours | quote }}
+            - name: DATA_MAX_AGE_DAYS
+              value: {{ .Values.cleanup.dataMaxAgeDays | quote }}
+            - name: DATA_DIR
+              value: /tmp/computer-use-data
+          volumeMounts:
+            # Share the dockerd socket via the same emptyDir.
+            - name: dind-socket
+              mountPath: /var/run
+            - name: user-data
+              mountPath: /tmp/computer-use-data
+          resources:
+            {{- toYaml .Values.cleanup.resources | nindent 12 }}
+        {{- end }}

package/helm/computer-use-server/templates/ingress.yaml

@@ -0,0 +1,38 @@
+# SPDX-License-Identifier: FSL-1.1-Apache-2.0
+# Copyright (c) 2025 Open Computer Use Contributors
+{{ if .Values.ingress.enabled -}}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "computer-use-server.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "computer-use-server.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- with .Values.ingress.className }}
+  ingressClassName: {{ . }}
+  {{- end }}
+  {{- with .Values.ingress.tls }}
+  tls:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            pathType: {{ .pathType }}
+            backend:
+              service:
+                name: {{ include "computer-use-server.fullname" $ }}
+                port:
+                  number: {{ $.Values.service.port }}
+          {{- end }}
+    {{- end }}
+{{- end }}

package/helm/computer-use-server/templates/networkpolicy.yaml

@@ -0,0 +1,50 @@
+# SPDX-License-Identifier: FSL-1.1-Apache-2.0
+# Copyright (c) 2025 Open Computer Use Contributors
+{{ if .Values.networkPolicy.enabled -}}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "computer-use-server.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "computer-use-server.labels" . | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "computer-use-server.selectorLabels" . | nindent 6 }}
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    - from:
+        - podSelector: {}
+        {{- with .Values.networkPolicy.ingressFrom }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      ports:
+        - port: 8081
+          protocol: TCP
+  egress:
+    # DNS — both UDP and TCP, against any namespace's kube-dns pods.
+    - to:
+        - namespaceSelector: {}
+      ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+    # In-cluster service traffic (e.g. external Postgres release, Open WebUI).
+    # Without this, an in-cluster DB or any Service the orchestrator depends
+    # on becomes unreachable when networkPolicy is enabled.
+    - to:
+        - namespaceSelector: {}
+    # Public internet — LLM APIs, registry pulls (workspace image), webhooks.
+    # Operators who need to block egress to private ranges (cloud metadata,
+    # intranet) should add explicit deny rules via networkPolicy.extraEgress.
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+    {{- with .Values.networkPolicy.extraEgress }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+{{- end }}

package/helm/computer-use-server/templates/pdb.yaml

@@ -0,0 +1,16 @@
+# SPDX-License-Identifier: FSL-1.1-Apache-2.0
+# Copyright (c) 2025 Open Computer Use Contributors
+{{ if .Values.podDisruptionBudget.enabled -}}
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{ include "computer-use-server.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "computer-use-server.labels" . | nindent 4 }}
+spec:
+  minAvailable: {{ .Values.podDisruptionBudget.minAvailable }}
+  selector:
+    matchLabels:
+      {{- include "computer-use-server.selectorLabels" . | nindent 6 }}
+{{- end }}

package/helm/computer-use-server/templates/pvc-data.yaml

@@ -0,0 +1,20 @@
+# SPDX-License-Identifier: FSL-1.1-Apache-2.0
+# Copyright (c) 2025 Open Computer Use Contributors
+{{ if and .Values.persistence.data.enabled (not .Values.persistence.data.existingClaim) -}}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "computer-use-server.fullname" . }}-data
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "computer-use-server.labels" . | nindent 4 }}
+spec:
+  accessModes:
+    - {{ .Values.persistence.data.accessMode }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.data.size }}
+  {{- if .Values.persistence.data.storageClass }}
+  storageClassName: {{ .Values.persistence.data.storageClass | quote }}
+  {{- end }}
+{{- end }}

package/helm/computer-use-server/templates/pvc-skills-cache.yaml

@@ -0,0 +1,20 @@
+# SPDX-License-Identifier: FSL-1.1-Apache-2.0
+# Copyright (c) 2025 Open Computer Use Contributors
+{{ if and .Values.persistence.skillsCache.enabled (not .Values.persistence.skillsCache.existingClaim) -}}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "computer-use-server.fullname" . }}-skills-cache
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "computer-use-server.labels" . | nindent 4 }}
+spec:
+  accessModes:
+    - {{ .Values.persistence.skillsCache.accessMode }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.skillsCache.size }}
+  {{- if .Values.persistence.skillsCache.storageClass }}
+  storageClassName: {{ .Values.persistence.skillsCache.storageClass | quote }}
+  {{- end }}
+{{- end }}

package/helm/computer-use-server/templates/pvc-user-data.yaml

@@ -0,0 +1,20 @@
+# SPDX-License-Identifier: FSL-1.1-Apache-2.0
+# Copyright (c) 2025 Open Computer Use Contributors
+{{ if and .Values.persistence.userData.enabled (not .Values.persistence.userData.existingClaim) -}}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "computer-use-server.fullname" . }}-user-data
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "computer-use-server.labels" . | nindent 4 }}
+spec:
+  accessModes:
+    - {{ .Values.persistence.userData.accessMode }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.userData.size }}
+  {{- if .Values.persistence.userData.storageClass }}
+  storageClassName: {{ .Values.persistence.userData.storageClass | quote }}
+  {{- end }}
+{{- end }}

package/helm/computer-use-server/templates/pvc-var-lib-docker.yaml

@@ -0,0 +1,27 @@
+# SPDX-License-Identifier: FSL-1.1-Apache-2.0
+# Copyright (c) 2025 Open Computer Use Contributors
+{{- /*
+Block-mode PVC for the inner dockerd's /var/lib/docker (the Kata default).
+A Block PVC arrives in the Kata guest as a virtio-blk device whose ext4
+filesystem preserves security.capability xattrs that the virtio-fs root drops.
+*/}}
+{{- $pv := .Values.persistence.varLibDocker.persistentVolume | default dict }}
+{{- if and $pv.enabled (not $pv.existingClaim) }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "computer-use-server.fullname" . }}-var-lib-docker
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "computer-use-server.labels" . | nindent 4 }}
+spec:
+  accessModes:
+    - ReadWriteOnce
+  volumeMode: Block
+  resources:
+    requests:
+      storage: {{ $pv.size }}
+  {{- if $pv.storageClass }}
+  storageClassName: {{ $pv.storageClass | quote }}
+  {{- end }}
+{{- end }}

package/helm/computer-use-server/templates/secret.yaml

@@ -0,0 +1,23 @@
+# SPDX-License-Identifier: FSL-1.1-Apache-2.0
+# Copyright (c) 2025 Open Computer Use Contributors
+{{ if and .Values.secrets.create (not .Values.secrets.existingSecret) -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "computer-use-server.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "computer-use-server.labels" . | nindent 4 }}
+type: Opaque
+stringData:
+  MCP_API_KEY: {{ required "secrets.mcpApiKey is required when secrets.create=true and secrets.existingSecret is empty" .Values.secrets.mcpApiKey | quote }}
+  {{- with .Values.secrets.visionApiKey }}
+  VISION_API_KEY: {{ . | quote }}
+  {{- end }}
+  {{- with .Values.secrets.anthropicAuthToken }}
+  ANTHROPIC_AUTH_TOKEN: {{ . | quote }}
+  {{- end }}
+  {{- with .Values.secrets.openaiApiKey }}
+  OPENAI_API_KEY: {{ . | quote }}
+  {{- end }}
+{{- end }}

package/helm/computer-use-server/templates/service.yaml

@@ -0,0 +1,22 @@
+# SPDX-License-Identifier: FSL-1.1-Apache-2.0
+# Copyright (c) 2025 Open Computer Use Contributors
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "computer-use-server.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "computer-use-server.labels" . | nindent 4 }}
+  {{- with .Values.service.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - name: mcp
+      port: {{ .Values.service.port }}
+      targetPort: mcp
+      protocol: TCP
+  selector:
+    {{- include "computer-use-server.selectorLabels" . | nindent 4 }}

package/helm/computer-use-server/templates/serviceaccount.yaml

@@ -0,0 +1,15 @@
+# SPDX-License-Identifier: FSL-1.1-Apache-2.0
+# Copyright (c) 2025 Open Computer Use Contributors
+{{ if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "computer-use-server.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "computer-use-server.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}

package/helm/computer-use-server/templates/tests/test-health.yaml

@@ -0,0 +1,23 @@
+# SPDX-License-Identifier: FSL-1.1-Apache-2.0
+# Copyright (c) 2025 Open Computer Use Contributors
+apiVersion: v1
+kind: Pod
+metadata:
+  name: {{ include "computer-use-server.fullname" . }}-test-health
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "computer-use-server.labels" . | nindent 4 }}
+  annotations:
+    helm.sh/hook: test
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+spec:
+  restartPolicy: Never
+  containers:
+    - name: curl
+      image: curlimages/curl:8.10.1
+      command:
+        - sh
+        - -c
+        - >
+          curl -fsS --max-time 10
+          http://{{ include "computer-use-server.fullname" . }}:{{ .Values.service.port }}/health