Initial commit

apps/frigate/manifests/envoy-route.yaml

@@ -0,0 +1,20 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: frigate
+  namespace: frigate
+spec:
+  parentRefs:
+    - name: edge
+      namespace: gateway
+      sectionName: https
+  hostnames:
+    - frigate.kube.huskypup.net
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: frigate
+          port: 5000

apps/frigate/manifests/istio-virtualservice.yaml

@@ -0,0 +1,27 @@
+apiVersion: networking.istio.io/v1beta1
+kind: VirtualService
+metadata:
+  name: frigate
+  namespace: frigate
+spec:
+  hosts:
+    - frigate.kube.huskypup.net
+  gateways:
+    - istio-system/edge
+  http:
+    # Authentik forward-auth endpoints must be reachable on the protected host
+    - match:
+        - uri:
+            prefix: /outpost.goauthentik.io
+      route:
+        - destination:
+            host: authentik-server.authentik.svc.cluster.local
+            port:
+              number: 80
+
+    - timeout: 3600s
+      route:
+        - destination:
+            host: frigate.frigate.svc.cluster.local
+            port:
+              number: 5000

apps/frigate/manifests/pvc.yaml

@@ -0,0 +1,29 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: frigate-config
+  namespace: frigate
+  labels:
+    app.kubernetes.io/name: frigate
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: rook-ceph-block
+  resources:
+    requests:
+      storage: 500Mi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: frigate-media
+  namespace: frigate
+  labels:
+    app.kubernetes.io/name: frigate
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: rook-ceph-block
+  resources:
+    requests:
+      storage: 500Gi

apps/frigate/manifests/secret.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: frigate-rtsp-credentials
+  namespace: frigate
+type: Opaque
+stringData:
+  # Update these with your actual camera credentials
+  # Then update apps/frigate/values.yaml with your camera RTSP URLs
+  FRIGATE_RTSP_USERNAME: your_camera_username
+  FRIGATE_RTSP_PASSWORD: your_camera_password

apps/frigate/values.yaml

@@ -0,0 +1,182 @@
+# Frigate Helm Chart Values
+# NVR with realtime object detection for IP cameras
+#
+# FEATURES:
+#   ✓ Object detection for IP cameras
+#   ✓ Persistent storage for recordings via Rook-Ceph
+#   ✓ TLS certificates via cert-manager
+#   ✓ Ingress via Istio VirtualService
+#   ✓ MQTT integration (optional)
+
+# Reduce Istio sidecar CPU request - frigate already uses 1 CPU request
+# and the cluster runs at ~98% CPU allocation. Default 10m sidecar request
+# can prevent scheduling.
+podAnnotations:
+  sidecar.istio.io/proxyCPU: "1m"
+
+image:
+  repository: ghcr.io/blakeblackshear/frigate
+  tag: "0.13.2"
+  pullPolicy: IfNotPresent
+
+service:
+  main:
+    type: ClusterIP
+    ports:
+      http:
+        port: 5000
+
+# Ingress disabled - Istio VirtualService handles routing
+ingress:
+  main:
+    enabled: false
+
+env:
+  TZ: America/New_York
+  FRIGATE_MQTT_HOST: "mosquitto.mqtt"
+  FRIGATE_MQTT_PORT: "1883"
+
+envFromSecrets:
+  - frigate-rtsp-credentials
+
+config: |
+  mqtt:
+    host: mosquitto.mqtt
+    port: 1883
+    topic_prefix: frigate
+    client_id: frigate
+  detectors:
+    cpu1:
+      type: cpu
+  cameras:
+    basement:
+      ffmpeg:
+        inputs:
+          - path: rtsp://admin:admin!@172.28.200.10:554/cam/realmonitor?channel=1&subtype=1
+            roles:
+              - detect
+          - path: rtsp://admin:admin!@172.28.200.10:554/cam/realmonitor?channel=1&subtype=0
+            roles:
+              - record
+      detect:
+        width: 704
+        height: 480
+        fps: 5
+      record:
+        enabled: true
+        retain:
+          days: 5
+          mode: all
+      snapshots:
+        enabled: true
+        timestamp: true
+        bounding_box: true
+    patio:
+      ffmpeg:
+        inputs:
+          - path: rtsp://admin:admin!@172.28.200.11:554/cam/realmonitor?channel=1&subtype=1
+            roles:
+              - detect
+          - path: rtsp://admin:admin!@172.28.200.11:554/cam/realmonitor?channel=1&subtype=0
+            roles:
+              - record
+      detect:
+        width: 704
+        height: 480
+        fps: 5
+      record:
+        enabled: true
+        retain:
+          days: 5
+          mode: all
+      snapshots:
+        enabled: true
+        timestamp: true
+        bounding_box: true
+    backyard:
+      ffmpeg:
+        inputs:
+          - path: rtsp://admin:admin!@172.28.200.12:554/cam/realmonitor?channel=1&subtype=1
+            roles:
+              - detect
+          - path: rtsp://admin:admin!@172.28.200.12:554/cam/realmonitor?channel=1&subtype=0
+            roles:
+              - record
+      detect:
+        width: 704
+        height: 480
+        fps: 5
+      record:
+        enabled: true
+        retain:
+          days: 5
+          mode: all
+      snapshots:
+        enabled: true
+        timestamp: true
+        bounding_box: true
+  go2rtc:
+    streams:
+      basement: rtsp://admin:admin!@172.28.200.10:554/cam/realmonitor?channel=1&subtype=0
+      basement_alt: rtsp://admin:admin!@172.28.200.10:554/cam/realmonitor?channel=1&subtype=1
+      patio: rtsp://admin:admin!@172.28.200.11:554/cam/realmonitor?channel=1&subtype=0
+      patio_alt: rtsp://admin:admin!@172.28.200.11:554/cam/realmonitor?channel=1&subtype=1
+      backyard: rtsp://admin:admin!@172.28.200.12:554/cam/realmonitor?channel=1&subtype=0
+      backyard_alt: rtsp://admin:admin!@172.28.200.12:554/cam/realmonitor?channel=1&subtype=1
+  objects:
+    track:
+      - person
+      - car
+      - dog
+      - cat
+      - vehicle
+  motion:
+    threshold: 25
+
+persistence:
+  config:
+    enabled: true
+    storageClass: rook-ceph-block
+    accessMode: ReadWriteOnce
+    size: 500Mi
+  media:
+    enabled: true
+    storageClass: rook-ceph-block
+    accessMode: ReadWriteOnce
+    size: 500Gi
+
+shmSize: 2Gi
+
+tmpfs:
+  enabled: true
+  sizeLimit: 2Gi
+
+securityContext:
+  privileged: false
+  capabilities:
+    drop:
+      - ALL
+
+resources:
+  requests:
+    cpu: 50m
+    memory: 1Gi
+  limits:
+    cpu: 500m
+    memory: 4Gi
+
+probes:
+  liveness:
+    enabled: true
+    initialDelaySeconds: 5
+    failureThreshold: 5
+  readiness:
+    enabled: true
+    initialDelaySeconds: 5
+    failureThreshold: 5
+  startup:
+    enabled: true
+    failureThreshold: 5
+
+nodeSelector:
+  kubernetes.io/arch: amd64