Kubernetes and Helm

The Helm chart packages nginx, nginz-iotd, optional nginz-iot-bridge, shared-memory volume, a shared pod process namespace, readiness probes, and the embedded operator console. Kubernetes remains an orchestrator. It never grants writer terms, synthesizes replay frontier, or routes from liveness alone.

Managed AWS EKS, Google GKE, and Azure AKS qualification is on hold. The installed evidence for this packaging is the Kind lifecycle profile.

Chart defaults

The chart default is Evaluation: one replica, memory store, panel enabled, MQTT LoadBalancer off, Prometheus scrape off.

profile: evaluation
replicaCount: 1
image:
  repository: darkanchor/citusio
  tag: "1.30"
panel:
  enabled: true
  root: /usr/share/nginz-iot-panel/browser
iotd:
  persistence:
    enabled: false
bridge:
  enabled: false

replicaCount values other than 1 are rejected. Multi-node ownership is not a replica count.

Customer registry pulls replace the sample repository with the entitled darkanchor/citusio, darkanchor/citusio-pro, darkanchor/citusio-max, or darkanchor/citusio-enterprise image after checkout.

Probes and shared memory

Readiness must follow daemon-owned route_to_node. TCP acceptance alone cannot establish it. The packaged probe uses the operator CLI (ngz-iot) against the admin snapshot. Pods need a shared-memory volume large enough for the configured rings; the chart default is 256Mi.

The chart sets shareProcessNamespace: true on every node pod. MPSC dead-producer recovery stores a producer PID plus process-start identity, so nginx, nginz-iotd, and bridge containers that share rings must resolve that identity in the same PID namespace as well as share memory. The shared namespace remains private to the pod—it is not hostPID. Do not disable it while retaining the multi-container shared-memory topology.

Run as the unprivileged iot user (10001). The chart drops capabilities, uses a read-only root filesystem, and applies RuntimeDefault seccomp.

Operator console

Every lane image already contains the static panel. The chart does not deploy a second panel image or Node runtime.

Enterprise terminates TLS at an external Ingress or load balancer and uses the authenticated same-origin container port. Set panel.ingress or panel.gateway only after the identity proxy injects verified principals and strips untrusted headers.

Enterprise values

Use values-enterprise.yaml explicitly. A profile string never grants ownership.

Enterprise values select the enterprise image, enable Prometheus rules, declare two named nodes with candidate terms, require a PostgreSQL secret, and optionally enable the namespaced fleet controller. The controller observes readiness; it does not replace fencing.

profile: enterprise
image:
  repository: darkanchor/citusio-enterprise
  tag: "1.30"
enterprise:
  nodes:
    - id: node-a
      candidateTerm: 1
    - id: node-b
      candidateTerm: 2
  postgres:
    existingSecret: nginz-iot-postgres
    dsnKey: dsn

See fenced active–standby before pointing a Service or Ingress at either node.

Cloud MQTT exposure

The chart keeps an internal MQTT Service separate from optional LoadBalancer exposure. Enable the MQTT listener only after the load-balancer controller and source-range policy are in place. Admin listeners stay internal.