add a cagateway

services/cagateway/Chart.yaml

@@ -0,0 +1,7 @@
+# A Helm Chart for a ca-gateway service
+# This is hard coded into the module right now TODO: make a oci chart for this
+apiVersion: v2
+name: ec-gateway
+version: 1.0.0
+
+type: application

services/cagateway/compose.yml

@@ -0,0 +1,59 @@
+# When deploying IOCs to a server with docker, the choice is:
+#
+# 1. Use host network so their PVs available on the subnet
+# 2. Run a ca-gateway on each server and add all servers to client's
+#    EPICS_CA_ADDR_LIST
+#
+# at present the only available option for podman is to use host network
+
+services:
+
+  # ca-gateway for development #################################################
+
+  ca-gateway: &ca-gateway
+
+    image: ghcr.io/epics-containers/docker-ca-gateway:2.1.3ec1
+
+    expose:
+      - 5064-5065/udp
+      - 5064-5065
+
+    ports:
+      # bind to localhost to isolate channel access to this host only
+      - 127.0.0.1:5064:5064/udp
+      - 127.0.0.1:5064-5065:5064-5065
+
+    restart: unless-stopped
+
+    networks:
+      channel_access:
+        ipv4_address: 172.20.255.254
+
+    configs:
+      - source: ca-gateway_config
+        target: /config
+
+    command: -cip 172.20.255.255 -pvlist /config/pvlist -access /config/access -log /dev/stdout -debug 1
+
+    profiles:
+      - develop
+
+  # per server ca-gateway for deployment #######################################
+  ca-gateway-deploy:
+
+    <<: *ca-gateway
+
+    ports:
+    # TODO - drop the IP address but also set up pvlist to make sure there
+    # are no loops - I need to look into safe config for per server ca-gateways
+    - 127.0.0.1:5064:5064/udp
+    - 127.0.0.1:5064-5065:5064-5065
+
+    command: -cip 172.20.255.255 -pvlist /config/pvlist -access /config/access -log /dev/stdout -debug 1
+
+    profiles:
+      - deploy
+
+configs:
+  ca-gateway_config:
+    file: ./config

services/cagateway/config/access

@@ -0,0 +1,6 @@
+# See /EPICS/extensions/src/gateway/GATEWAY.access for more detailed example
+
+ASG(DEFAULT) {
+   RULE(1,READ)
+   RULE(1,WRITE)
+}

services/cagateway/config/pvlist

@@ -0,0 +1,9 @@
+# See /EPICS/extensions/src/gateway/GATEWAY.pvlist for more detailed example
+
+EVALUATION ORDER ALLOW, DENY
+
+BL47P.*            ALLOW
+
+# [0-9].*          ALLOW
+# [a-z].*          ALLOW
+# [A-Z].*          ALLOW

services/cagateway/templates/configmap.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name:  {{ .Release.Name }}-config
+  labels:
+    app: {{ .Release.Name }}
+data:
+
+# contents of the ioc instance config folder
+{{ (.Files.Glob "config/*").AsConfig | indent 2 }}

services/cagateway/templates/deployment.yaml

@@ -0,0 +1,83 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: {{ .Release.Name }}
+    enabled: 'true'
+    ioc_group: p47
+    is_ioc: 'true'
+    location: bl47p
+  name: {{ .Release.Name }}
+  namespace: p47-beamline
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: {{ .Release.Name }}
+  template:
+    metadata:
+      creationTimestamp: null
+      labels:
+        app: {{ .Release.Name }}
+        ioc_group: p47
+        is_ioc: 'true'
+        location: bl47p
+        rollme: goWO0
+    spec:
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: beamline
+                    operator: In
+                    values:
+                      - bl47p
+      containers:
+        - command:
+            - -sport 6064 -cip 172.23.255.255 -pvlist /config/pvlist -access /config/access -log /dev/stdout -debug 1
+          env:
+            - name: IOC_NAME
+              value: {{ .Release.Name }}
+            - name: IOC_LOCATION
+              value: bl47p
+            - name: IOC_GROUP
+              value: p47
+          image: {{ .Values.image }}
+          imagePullPolicy: Always
+          name: {{ .Release.Name }}
+          resources:
+            limits:
+              cpu: 500m
+              memory: 256Mi
+            requests:
+              cpu: 100m
+              memory: 64Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+          stdin: true
+          tty: true
+          volumeMounts:
+            - mountPath: /config
+              name: config-volume
+      hostNetwork: true
+      restartPolicy: Always
+      terminationGracePeriodSeconds: 3
+      tolerations:
+        - effect: NoSchedule
+          key: beamline
+          operator: Equal
+          value: bl47p
+        - effect: NoSchedule
+          key: location
+          operator: Equal
+          value: bl47p
+        - effect: NoSchedule
+          key: nodetype
+          operator: Equal
+          value: training-rig
+      volumes:
+        - configMap:
+            defaultMode: 420
+            name: {{ .Release.Name }}-config
+          name: config-volume

services/cagateway/values.yaml

@@ -0,0 +1 @@
+image: ghcr.io/epics-containers/docker-ca-gateway:2.1.3ec1

services/values.yaml

@@ -10,7 +10,7 @@ global:
 ioc-instance:
   # useHostNetwork - use host network for IOC - required for Channel Access
   # to work outside of the cluster
-  hostNetwork: true
+  hostNetwork: false
 
   # affinity and tolerations to get the right nodes on pollux
   securityContext: