feat: Update Frigate Helm chart to version 0.2.0 and enhance deployment with init container for config seeding

frigate/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: frigate
 description: Frigate NVR Helm chart with Rockchip RK3588 hardware acceleration (CPU/GPU/NPU)
 type: application
-version: 0.1.0
+version: 0.2.0
 appVersion: "0.15.0"
 annotations:
   version-source: github-release:blakeblackshear/frigate

frigate/templates/configmap.yaml

@@ -1,9 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: {{ .Release.Name }}-config
-  labels:
-    {{- include "frigate.labels" . | nindent 4 }}
-data:
-  config.yaml: |
-{{ toYaml .Values.frigateConfig | indent 4 }}

frigate/templates/deployment.yaml

@@ -17,9 +17,6 @@ spec:
     metadata:
       labels:
         {{- include "frigate.selectorLabels" . | nindent 8 }}
-      annotations:
-        # Roll the pod when the config ConfigMap changes
-        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
     spec:
       {{- with .Values.nodeSelector }}
       nodeSelector:
@@ -33,6 +30,27 @@ spec:
       affinity:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- if .Values.configSeed.existingConfigMap }}
+      initContainers:
+        - name: seed-config
+          image: "{{ .Values.initImage.repository }}:{{ .Values.initImage.tag }}"
+          imagePullPolicy: {{ .Values.initImage.pullPolicy }}
+          command:
+            - /bin/sh
+            - -ec
+            - |
+              if [ ! -f /config/config.yml ]; then
+                echo "Seeding /config/config.yml from ConfigMap"
+                cp /config-seed/{{ .Values.configSeed.key }} /config/config.yml
+              else
+                echo "/config/config.yml already exists, leaving Frigate's copy alone"
+              fi
+          volumeMounts:
+            - name: config
+              mountPath: /config
+            - name: config-seed
+              mountPath: /config-seed
+      {{- end }}
       containers:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default (printf "%s-rk" (.Chart.AppVersion | toString)) }}"
@@ -61,10 +79,10 @@ spec:
                 name: {{ .Values.existingSecret }}
           {{- end }}
           securityContext:
-            # RK3588 device nodes (/dev/dri, /dev/rga, /dev/mpp_service) are
+            # RK3588 device nodes are owned by video/render groups that don't
-            # accessible only to root + video/render groups. Privileged is the
+            # exist inside the Frigate image. Privileged is the simplest path
-            # simplest reliable path on k3s; tighten later with explicit
+            # on k3s; tighten later with explicit supplementalGroups if you
-            # supplementalGroups if you want.
+            # care.
             privileged: {{ .Values.rockchip.enabled }}
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
@@ -85,9 +103,6 @@ spec:
             timeoutSeconds: 10
             failureThreshold: 3
           volumeMounts:
-            - name: config-file
-              mountPath: /config/config.yaml
-              subPath: config.yaml
             - name: config
               mountPath: /config
             - name: media
@@ -104,12 +119,6 @@ spec:
             {{- end }}
             {{- end }}
       volumes:
-        - name: config-file
-          configMap:
-            name: {{ .Release.Name }}-config
-            items:
-              - key: config.yaml
-                path: config.yaml
         - name: config
           hostPath:
             path: {{ required "config.hostPath is required" .Values.config.hostPath }}
@@ -126,6 +135,11 @@ spec:
           hostPath:
             path: /etc/localtime
             type: File
+        {{- if .Values.configSeed.existingConfigMap }}
+        - name: config-seed
+          configMap:
+            name: {{ .Values.configSeed.existingConfigMap }}
+        {{- end }}
         {{- if .Values.rockchip.enabled }}
         {{- range .Values.rockchip.devices }}
         - name: {{ . | base | replace "_" "-" }}

frigate/values.yaml

@@ -4,12 +4,17 @@
 image:
   # Use the -rk variant for Rockchip hardware acceleration
   repository: ghcr.io/blakeblackshear/frigate
-  tag: ""              # defaults to "stable-rk" (see deployment.yaml) when empty
+  tag: ""              # defaults to "<appVersion>-rk" (see deployment.yaml) when empty
+  pullPolicy: IfNotPresent
+
+# Image used by the seed init container (needs `cp` + `sh`)
+initImage:
+  repository: busybox
+  tag: "1.36"
   pullPolicy: IfNotPresent
 
 timezone: "Europe/Kyiv"
 
-# Web UI / RTMP / RTSP ports
 httpPort: 5000
 rtspPort: 8554
 webrtcPort: 8555
@@ -21,7 +26,7 @@ service:
   webrtcPort: 8555
 
 # Frigate needs a large /dev/shm for clip processing.
-# Rough rule of thumb: 40MB per 1080p camera + 10MB overhead.
+# Rough rule of thumb: ~40 MiB per 1080p camera + overhead.
 shmSizeMi: 512
 
 resources:
@@ -32,7 +37,8 @@ resources:
     cpu: "4"
     memory: "4Gi"
 
-# /config persistence (Frigate database, model cache, runtime state)
+# /config persistence (Frigate database, config.yml, model cache, runtime state).
+# Frigate UI edits write here, so this MUST persist across pod restarts.
 config:
   hostPath: ""         # e.g. /srv/data/frigate/config
 
@@ -40,8 +46,17 @@ config:
 media:
   hostPath: ""         # e.g. /srv/data/frigate/media
 
+# Seed config from an existing ConfigMap. The init container copies
+# `<key>` → `/config/config.yml` ONLY if /config/config.yml is missing
+# (cp -n), so Frigate's own edits (UI, live reload) stay authoritative.
+#
+# To re-seed from Git, delete /config/config.yml on the host and restart
+# the pod.
+configSeed:
+  existingConfigMap: ""    # e.g. frigate-config-seed
+  key: config.yml
+
 # Rockchip device passthrough (RK3588).
-# Frigate's rockchip docs require these devices for ffmpeg-rkmpp + RKNPU detector.
 rockchip:
   enabled: true
   devices:
@@ -50,97 +65,13 @@ rockchip:
     - /dev/rga
     - /dev/mpp_service
 
-# Existing Kubernetes Secret with Frigate substitution env vars
+# Existing Kubernetes Secret whose keys are exposed as env vars on the
-# (every key in this Secret is exposed in the container as an env var; Frigate
+# Frigate container. Frigate substitutes {KEY} tokens in config.yml from
-# substitutes ${KEY} tokens in its config from any env var prefixed FRIGATE_).
+# any env var prefixed FRIGATE_.
-# The Secret must define at minimum:
-#   FRIGATE_MQTT_HOST, FRIGATE_MQTT_USER, FRIGATE_MQTT_PASSWORD
-# Plus one user/password pair per camera, e.g.:
-#   FRIGATE_REOLINK_FRONT_USER, FRIGATE_REOLINK_FRONT_PASSWORD
 existingSecret: ""
 
-# Inline frigate config.yaml. Rendered into a ConfigMap and mounted at
-# /config/config.yaml. Everything except secrets (rtsp passwords, mqtt creds)
-# belongs here; secrets are pulled from `existingSecret` via env substitution.
-frigateConfig:
-  mqtt:
-    enabled: true
-    host: "{FRIGATE_MQTT_HOST}"
-    port: 1883
-    user: "{FRIGATE_MQTT_USER}"
-    password: "{FRIGATE_MQTT_PASSWORD}"
-    topic_prefix: frigate
-    client_id: frigate
-
-  # Rockchip NPU detector (RKNPU on RK3588 has 3 cores).
-  detectors:
-    rknn:
-      type: rknn
-      num_cores: 3
-
-  # Detection model. Frigate auto-downloads supported RKNN models into
-  # /config/model_cache/rknn_cache on first start. Override here to use a
-  # custom .rknn placed on the config volume.
-  model:
-    path: /config/model_cache/rknn_cache/yolov9-t-320x320.rknn
-    model_type: yolo-generic
-    width: 320
-    height: 320
-    input_tensor: nhwc
-    input_pixel_format: rgb
-
-  # Hardware-accelerated video decoding via Rockchip MPP.
-  ffmpeg:
-    hwaccel_args: preset-rkmpp
-
-  detect:
-    enabled: true
-    width: 1280
-    height: 720
-    fps: 5
-
-  snapshots:
-    enabled: true
-    bounding_box: true
-    retain:
-      default: 7
-
-  record:
-    enabled: true
-    retain:
-      days: 3
-      mode: motion
-    alerts:
-      retain:
-        days: 14
-        mode: motion
-    detections:
-      retain:
-        days: 10
-        mode: motion
-
-  birdseye:
-    enabled: true
-    mode: motion
-
-  go2rtc:
-    streams: {}
-
-  logger:
-    default: info
-
-  # Cameras. Override / extend in the cluster HelmRelease.
-  # Use ${VAR} tokens for any value sourced from `existingSecret`.
-  cameras: {}
-
 nodeSelector: {}
 tolerations: []
 affinity: {}
 
 ingresses: {}
-  # https:
-  #   host: frigate.example.com
-  #   annotations: {}
-  #   tls:
-  #     - hosts:
-  #         - frigate.example.com