helm-charts/frigate/templates/deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ .Release.Name }}
  labels:
    {{- include "frigate.labels" . | nindent 4 }}
  annotations:
    version-source: {{ index .Chart.Annotations "version-source" }}
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      {{- include "frigate.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      labels:
        {{- include "frigate.selectorLabels" . | nindent 8 }}
    spec:
      {{- with .Values.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- if .Values.configSeed.existingConfigMap }}
      initContainers:
        - name: seed-config
          image: "{{ .Values.initImage.repository }}:{{ .Values.initImage.tag }}"
          imagePullPolicy: {{ .Values.initImage.pullPolicy }}
          command:
            - /bin/sh
            - -ec
            - |
              if [ ! -f /config/config.yml ]; then
                echo "Seeding /config/config.yml from ConfigMap"
                cp /config-seed/{{ .Values.configSeed.key }} /config/config.yml
              else
                echo "/config/config.yml already exists, leaving Frigate's copy alone"
              fi
          volumeMounts:
            - name: config
              mountPath: /config
            - name: config-seed
              mountPath: /config-seed
      {{- end }}
      containers:
        - name: {{ .Chart.Name }}
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default (printf "%s-rk" (.Chart.AppVersion | toString)) }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          ports:
            - name: http
              containerPort: {{ .Values.httpPort }}
              protocol: TCP
            - name: rtsp
              containerPort: {{ .Values.rtspPort }}
              protocol: TCP
            - name: webrtc
              containerPort: {{ .Values.webrtcPort }}
              protocol: TCP
            - name: webrtc-udp
              containerPort: {{ .Values.webrtcPort }}
              protocol: UDP
          env:
            - name: TZ
              value: {{ .Values.timezone | quote }}
            - name: LIBVA_DRIVER_NAME
              value: rkmpp
          {{- if .Values.existingSecret }}
          envFrom:
            - secretRef:
                name: {{ .Values.existingSecret }}
          {{- end }}
          securityContext:
            # RK3588 device nodes are owned by video/render groups that don't
            # exist inside the Frigate image. Privileged is the simplest path
            # on k3s; tighten later with explicit supplementalGroups if you
            # care.
            privileged: {{ .Values.rockchip.enabled }}
          resources:
            {{- toYaml .Values.resources | nindent 12 }}
          readinessProbe:
            httpGet:
              path: /api/version
              port: http
            initialDelaySeconds: 30
            periodSeconds: 10
            timeoutSeconds: 5
            failureThreshold: 6
          livenessProbe:
            httpGet:
              path: /api/version
              port: http
            initialDelaySeconds: 120
            periodSeconds: 30
            timeoutSeconds: 10
            failureThreshold: 3
          volumeMounts:
            - name: config
              mountPath: /config
            - name: media
              mountPath: /media/frigate
            - name: dshm
              mountPath: /dev/shm
            - name: localtime
              mountPath: /etc/localtime
              readOnly: true
            {{- if .Values.rockchip.enabled }}
            {{- range .Values.rockchip.devices }}
            - name: {{ . | base | replace "_" "-" }}
              mountPath: {{ . }}
            {{- end }}
            {{- end }}
      volumes:
        - name: config
          hostPath:
            path: {{ required "config.hostPath is required" .Values.config.hostPath }}
            type: DirectoryOrCreate
        - name: media
          hostPath:
            path: {{ required "media.hostPath is required" .Values.media.hostPath }}
            type: DirectoryOrCreate
        - name: dshm
          emptyDir:
            medium: Memory
            sizeLimit: {{ .Values.shmSizeMi }}Mi
        - name: localtime
          hostPath:
            path: /etc/localtime
            type: File
        {{- if .Values.configSeed.existingConfigMap }}
        - name: config-seed
          configMap:
            name: {{ .Values.configSeed.existingConfigMap }}
        {{- end }}
        {{- if .Values.rockchip.enabled }}
        {{- range .Values.rockchip.devices }}
        - name: {{ . | base | replace "_" "-" }}
          hostPath:
            path: {{ . }}
        {{- end }}
        {{- end }}