Stateful in-memory Server-Sent-Events hub for the Krateo portal notifications/events bell: it polls ClickHouse for new Kubernetes events and pushes them to connected browsers.
A single-binary Go service (stdlib HTTP + one Krateo dependency): each pod runs a
ClickHouse poller and an SSE fan-out hub. The portal's events bell opens
GET /notifications (SSE) and fetches history from GET /events (JSON). This is the
source repo — it ships only the image ghcr.io/krateo-platformops/sse-proxy; the
deployed Helm chart lives in
clickstack-chart
(charts/krateo-sse-proxy). Full picture: docs/index.md.
Normally installed by the Krateo installer as part of the observability
(clickstack) blueprint — the krateo-sse-proxy chart is reconciled as a Composition.
Standalone of the installer, the same chart installs directly:
helm install sse-proxy oci://ghcr.io/krateo-platformops/charts/krateo-sse-proxy \
--version 0.1.6 --namespace krateo-systemDetails (installer path, standalone manifest, local run): docs/usage.md.
Everything is env vars — see docs/configuration.md. Most used:
| Var | Default | Effect |
|---|---|---|
CLICKHOUSE_URL |
in-cluster ClickHouse | where events are polled from |
URL_AUTHN |
authn in krateo-system |
authn's base URL; the JWKS public-key set is derived from it and used to verify caller JWTs (RS256). Auth is mandatory — there is no open/pass-through mode. If URL_AUTHN and JWT_JWKS_URL are both empty the proxy refuses to start (fail-closed); for a local dev harness point them at a fake JWKS server |
RBAC_SCOPING_ENABLED |
false |
opt-in server-side per-tenant namespace scoping (requires the JWKS source to resolve; on main, not yet in a published image) |
- examples/events-snapshot — fetch the recent-events JSON snapshot from inside the cluster (a one-shot Job).
- examples/notifications-stream — subscribe to the live SSE stream and print the raw frames (a one-shot Job).
- docs/index.md — the map
- docs/overview.md — what it does and how it works
- docs/usage.md — how it is installed / consumed
- docs/configuration.md — the whole config surface
- docs/api.md — the HTTP/SSE contract
- docs/examples.md — examples index
- docs/release.md — how a release ships
- docs/log.md — curated history
go test ./... (pure stdlib tests; the RBAC tests fake the Kubernetes API via
KUBERNETES_API_URL). Tag bare semver X.Y.Z — no v prefix, a v-tag ships
nothing — to build + push the multi-arch image. Runbook: docs/release.md.