feat: manually mirror opencoze's code from bytedance

Change-Id: I09a73aadda978ad9511264a756b2ce51f5761adf
2025-07-20 17:36:12 +08:00
commit 890153324f
14811 changed files with 1923430 additions and 0 deletions
--- a/helm/charts/opencoze/templates/NOTES.txt
+++ b/helm/charts/opencoze/templates/NOTES.txt
@@ -0,0 +1,22 @@
+1. Get the application URL by running these commands:
+{{- if .Values.ingress.enabled }}
+{{- range $host := .Values.ingress.hosts }}
+  {{- range .paths }}
+  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
+  {{- end }}
+{{- end }}
+{{- else if contains "NodePort" .Values.service.type }}
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "opencoze.fullname" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.service.type }}
+     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+           You can watch its status by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "opencoze.fullname" . }}'
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "opencoze.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+  echo http://$SERVICE_IP:{{ .Values.service.port }}
+{{- else if contains "ClusterIP" .Values.service.type }}
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "opencoze.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+  export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
+  echo "Visit http://127.0.0.1:8080 to use your application"
+  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
+{{- end }}
--- a/helm/charts/opencoze/templates/_helpers.tpl
+++ b/helm/charts/opencoze/templates/_helpers.tpl
@@ -0,0 +1,50 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "opencoze.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "opencoze.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "opencoze.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Common labels.
+*/}}
+{{- define "opencoze.labels" -}}
+{{- if .Values.commonLabels }}
+{{- toYaml .Values.commonLabels | nindent 4 }}
+{{- end }}
+{{- if .Values.component }}
+app.kubernetes.io/component: {{ .Values.component }}
+{{- end }}
+app.kubernetes.io/name: {{ include "opencoze.name" . }}
+helm.sh/chart: {{ include "opencoze.chart" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
--- a/helm/charts/opencoze/templates/deployment.yaml
+++ b/helm/charts/opencoze/templates/deployment.yaml
@@ -0,0 +1,110 @@
+{{- if .Values.cozeServer.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ printf "%s-server" (include "opencoze.fullname" .) }}
+  labels:
+    {{- include "opencoze.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.cozeServer.replicaCount }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      app.kubernetes.io/name: {{ include "opencoze.name" . }}
+      app.kubernetes.io/component: server
+  template:
+    metadata:
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        app.kubernetes.io/name: {{ include "opencoze.name" . }}
+        app.kubernetes.io/component: server
+    spec:
+      initContainers:
+        - name: wait-for-mysql
+          image: {{ .Values.images.busybox }}
+          command: ['sh', '-c', 'until nc -z {{ include "opencoze.fullname" . }}-mysql 3306; do echo waiting for mysql; sleep 2; done']
+        {{- if .Values.redis.enabled }}
+        - name: wait-for-redis
+          image: {{ .Values.images.busybox }}
+          command: ['sh', '-c', 'until nc -z {{ include "opencoze.fullname" . }}-redis {{ .Values.redis.port }}; do echo waiting for redis; sleep 2; done']
+        {{- end }}
+        {{- if .Values.rocketmq.enabled }}
+        - name: wait-for-rocketmq
+          image: {{ .Values.images.busybox }}
+          command: ['sh', '-c', 'until nc -z {{ include "opencoze.fullname" . }}-rocketmq-namesrv 9876; do echo waiting for rocketmq; sleep 2; done']
+        {{- end }}
+        {{- if .Values.elasticsearch.enabled }}
+        - name: wait-for-elasticsearch
+          image: {{ .Values.images.busybox }}
+          command: ['sh', '-c', 'until nc -z {{ include "opencoze.fullname" . }}-elasticsearch 9200; do echo waiting for elasticsearch; sleep 2; done']
+        {{- end }}
+        {{- if .Values.minio.enabled }}
+        - name: wait-for-minio
+          image: {{ .Values.images.busybox }}
+          command: ['sh', '-c', 'until nc -z {{ include "opencoze.fullname" . }}-minio 9000; do echo waiting for minio; sleep 2; done']
+        {{- end }}
+        {{- if .Values.milvus.enabled }}
+        - name: wait-for-milvus
+          image: {{ .Values.images.busybox }}
+          command: ['sh', '-c', 'until nc -z {{ include "opencoze.fullname" . }}-milvus 19530; do echo waiting for milvus; sleep 2; done']
+        {{- end }}
+      containers:
+        - name: {{ .Chart.Name }}
+          image: "{{ .Values.cozeServer.image.repository }}:{{ .Values.cozeServer.image.tag }}"
+          imagePullPolicy: {{ .Values.cozeServer.image.pullPolicy }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.cozeServer.service.port }}
+          env:
+            - name: MYSQL_HOST
+              value: "{{ include "opencoze.fullname" . }}-mysql"
+            - name: MYSQL_PORT
+              value: {{ .Values.mysql.port | quote }}
+            - name: MYSQL_USER
+              value: {{ .Values.mysql.user | quote }}
+            - name: MYSQL_PASSWORD
+              value: {{ .Values.mysql.password | quote }}
+            - name: MYSQL_DATABASE
+              value: {{ .Values.mysql.database | quote }}
+            - name: REDIS_ADDR
+              value: "{{ include "opencoze.fullname" . }}-redis:{{ .Values.redis.port }}"
+            - name: MINIO_AK
+              value: {{ .Values.minio.accessKey | quote }}
+            - name: MINIO_SK
+              value: {{ .Values.minio.secretKey | quote }}
+            - name: STORAGE_BUCKET
+              value: {{ .Values.minio.bucket | quote }}
+            - name: ES_ADDR
+              value: "http://{{ include "opencoze.fullname" . }}-elasticsearch:9200"
+            - name: ES_USERNAME
+              value: {{ .Values.elasticsearch.username | quote }}
+            - name: ES_PASSWORD
+              value: {{ .Values.elasticsearch.password | quote }}
+            - name: RMQ_NAME_SERVER
+              value: "http://{{ include "opencoze.fullname" . }}-rocketmq-namesrv:9876"
+            - name: MILVUS_ADDR
+              value: "{{ include "opencoze.fullname" . }}-milvus:19530"
+            - name: MYSQL_DSN
+              value: "{{ .Values.mysql.user }}:{{ .Values.mysql.password }}@tcp({{ include "opencoze.fullname" . }}-mysql:3306)/{{ .Values.mysql.database }}?charset=utf8mb4&parseTime=True&loc=Local"
+            {{- range $key, $val := .Values.cozeServer.env }}
+            - name: {{ $key }}
+              value: {{ $val | quote }}
+            {{- end }}
+
+          {{- if .Values.cozeServer.confHostPath }}
+          volumeMounts:
+            - name: opencoze-server-conf
+              mountPath: /app/resources/conf
+          {{- end }}
+      {{- if .Values.cozeServer.confHostPath }}
+      volumes:
+        - name: opencoze-server-conf
+          hostPath:
+            path: {{ .Values.cozeServer.confHostPath }}
+            type: DirectoryOrCreate
+      {{- end }}
+{{- end }}
--- a/helm/charts/opencoze/templates/elasticsearch-init-configmap.yaml
+++ b/helm/charts/opencoze/templates/elasticsearch-init-configmap.yaml
@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "opencoze.fullname" . }}-es-init-config
+data:
+{{ (.Files.Glob "files/es/*.json").AsConfig | indent 2 }}
--- a/helm/charts/opencoze/templates/elasticsearch-init-job.yaml
+++ b/helm/charts/opencoze/templates/elasticsearch-init-job.yaml
@@ -0,0 +1,47 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ include "opencoze.fullname" . }}-es-init
+
+spec:
+  template:
+    spec:
+      restartPolicy: Never
+      initContainers:
+        - name: wait-for-es
+          image: {{ .Values.images.busybox }}
+          command: ['sh', '-c', 'until nc -z {{ include "opencoze.fullname" . }}-elasticsearch 9200; do echo waiting for elasticsearch; sleep 2; done']
+      containers:
+        - name: es-init
+          image: {{ .Values.images.curl }}
+          env:
+            - name: ES_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-es-secret
+                  key: username
+            - name: ES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-es-secret
+                  key: password
+          command:
+            - /bin/sh
+            - -c
+            - |
+              set -ex
+              /scripts/setup_es.sh
+          volumeMounts:
+            - name: es-init-script
+              mountPath: /scripts
+            - name: es-index-schema
+              mountPath: /es_index_schema
+      volumes:
+        - name: es-init-script
+          configMap:
+            name: {{ include "opencoze.fullname" . }}-es-init-script
+            defaultMode: 0755
+        - name: es-index-schema
+          configMap:
+            name: {{ include "opencoze.fullname" . }}-es-init-config
+  backoffLimit: 4
--- a/helm/charts/opencoze/templates/elasticsearch-init-script-configmap.yaml
+++ b/helm/charts/opencoze/templates/elasticsearch-init-script-configmap.yaml
@@ -0,0 +1,44 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "opencoze.fullname" . }}-es-init-script
+data:
+  setup_es.sh: |
+    #!/bin/sh
+    set -ex
+
+    ES_HOST="http://{{ include "opencoze.fullname" . }}-elasticsearch:9200"
+
+    CURL_AUTH=""
+    if [ -n "$ES_USERNAME" ] && [ -n "$ES_PASSWORD" ]; then
+      CURL_AUTH="-u $ES_USERNAME:$ES_PASSWORD"
+    fi
+
+
+    # Upload index templates
+    for file in /es_index_schema/*.json; do
+      if [ -f "$file" ]; then
+        template_name=$(basename "$file" .index-template.json)
+        echo "Uploading index template $template_name"
+        curl -X PUT $CURL_AUTH "$ES_HOST/_index_template/$template_name" -H "Content-Type: application/json" --data-binary "@$file"
+      fi
+    done
+
+    # Create indices
+    for file in /es_index_schema/*.json; do
+      if [ -f "$file" ]; then
+        template_name=$(basename "$file" .index-template.json)
+        index_name=$template_name
+        echo "Creating index $index_name"
+        curl -X PUT $CURL_AUTH "$ES_HOST/$index_name" -H "Content-Type: application/json" -d'{
+          "settings": {
+            "index": {
+              "number_of_shards": 1,
+              "number_of_replicas": 1
+            }
+          }
+        }'
+      fi
+    done
+
+    echo "Elasticsearch setup complete."
--- a/helm/charts/opencoze/templates/elasticsearch-secret.yaml
+++ b/helm/charts/opencoze/templates/elasticsearch-secret.yaml
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Release.Name }}-es-secret
+  labels:
+    {{- include "opencoze.labels" . | nindent 4 }}
+type: Opaque
+data:
+  username: {{ .Values.elasticsearch.username | b64enc | quote }}
+  password: {{ .Values.elasticsearch.password | b64enc | quote }}
--- a/helm/charts/opencoze/templates/elasticsearch-service.yaml
+++ b/helm/charts/opencoze/templates/elasticsearch-service.yaml
@@ -0,0 +1,19 @@
+{{- if .Values.elasticsearch.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "opencoze.fullname" . }}-elasticsearch
+  labels:
+    {{- include "opencoze.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.elasticsearch.service.type }}
+  ports:
+    - port: {{ .Values.elasticsearch.service.port }}
+      targetPort: {{ .Values.elasticsearch.service.targetPort }}
+      protocol: TCP
+      name: http
+  selector:
+    app.kubernetes.io/component: elasticsearch
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/name: {{ include "opencoze.name" . }}
+{{- end }}
--- a/helm/charts/opencoze/templates/elasticsearch-statefulset.yaml
+++ b/helm/charts/opencoze/templates/elasticsearch-statefulset.yaml
@@ -0,0 +1,88 @@
+{{- if .Values.elasticsearch.enabled }}
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ include "opencoze.fullname" . }}-elasticsearch
+  labels:
+    {{- include "opencoze.labels" . | nindent 4 }}
+spec:
+  serviceName: {{ .Release.Name }}-elasticsearch
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: elasticsearch
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      app.kubernetes.io/name: {{ include "opencoze.name" . }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: elasticsearch
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        app.kubernetes.io/name: {{ include "opencoze.name" . }}
+    spec:
+      initContainers:
+      - name: install-plugins
+        image: "{{ .Values.elasticsearch.image.repository }}:{{ .Values.elasticsearch.image.tag }}"
+        securityContext:
+          runAsUser: 0
+        command:
+        - /bin/bash
+        - -c
+        - |
+          set -ex
+          echo 'Installing smartcn plugin...';
+          if [ ! -d /opt/bitnami/elasticsearch/plugins/analysis-smartcn ]; then
+            /opt/bitnami/elasticsearch/bin/elasticsearch-plugin install analysis-smartcn
+          fi
+        volumeMounts:
+        - name: es-plugins
+          mountPath: /opt/bitnami/elasticsearch/plugins
+      containers:
+        - name: elasticsearch
+          securityContext:
+            runAsUser: 0
+          image: "{{ .Values.elasticsearch.image.repository }}:{{ .Values.elasticsearch.image.tag }}"
+          env:
+            - name: ES_JAVA_OPTS
+              value: {{ .Values.elasticsearch.javaOpts | quote }}
+            - name: ELASTIC_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-es-secret
+                  key: username
+            - name: ELASTIC_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-es-secret
+                  key: password
+          command:
+            - /bin/bash
+            - -c
+            - |
+              /opt/bitnami/scripts/elasticsearch/setup.sh
+              chown -R elasticsearch:elasticsearch /bitnami/elasticsearch/data
+              chmod g+s /bitnami/elasticsearch/data
+              exec /opt/bitnami/scripts/elasticsearch/entrypoint.sh /opt/bitnami/scripts/elasticsearch/run.sh
+          ports:
+            - containerPort: {{ .Values.elasticsearch.service.port }}
+          volumeMounts:
+            - name: es-data
+              mountPath: /bitnami/elasticsearch/data
+            - name: es-plugins
+              mountPath: /opt/bitnami/elasticsearch/plugins
+      volumes:
+      - name: es-plugins
+        emptyDir: {}
+      - name: es-config
+        configMap:
+          name: {{ include "opencoze.fullname" . }}-es-init-config
+  volumeClaimTemplates:
+  - metadata:
+      name: es-data
+    spec:
+      accessModes: [ "ReadWriteOnce" ]
+      storageClassName: {{ .Values.elasticsearch.persistence.storageClassName | quote }}
+      resources:
+        requests:
+          storage: {{ .Values.elasticsearch.persistence.size | quote }}
+{{- end }}
--- a/helm/charts/opencoze/templates/etcd-service.yaml
+++ b/helm/charts/opencoze/templates/etcd-service.yaml
@@ -0,0 +1,20 @@
+{{- if .Values.etcd.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "opencoze.fullname" . }}-etcd
+  labels:
+    {{- include "opencoze.labels" . | nindent 4 }}
+spec:
+  ports:
+    - name: client
+      port: 2379
+      targetPort: 2379
+    - name: peer
+      port: 2380
+      targetPort: 2380
+  selector:
+    app.kubernetes.io/component: etcd
+    app.kubernetes.io/name: {{ include "opencoze.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
--- a/helm/charts/opencoze/templates/etcd-statefulset.yaml
+++ b/helm/charts/opencoze/templates/etcd-statefulset.yaml
@@ -0,0 +1,60 @@
+{{- if .Values.etcd.enabled }}
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ include "opencoze.fullname" . }}-etcd
+  labels:
+    {{- include "opencoze.labels" . | nindent 4 }}
+spec:
+  serviceName: {{ .Release.Name }}-etcd
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: etcd
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      app.kubernetes.io/name: {{ include "opencoze.name" . }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: etcd
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        app.kubernetes.io/name: {{ include "opencoze.name" . }}
+    spec:
+      containers:
+        - name: etcd
+          securityContext:
+            runAsUser: 0
+          image: "{{ .Values.etcd.image.repository }}:{{ .Values.etcd.image.tag }}"
+          env:
+            - name: ALLOW_NONE_AUTHENTICATION
+              value: "yes"
+            - name: ETCD_AUTO_COMPACTION_MODE
+              value: "revision"
+            - name: ETCD_AUTO_COMPACTION_RETENTION
+              value: "1000"
+            - name: ETCD_QUOTA_BACKEND_BYTES
+              value: "4294967296"
+          command:
+            - /bin/bash
+            - -c
+            - |
+              /opt/bitnami/scripts/etcd/setup.sh
+              chown -R etcd:etcd /bitnami/etcd
+              chmod g+s /bitnami/etcd
+              exec /opt/bitnami/scripts/etcd/entrypoint.sh /opt/bitnami/scripts/etcd/run.sh
+          ports:
+            - containerPort: 2379
+            - containerPort: 2380
+          volumeMounts:
+          - name: etcd-data
+            mountPath: /bitnami/etcd
+  volumeClaimTemplates:
+    - metadata:
+        name: etcd-data
+      spec:
+        accessModes: [ "ReadWriteOnce" ]
+        storageClassName: {{ .Values.etcd.persistence.storageClassName | quote }}
+        resources:
+          requests:
+            storage: {{ .Values.etcd.persistence.size | quote }}
+{{- end }}
--- a/helm/charts/opencoze/templates/kibana-deployment.yaml
+++ b/helm/charts/opencoze/templates/kibana-deployment.yaml
@@ -0,0 +1,101 @@
+{{- if .Values.kibana.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "opencoze.fullname" . }}-kibana
+  labels:
+    {{- include "opencoze.labels" . | nindent 4 }}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: kibana
+      app.kubernetes.io/name: {{ include "opencoze.name" . }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: kibana
+        app.kubernetes.io/name: {{ include "opencoze.name" . }}
+        app.kubernetes.io/instance: {{ .Release.Name }}
+    spec:
+      securityContext:
+        runAsUser: 0
+        fsGroup: 1001
+      initContainers:
+      - name: wait-for-elasticsearch
+        image: {{ .Values.images.curl }}
+        env:
+        - name: ES_HOST
+          value: '{{ include "opencoze.fullname" . }}-elasticsearch'
+        - name: ES_PORT
+          value: "9200"
+        - name: ES_USERNAME
+          valueFrom:
+            secretKeyRef:
+              name: {{ .Release.Name }}-es-secret
+              key: username
+        - name: ES_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: {{ .Release.Name }}-es-secret
+              key: password
+        command: ['sh', '-c', 'until curl -s -u "$ES_USERNAME:$ES_PASSWORD" "http://$ES_HOST:$ES_PORT/_cluster/health?wait_for_status=yellow&timeout=1s"; do echo "waiting for elasticsearch"; sleep 2; done;']
+      containers:
+        - name: kibana
+          image: "{{ .Values.kibana.image.repository }}:{{ .Values.kibana.image.tag }}"
+          env:
+          - name: KIBANA_ELASTICSEARCH_URL
+            value: "{{ include "opencoze.fullname" . }}-elasticsearch"
+          command:
+            - /bin/bash
+            - -c
+            - |
+              /opt/bitnami/scripts/kibana/setup.sh
+              chown -R kibana:kibana /bitnami/kibana
+              chmod g+s /bitnami/kibana
+              exec /opt/bitnami/scripts/kibana/entrypoint.sh /opt/bitnami/scripts/kibana/run.sh
+              /opt/bitnami/scripts/kibana/setup.sh
+              chown -R 1001:1001 /bitnami/kibana
+              chmod -R g+s /bitnami/kibana
+              exec /opt/bitnami/scripts/kibana/entrypoint.sh /opt/bitnami/scripts/kibana/run.sh
+          env:
+            - name: KIBANA_ELASTICSEARCH_URL
+              value: '{{ include "opencoze.fullname" . }}-elasticsearch'
+            - name: ELASTICSEARCH_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-es-secret
+                  key: username
+            - name: ELASTICSEARCH_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-es-secret
+                  key: password
+          ports:
+            - name: http
+              containerPort: {{ .Values.kibana.service.port }}
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /api/status
+              port: http
+            initialDelaySeconds: 120
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 6
+          readinessProbe:
+            httpGet:
+              path: /api/status
+              port: http
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 6
+          volumeMounts:
+            - name: kibana-data
+              mountPath: /bitnami/kibana
+      volumes:
+        - name: kibana-data
+          emptyDir: {}
+{{- end }}
--- a/helm/charts/opencoze/templates/kibana-service.yaml
+++ b/helm/charts/opencoze/templates/kibana-service.yaml
@@ -0,0 +1,19 @@
+{{- if .Values.kibana.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "opencoze.fullname" . }}-kibana
+  labels:
+    {{- include "opencoze.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.kibana.service.type }}
+  ports:
+    - port: {{ .Values.kibana.service.port }}
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    app.kubernetes.io/component: kibana
+    app.kubernetes.io/name: {{ include "opencoze.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
--- a/helm/charts/opencoze/templates/milvus-service.yaml
+++ b/helm/charts/opencoze/templates/milvus-service.yaml
@@ -0,0 +1,20 @@
+{{- if .Values.milvus.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "opencoze.fullname" . }}-milvus
+  labels:
+    {{- include "opencoze.labels" . | nindent 4 }}
+spec:
+  ports:
+    - name: milvus
+      port: 19530
+      targetPort: 19530
+    - name: metrics
+      port: 9091
+      targetPort: 9091
+  selector:
+    app.kubernetes.io/component: milvus
+    app.kubernetes.io/name: {{ include "opencoze.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
--- a/helm/charts/opencoze/templates/milvus-statefulset.yaml
+++ b/helm/charts/opencoze/templates/milvus-statefulset.yaml
@@ -0,0 +1,77 @@
+{{- if .Values.milvus.enabled }}
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ include "opencoze.fullname" . }}-milvus
+  labels:
+    {{- include "opencoze.labels" . | nindent 4 }}
+spec:
+  serviceName: {{ .Release.Name }}-milvus
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: milvus
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      app.kubernetes.io/name: {{ include "opencoze.name" . }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: milvus
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        app.kubernetes.io/name: {{ include "opencoze.name" . }}
+    spec:
+      containers:
+        - name: milvus
+          securityContext:
+            runAsUser: 0
+          image: "{{ .Values.milvus.image.repository }}:{{ .Values.milvus.image.tag }}"
+          command: ["milvus", "run", "standalone"]
+          env:
+            - name: ETCD_ENDPOINTS
+              value: "{{ include "opencoze.fullname" . }}-etcd:2379"
+            - name: MINIO_ADDRESS
+              value: "{{ include "opencoze.fullname" . }}-minio:9000"
+            - name: MINIO_BUCKET_NAME
+              value: {{ .Values.milvus.bucketName | quote }}
+            - name: MINIO_ACCESS_KEY_ID
+              value: {{ .Values.minio.accessKey | quote }}
+            - name: MINIO_SECRET_ACCESS_KEY
+              value: {{ .Values.minio.secretKey | quote }}
+            - name: MINIO_USE_SSL
+              value: "false"
+            - name: LOG_LEVEL
+              value: "debug"
+          ports:
+            - containerPort: 19530
+            - containerPort: 9091
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: 9091
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            timeoutSeconds: 5
+            successThreshold: 1
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: 9091
+            initialDelaySeconds: 10
+            periodSeconds: 5
+            timeoutSeconds: 3
+            successThreshold: 1
+            failureThreshold: 3
+          volumeMounts:
+          - name: milvus-data
+            mountPath: /var/lib/milvus
+  volumeClaimTemplates:
+    - metadata:
+        name: milvus-data
+      spec:
+        accessModes: [ "ReadWriteOnce" ]
+        storageClassName: {{ .Values.milvus.persistence.storageClassName | quote }}
+        resources:
+          requests:
+            storage: {{ .Values.milvus.persistence.size | quote }}
+{{- end }}
--- a/helm/charts/opencoze/templates/minio-service.yaml
+++ b/helm/charts/opencoze/templates/minio-service.yaml
@@ -0,0 +1,21 @@
+{{- if .Values.minio.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "opencoze.fullname" . }}-minio
+  labels:
+    {{- include "opencoze.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.minio.service.type }}
+  ports:
+    - name: api
+      port: {{ .Values.minio.service.port }}
+      targetPort: {{ .Values.minio.service.port }}
+    - name: console
+      port: {{ .Values.minio.service.consolePort }}
+      targetPort: {{ .Values.minio.service.consolePort }}
+  selector:
+    app.kubernetes.io/component: minio
+    app.kubernetes.io/name: {{ include "opencoze.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
--- a/helm/charts/opencoze/templates/minio-statefulset.yaml
+++ b/helm/charts/opencoze/templates/minio-statefulset.yaml
@@ -0,0 +1,65 @@
+{{- if .Values.minio.enabled }}
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ include "opencoze.fullname" . }}-minio
+  labels:
+    {{- include "opencoze.labels" . | nindent 4 }}
+spec:
+  serviceName: {{ .Release.Name }}-minio
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: minio
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      app.kubernetes.io/name: {{ include "opencoze.name" . }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: minio
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        app.kubernetes.io/name: {{ include "opencoze.name" . }}
+    spec:
+      containers:
+        - name: minio
+          image: "{{ .Values.minio.image.repository }}:{{ .Values.minio.image.tag }}"
+          args:
+            - server
+            - /data
+            - --console-address
+            - ":{{ .Values.minio.service.consolePort }}"
+          env:
+            - name: MINIO_ROOT_USER
+              value: {{ .Values.minio.accessKey | quote }}
+            - name: MINIO_ROOT_PASSWORD
+              value: {{ .Values.minio.secretKey | quote }}
+            - name: MINIO_DEFAULT_BUCKETS
+              value: "{{ .Values.minio.bucket }},{{ .Values.milvus.bucketName }}"
+          ports:
+            - containerPort: {{ .Values.minio.service.port }}
+            - containerPort: {{ .Values.minio.service.consolePort }}
+          volumeMounts:
+            - name: minio-data
+              mountPath: /data
+          livenessProbe:
+            httpGet:
+              path: /minio/health/live
+              port: {{ .Values.minio.service.port }}
+            initialDelaySeconds: 30
+            periodSeconds: 15
+          readinessProbe:
+            httpGet:
+              path: /minio/health/ready
+              port: {{ .Values.minio.service.port }}
+            initialDelaySeconds: 20
+            periodSeconds: 10
+  volumeClaimTemplates:
+    - metadata:
+        name: minio-data
+      spec:
+        accessModes: [ "ReadWriteOnce" ]
+        storageClassName: {{ .Values.minio.persistence.storageClassName | quote }}
+        resources:
+          requests:
+            storage: {{ .Values.minio.persistence.size | quote }}
+{{- end }}
--- a/helm/charts/opencoze/templates/mysql-init-configmap.yaml
+++ b/helm/charts/opencoze/templates/mysql-init-configmap.yaml
@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "opencoze.fullname" . }}-mysql-init
+data:
+{{ (.Files.Glob "files/mysql/*.sql").AsConfig | indent 2 }}
--- a/helm/charts/opencoze/templates/mysql-init-job.yaml
+++ b/helm/charts/opencoze/templates/mysql-init-job.yaml
@@ -0,0 +1,53 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ include "opencoze.fullname" . }}-mysql-init
+  annotations:
+    "helm.sh/hook": post-install,post-upgrade
+    "helm.sh/hook-weight": "-10"
+    "helm.sh/hook-after-create": "true"
+spec:
+  template:
+    spec:
+      initContainers:
+      - name: wait-for-mysql
+        image: {{ .Values.images.busybox }}
+        command: ['sh', '-c', 'until nc -z {{ .Release.Name }}-mysql 3306; do echo waiting for mysql; sleep 2; done']
+      - name: sql-init
+        image: "{{ .Values.mysql.image.repository }}:{{ .Values.mysql.image.tag }}"
+        command:
+        - "/bin/sh"
+        - "-c"
+        - |
+          mysql -h {{ .Release.Name }}-mysql -u root -p"{{ .Values.mysql.rootPassword }}" -e "CREATE USER IF NOT EXISTS '{{ .Values.mysql.user }}'@'%' IDENTIFIED BY '{{ .Values.mysql.password }}';GRANT ALL PRIVILEGES ON {{ .Values.mysql.database }}.* TO '{{ .Values.mysql.user }}'@'%';FLUSH PRIVILEGES;"
+          mysql -h {{ .Release.Name }}-mysql -u {{ .Values.mysql.user }} -p"{{ .Values.mysql.password }}" {{ .Values.mysql.database }} < /sql/schema.sql
+          mysql -h {{ .Release.Name }}-mysql -u {{ .Values.mysql.user }} -p"{{ .Values.mysql.password }}" {{ .Values.mysql.database }} < /sql/sql_init.sql
+        volumeMounts:
+        - name: init-sql
+          mountPath: /sql/sql_init.sql
+          subPath: sql_init.sql
+        - name: schema-sql
+          mountPath: /sql/schema.sql
+          subPath: schema.sql
+        env:
+        - name: MYSQL_PASSWORD
+          value: {{ .Values.mysql.password | quote }}
+      containers:
+      - name: job-completer
+        image: {{ .Values.images.busybox }}
+        command: ["echo", "MySQL initialization complete"]
+      volumes:
+      - name: init-sql
+        configMap:
+          name: {{ include "opencoze.fullname" . }}-mysql-init
+          items:
+            - key: sql_init.sql
+              path: sql_init.sql
+      - name: schema-sql
+        configMap:
+          name: {{ include "opencoze.fullname" . }}-mysql-init
+          items:
+            - key: schema.sql
+              path: schema.sql
+      restartPolicy: Never
+  backoffLimit: 5
--- a/helm/charts/opencoze/templates/mysql-service.yaml
+++ b/helm/charts/opencoze/templates/mysql-service.yaml
@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "opencoze.fullname" . }}-mysql
+  labels:
+    {{- include "opencoze.labels" . | nindent 4 }}
+spec:
+  type: ClusterIP
+  ports:
+    - port: {{ .Values.mysql.port }}
+      targetPort: {{ .Values.mysql.targetPort }}
+      name: mysql
+  selector:
+    app.kubernetes.io/component: mysql
+    app.kubernetes.io/name: {{ include "opencoze.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
--- a/helm/charts/opencoze/templates/mysql-statefulset.yaml
+++ b/helm/charts/opencoze/templates/mysql-statefulset.yaml
@@ -0,0 +1,69 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "opencoze.fullname" . }}-mysql
+stringData:
+  mysql-password: {{ .Values.mysql.password | quote }}
+  mysql-root-password: {{ .Values.mysql.rootPassword | quote }}
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ include "opencoze.fullname" . }}-mysql
+  labels:
+    {{- include "opencoze.labels" . | nindent 4 }}
+spec:
+  serviceName: {{ .Release.Name }}-mysql
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: mysql
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      app.kubernetes.io/name: {{ include "opencoze.name" . }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: mysql
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        app.kubernetes.io/name: {{ include "opencoze.name" . }}
+    spec:
+      containers:
+        - name: mysql
+          image: "{{ .Values.mysql.image.repository }}:{{ .Values.mysql.image.tag }}"
+          env:
+            - name: MYSQL_ROOT_PASSWORD
+              value: {{ .Values.mysql.rootPassword | quote }}
+            - name: MYSQL_DATABASE
+              value: {{ .Values.mysql.database | quote }}
+            - name: MYSQL_USER
+              value: {{ .Values.mysql.user | quote }}
+            - name: MYSQL_PASSWORD
+              value: {{ .Values.mysql.password | quote }}
+          ports:
+            - containerPort: 3306
+          args:
+            - "--character-set-server=utf8mb4"
+            - "--collation-server=utf8mb4_unicode_ci"
+          readinessProbe:
+            exec:
+              command:
+              - mysqladmin
+              - ping
+              - -uroot
+              - -p{{ .Values.mysql.rootPassword }}
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            timeoutSeconds: 5
+          volumeMounts:
+          - name: mysql-data
+            mountPath: /var/lib/mysql
+
+  volumeClaimTemplates:
+    - metadata:
+        name: mysql-data
+      spec:
+        accessModes: [ "ReadWriteOnce" ]
+        storageClassName: {{ .Values.mysql.persistence.storageClassName | quote }}
+        resources:
+          requests:
+            storage: {{ .Values.mysql.persistence.size | quote }}
--- a/helm/charts/opencoze/templates/redis-service.yaml
+++ b/helm/charts/opencoze/templates/redis-service.yaml
@@ -0,0 +1,17 @@
+{{- if .Values.redis.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "opencoze.fullname" . }}-redis
+  labels:
+    {{- include "opencoze.labels" . | nindent 4 }}
+spec:
+  ports:
+    - port: {{ .Values.redis.port }}
+      targetPort: {{ .Values.redis.port }}
+      protocol: TCP
+  selector:
+    app.kubernetes.io/component: redis
+    app.kubernetes.io/name: {{ include "opencoze.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
--- a/helm/charts/opencoze/templates/redis-statefulset.yaml
+++ b/helm/charts/opencoze/templates/redis-statefulset.yaml
@@ -0,0 +1,49 @@
+{{- if .Values.redis.enabled }}
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ include "opencoze.fullname" . }}-redis
+  labels:
+    {{- include "opencoze.labels" . | nindent 4 }}
+spec:
+  serviceName: {{ .Release.Name }}-redis
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: redis
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      app.kubernetes.io/name: {{ include "opencoze.name" . }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: redis
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        app.kubernetes.io/name: {{ include "opencoze.name" . }}
+    spec:
+      containers:
+        - name: redis
+          image: "{{ .Values.redis.image.repository }}:{{ .Values.redis.image.tag }}"
+          env:
+            - name: REDIS_AOF_ENABLED
+              value: {{ .Values.redis.aofEnabled | quote }}
+            - name: REDIS_PORT_NUMBER
+              value: {{ .Values.redis.port | quote }}
+            - name: REDIS_IO_THREADS
+              value: {{ .Values.redis.ioThreads | quote }}
+            - name: ALLOW_EMPTY_PASSWORD
+              value: {{ .Values.redis.allowEmptyPassword | quote }}
+          ports:
+            - containerPort: {{ .Values.redis.port }}
+          volumeMounts:
+          - name: redis-data
+            mountPath: /bitnami/redis/data
+  volumeClaimTemplates:
+    - metadata:
+        name: redis-data
+      spec:
+        accessModes: [ "ReadWriteOnce" ]
+        storageClassName: {{ .Values.redis.persistence.storageClassName | quote }}
+        resources:
+          requests:
+            storage: {{ .Values.redis.persistence.size | quote }}
+{{- end }}
--- a/helm/charts/opencoze/templates/rocketmq-broker-configmap.yaml
+++ b/helm/charts/opencoze/templates/rocketmq-broker-configmap.yaml
@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "opencoze.fullname" . }}-broker-config
+  labels:
+    {{- include "opencoze.labels" . | nindent 4 }}
+data:
+  broker.conf: |-
+    brokerClusterName = DefaultCluster
+    brokerName = broker-a
+    brokerId = 0
+    deleteWhen = 04
+    fileReservedTime = 48
+    brokerRole = ASYNC_MASTER
+    flushDiskType = ASYNC_FLUSH
+    brokerIP1 = __POD_IP__
--- a/helm/charts/opencoze/templates/rocketmq-broker-service.yaml
+++ b/helm/charts/opencoze/templates/rocketmq-broker-service.yaml
@@ -0,0 +1,23 @@
+{{- if .Values.rocketmq.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "opencoze.fullname" . }}-rocketmq-broker
+  labels:
+    {{- include "opencoze.labels" . | nindent 4 }}
+spec:
+  ports:
+    - port: 10909
+      targetPort: 10909
+      name: broker-a
+    - port: 10911
+      targetPort: 10911
+      name: broker-b
+    - port: 10912
+      targetPort: 10912
+      name: broker-c
+  selector:
+    app.kubernetes.io/component: rocketmq-broker
+    app.kubernetes.io/name: {{ include "opencoze.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
--- a/helm/charts/opencoze/templates/rocketmq-broker-statefulset.yaml
+++ b/helm/charts/opencoze/templates/rocketmq-broker-statefulset.yaml
@@ -0,0 +1,126 @@
+{{- if .Values.rocketmq.enabled }}
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ include "opencoze.fullname" . }}-rocketmq-broker
+  labels:
+    {{- include "opencoze.labels" . | nindent 4 }}
+spec:
+  serviceName: {{ .Release.Name }}-rocketmq-broker
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: rocketmq-broker
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      app.kubernetes.io/name: {{ include "opencoze.name" . }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: rocketmq-broker
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        app.kubernetes.io/name: {{ include "opencoze.name" . }}
+    spec:
+      initContainers:
+        - name: wait-for-namesrv
+          image: opencoze-cn-beijing.cr.volces.com/iac/busybox:latest
+          command: ['sh', '-c', 'until nc -z {{ .Release.Name }}-rocketmq-namesrv 9876; do echo waiting for namesrv; sleep 2; done']
+      volumes:
+        - name: broker-config
+          configMap:
+            name: {{ include "opencoze.fullname" . }}-broker-config
+      containers:
+        - name: broker
+          image: "{{ .Values.rocketmq.broker.image.repository }}:{{ .Values.rocketmq.broker.image.tag }}"
+          env:
+            - name: NAMESRV_ADDR
+              value: "{{ include "opencoze.fullname" . }}-rocketmq-namesrv:9876"
+            - name: POD_IP
+              valueFrom:
+                fieldRef:
+                  fieldPath: status.podIP
+          command:
+            - /bin/bash
+            - -c
+            - |
+              set -ex
+              mkdir -p /home/rocketmq/logs/rocketmqlogs /home/rocketmq/store
+              touch /home/rocketmq/logs/rocketmqlogs/tools.log \
+                    /home/rocketmq/logs/rocketmqlogs/tools_default.log
+              chown -R rocketmq:rocketmq /home/rocketmq/logs /home/rocketmq/store
+              chmod g+s /home/rocketmq/logs /home/rocketmq/store
+
+              echo "Starting RocketMQ Broker..."
+              cp /home/rocketmq/conf/broker.conf /tmp/broker.conf
+              sed -i "s/__POD_IP__/$POD_IP/g" /tmp/broker.conf
+              echo "broker.conf content after sed:"
+              cat /tmp/broker.conf
+              /home/rocketmq/rocketmq-5.3.2/bin/mqbroker -c /tmp/broker.conf &
+              broker_ready=false
+              for i in {1..60}; do
+                if /home/rocketmq/rocketmq-5.3.2/bin/mqadmin clusterList -n $NAMESRV_ADDR | grep -q "DefaultCluster.*broker-a"; then
+                  echo "Registered."
+                  broker_ready=true
+                  break
+                fi
+                echo "Not ready, retry $i/60..."
+                sleep 1
+              done
+              if [ "$broker_ready" = false ]; then
+                echo "ERROR: registration timed out."
+                exit 1
+              fi
+
+              touch /tmp/rocketmq_ready
+              echo "Broker started successfully."
+
+              echo "Creating topics..."
+              {{- range .Values.rocketmq.topics }}
+              /home/rocketmq/rocketmq-5.3.2/bin/mqadmin updateTopic -n $NAMESRV_ADDR -c DefaultCluster -t "{{ . }}"
+              {{- end }}
+
+              echo "Creating consumer groups..."
+              {{- range .Values.rocketmq.consumerGroups }}
+              /home/rocketmq/rocketmq-5.3.2/bin/mqadmin updateSubGroup -n $NAMESRV_ADDR -c DefaultCluster -g "{{ . }}"
+              {{- end }}
+
+              wait
+          readinessProbe:
+            exec:
+              command:
+                - sh
+                - -c
+                - "[ -f /tmp/rocketmq_ready ]"
+            initialDelaySeconds: 30
+            periodSeconds: 10
+          securityContext:
+            privileged: true
+            runAsUser: 0
+          ports:
+            - containerPort: 10909
+            - containerPort: 10911
+          volumeMounts:
+            - name: broker-store
+              mountPath: /home/rocketmq/store
+            - name: broker-logs
+              mountPath: /home/rocketmq/logs
+            - name: broker-config
+              mountPath: /home/rocketmq/conf/broker.conf
+              subPath: broker.conf
+  volumeClaimTemplates:
+    - metadata:
+        name: broker-store
+      spec:
+        accessModes: [ "ReadWriteOnce" ]
+        storageClassName: {{ .Values.rocketmq.broker.persistence.store.storageClassName | quote }}
+        resources:
+          requests:
+            storage: {{ .Values.rocketmq.broker.persistence.store.size | quote }}
+    - metadata:
+        name: broker-logs
+      spec:
+        accessModes: [ "ReadWriteOnce" ]
+        storageClassName: {{ .Values.rocketmq.broker.persistence.logs.storageClassName | quote }}
+        resources:
+          requests:
+            storage: {{ .Values.rocketmq.broker.persistence.logs.size | quote }}
+{{- end }}
--- a/helm/charts/opencoze/templates/rocketmq-namesrv-service.yaml
+++ b/helm/charts/opencoze/templates/rocketmq-namesrv-service.yaml
@@ -0,0 +1,17 @@
+{{- if .Values.rocketmq.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "opencoze.fullname" . }}-rocketmq-namesrv
+  labels:
+    {{- include "opencoze.labels" . | nindent 4 }}
+spec:
+  clusterIP: None
+  ports:
+    - port: 9876
+      name: namesrv
+  selector:
+    app.kubernetes.io/component: rocketmq-namesrv
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/name: {{ include "opencoze.name" . }}
+{{- end }}
--- a/helm/charts/opencoze/templates/rocketmq-namesrv-statefulset.yaml
+++ b/helm/charts/opencoze/templates/rocketmq-namesrv-statefulset.yaml
@@ -0,0 +1,71 @@
+{{- if .Values.rocketmq.enabled }}
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ include "opencoze.fullname" . }}-rocketmq-namesrv
+  labels:
+    {{- include "opencoze.labels" . | nindent 4 }}
+spec:
+  serviceName: {{ .Release.Name }}-rocketmq-namesrv
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: rocketmq-namesrv
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      app.kubernetes.io/name: {{ include "opencoze.name" . }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: rocketmq-namesrv
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        app.kubernetes.io/name: {{ include "opencoze.name" . }}
+    spec:
+      containers:
+        - name: namesrv
+          securityContext:
+            runAsUser: 0
+          image: "{{ .Values.rocketmq.namesrv.image.repository }}:{{ .Values.rocketmq.namesrv.image.tag }}"
+          command:
+            - /bin/bash
+            - -c
+            - |
+              set -ex
+              export PATH=$PATH:/home/rocketmq/rocketmq-5.3.2/bin
+              mkdir -p /home/rocketmq/logs /home/rocketmq/store
+              chown -R rocketmq:rocketmq /home/rocketmq/logs /home/rocketmq/store
+              exec sh mqnamesrv
+
+          ports:
+            - containerPort: 9876
+          readinessProbe:
+            exec:
+              command:
+                - sh
+                - -c
+                - "/home/rocketmq/rocketmq-5.3.2/bin/mqadmin clusterList -n localhost:9876"
+            initialDelaySeconds: 20
+            periodSeconds: 10
+            timeoutSeconds: 5
+          volumeMounts:
+            - name: namesrv-store
+              mountPath: /home/rocketmq/store
+            - name: namesrv-logs
+              mountPath: /home/rocketmq/logs
+  volumeClaimTemplates:
+    - metadata:
+        name: namesrv-store
+      spec:
+        accessModes: [ "ReadWriteOnce" ]
+        storageClassName: {{ .Values.rocketmq.namesrv.persistence.store.storageClassName | quote }}
+        resources:
+          requests:
+            storage: {{ .Values.rocketmq.namesrv.persistence.store.size | quote }}
+    - metadata:
+        name: namesrv-logs
+      spec:
+        accessModes: [ "ReadWriteOnce" ]
+        storageClassName: {{ .Values.rocketmq.namesrv.persistence.logs.storageClassName | quote }}
+        resources:
+          requests:
+            storage: {{ .Values.rocketmq.namesrv.persistence.logs.size | quote }}
+{{- end }}
--- a/helm/charts/opencoze/templates/service.yaml
+++ b/helm/charts/opencoze/templates/service.yaml
@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ printf "%s-server" (include "opencoze.fullname" .) }}
+  labels:
+    {{- include "opencoze.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.cozeServer.service.type }}
+  ports:
+    - port: {{ .Values.cozeServer.service.port }}
+      targetPort: http
+      protocol: TCP
+      name: app-port
+  selector:
+    app.kubernetes.io/name: {{ include "opencoze.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: server
--- a/helm/charts/opencoze/templates/validate-config.yaml
+++ b/helm/charts/opencoze/templates/validate-config.yaml
@@ -0,0 +1,9 @@
+{{- if not .Values.mysql.rootPassword -}}
+{{- fail "mysql.rootPassword is required" -}}
+{{- end -}}
+{{- if not .Values.minio.accessKey -}}
+{{- fail "minio.accessKey is required" -}}
+{{- end -}}
+{{- if not .Values.minio.secretKey -}}
+{{- fail "minio.secretKey is required" -}}
+{{- end -}}