Angelin01 · Aug 27, 2026 · Aug 21, 2026 · Aug 26, 2026 · Aug 26, 2026 · Aug 26, 2026
@@ -0,0 +1,4 @@
+*
+!chart
+!schema.yaml
+!data-test
@@ -0,0 +1,2 @@
+chart/*/charts/
+chart/*/Chart.lock
@@ -0,0 +1,38 @@
+ARG MARKETPLACE_TOOLS_TAG=latest
+
+FROM alpine:3 AS build
+
+RUN apk add --no-cache yq tar gettext
+
+WORKDIR /work
+COPY chart/ccv-cell-mp ./chart
+COPY schema.yaml ./schema.yaml
+COPY data-test ./data-test
+
+ARG REGISTRY
+ARG TAG
+
+# Application descriptor version must equal schema publishedVersion (the tag).
+RUN sed -i "s/^appVersion:.*/appVersion: \"${TAG}\"/" chart/Chart.yaml
+
+# Production chart tarball (mirrors what the helm onbuild base would have produced).
+RUN tar -czf /chart.tar.gz chart
+
+# Verify chart: deep-merge overlay values into the chart's values, add overlay templates, re-tar.
+RUN mkdir -p /work/test \
+    && cp -r chart /work/test/chart \
+    && yq eval-all 'select(fi==0) * select(fi==1)' \
+         chart/values.yaml data-test/chart-overlay/values.yaml > /work/test/chart/values.yaml \
+    && cp data-test/chart-overlay/templates/* /work/test/chart/templates/ \
+    && tar -czf /chart-test.tar.gz -C /work/test chart
+
+# publishedVersion in both schemas is envsubst'd from $TAG (matches the helm onbuild behavior).
+RUN env -i "REGISTRY=${REGISTRY}" "TAG=${TAG}" envsubst < schema.yaml > /schema.yaml \
+    && env -i "REGISTRY=${REGISTRY}" "TAG=${TAG}" envsubst < data-test/schema.yaml > /schema-test.yaml
+
+FROM gcr.io/cloud-marketplace-tools/k8s/deployer_helm:$MARKETPLACE_TOOLS_TAG
+
+COPY --from=build /chart.tar.gz /data/chart/chart.tar.gz
+COPY --from=build /schema.yaml /data/schema.yaml
+COPY --from=build /chart-test.tar.gz /data-test/chart/chart.tar.gz
+COPY --from=build /schema-test.yaml /data-test/schema.yaml
@@ -0,0 +1,10 @@
+apiVersion: v2
+name: ccv-cell-mp
+description: GCP Marketplace wrapper around the ccv-cell chart
+type: application
+version: 0.0.0
+appVersion: "0.0.0"
+dependencies:
+  - name: ccv-cell
+    version: "*"
+    repository: file://../../../../charts/ccv-cell
@@ -0,0 +1,31 @@
+apiVersion: app.k8s.io/v1beta1
+kind: Application
+metadata:
+  name: "{{ .Release.Name }}"
+  namespace: "{{ .Release.Namespace }}"
+  labels:
+    app.kubernetes.io/name: "{{ .Release.Name }}"
+  annotations:
+    # PLACEHOLDER: partner_id/product_id must match the Marketplace listing IDs.
+    marketplace.cloud.google.com/deploy-info: '{"partner_id": "chainlink", "product_id": "ccv-cell", "partner_name": "Chainlink"}'
+spec:
+  descriptor:
+    type: CCV Cell
+    version: "{{ .Chart.AppVersion }}"
+    description: >-
+      A Chainlink CCV Cell: a committee verifier and its aggregator.
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: "{{ .Release.Name }}"
+  addOwnerRef: true
+  componentKinds:
+    - group: v1
+      kind: ConfigMap
+    - group: v1
+      kind: Service
+    - group: apps/v1
+      kind: StatefulSet
+    - group: gateway.networking.k8s.io
+      kind: GRPCRoute
+    - group: secrets-store.csi.x-k8s.io
+      kind: SecretProviderClass
@@ -0,0 +1,27 @@
+{{- if .Values.grpcRoute.enabled }}
+{{- $sub := index .Subcharts "ccv-cell" }}
+{{- $agg := $sub.Values.aggregator }}
+apiVersion: gateway.networking.k8s.io/v1
+kind: GRPCRoute
+metadata:
+  name: {{ include "ccv-cell.aggregator.fullname" $sub }}
+  labels:
+    {{- include "ccv-cell.aggregator.labels" $sub | nindent 4 }}
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: {{ required "grpcRoute.parentRefName is required" .Values.grpcRoute.parentRefName }}
+      {{- with .Values.grpcRoute.parentRefNamespace }}
+      namespace: {{ . }}
+      {{- end }}
+      {{- with .Values.grpcRoute.parentRefSectionName }}
+      sectionName: {{ . }}
+      {{- end }}
+  hostnames:
+    - {{ required "grpcRoute.hostname is required" .Values.grpcRoute.hostname | quote }}
+  rules:
+    - backendRefs:
+        - name: {{ include "ccv-cell.aggregator.fullname" $sub }}
+          port: {{ $agg.service.ports.grpc }}
+{{- end }}
@@ -0,0 +1,30 @@
+grpcRoute:
+  enabled: true
+  hostname: ""
+  parentRefName: ""
+  parentRefNamespace: ""
+  parentRefSectionName: ""
+
+ccv-cell:
+  aggregator:
+    image:
+      # Marketplace parameterizes repository/tag, and the chart rejects tag and digest together.
+      digest: ""
+    # Marketplace forbids charts from creating service accounts, it creates them and passes the name.
+    serviceAccount:
+      create: false
+    secrets:
+      app:
+        type: gcpSecretStore
+
+  verifier:
+    image:
+      digest: ""
+    serviceAccount:
+      create: false
+    secrets:
+      app:
+        type: gcpSecretStore
+      bootstrap:
+        type: gcpSecretStore
+        keystoreBackend: kms
@@ -0,0 +1,7 @@
+{{- define "ccv-cell-mp.image" -}}
+{{- if .registry -}}
+{{ .registry }}/{{ .repository }}:{{ .tag }}
+{{- else -}}
+{{ .repository }}:{{ .tag }}
+{{- end -}}
+{{- end -}}
@@ -0,0 +1,67 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: verify-postgres-init
+data:
+  init.sql: |
+    CREATE DATABASE aggregator;
+    CREATE DATABASE verifier;
+    CREATE DATABASE bootstrap;
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: verify-postgres
+  labels:
+    app.kubernetes.io/name: verify-postgres
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: verify-postgres
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: verify-postgres
+    spec:
+      containers:
+        - name: postgres
+          image: {{ include "ccv-cell-mp.image" .Values.verify.postgres.image | quote }}
+          env:
+            - name: POSTGRES_USER
+              value: ccv
+            - name: POSTGRES_PASSWORD
+              value: ccv
+            - name: PGDATA
+              value: /var/lib/postgresql/data/pgdata
+          ports:
+            - containerPort: 5432
+          volumeMounts:
+            - name: initdb
+              mountPath: /docker-entrypoint-initdb.d
+            - name: data
+              mountPath: /var/lib/postgresql/data
+          readinessProbe:
+            exec:
+              command: ["pg_isready", "-U", "ccv"]
+            initialDelaySeconds: 5
+            periodSeconds: 5
+      volumes:
+        - name: initdb
+          configMap:
+            name: verify-postgres-init
+        - name: data
+          emptyDir: {}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: verify-postgres
+  labels:
+    app.kubernetes.io/name: verify-postgres
+spec:
+  selector:
+    app.kubernetes.io/name: verify-postgres
+  ports:
+    - port: 5432
+      targetPort: 5432
@@ -0,0 +1,59 @@
+{{- $apiKey := "00000000-0000-4000-8000-000000000001" }}
+{{- $secretKey := "0000000000000000000000000000000000000000000000000000000000000001" }}
+{{- $pgUser := "ccv" }}
+{{- $pgPass := "ccv" }}
+{{- $pgHost := "verify-postgres:5432" }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: verify-aggregator-app
+type: Opaque
+stringData:
+  secrets.toml: |
+    [storage]
+    url = "postgres://{{ $pgUser }}:{{ $pgPass }}@{{ $pgHost }}/aggregator?sslmode=disable"
+
+    [[clients]]
+    client_id = "committee-verifier-1"
+    api_key = "{{ $apiKey }}"
+    secret_key = "{{ $secretKey }}"
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: verify-verifier-app
+type: Opaque
+stringData:
+  secrets.toml: |
+    [db]
+    url = "postgres://{{ $pgUser }}:{{ $pgPass }}@{{ $pgHost }}/verifier?sslmode=disable"
+
+    [[aggregators]]
+    secret_name = "aggregator_1"
+    api_key = "{{ $apiKey }}"
+    secret_key = "{{ $secretKey }}"
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: verify-verifier-bootstrap
+type: Opaque
+stringData:
+  secrets.toml: |
+    [db]
+    url = "postgres://{{ $pgUser }}:{{ $pgPass }}@{{ $pgHost }}/bootstrap?sslmode=disable"
+
+    [keystore]
+    backend = "postgres"
+    password = "keystore-password"
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: verify-verifier-key-import
+type: Opaque
+stringData:
+  key.json: |
+    {"chainType":"evm","onchainPublicKey":"072cdf41f8814e23a3856591645b639f9c71de83","crypto":{"cipher":"aes-128-ctr","ciphertext":"375f050af72d8b14cf5fd90b03ebfd3989b1b79201d7009bf263db8fb0adfcebfcb327cce00e025d42ce51413e20d4e138a575396b33004d938a4457000513b1f3db6e68f56c5892b03552dac1ad934446d26ea94c226604857d1139a85e5073200c027c15f216884ff018b013f1c0da240881fa85a75f67d52d7108ddab19ca23e39756079b813e87d2567f2b72aab5da256b0decd4063b20f29fc8675bbbe150b6370d63560d8ccac13d964387eebe75a18333fd0ddf9c07b4d1c239aa5fc4a43729c0559a0eda18f29b4f8e4dedbc618e67e3ba9bcb211066493e1693bf4582158850c2cc518627e138af5b","cipherparams":{"iv":"e5a909d2e11de3ea49b5473f31ff3073"},"kdf":"scrypt","kdfparams":{"dklen":32,"n":16384,"p":1,"r":8,"salt":"d4dace3b4401df431d04fe12a71ddef0e2426bf1fd9034fca02daa7843de97ba"},"mac":"2b92ff3c054909046826443b515f9402966d7a273f72ad60ebe61f9faacfcef3"}}
+  export-password.txt: >-
+    export-password
@@ -0,0 +1,29 @@
+{{- $sub := index .Subcharts "ccv-cell" }}
+{{- $agg := include "ccv-cell.aggregator.fullname" $sub }}
+{{- $ver := printf "%s-headless" (include "ccv-cell.verifier.fullname" $sub) }}
+apiVersion: v1
+kind: Pod
+metadata:
+  name: {{ .Release.Name }}-tester
+  annotations:
+    "helm.sh/hook": test-success
+spec:
+  restartPolicy: Never
+  containers:
+    - name: tester
+      image: {{ include "ccv-cell-mp.image" .Values.verify.curl.image | quote }}
+      command:
+        - sh
+        - -c
+        - |
+          set -e
+          agg="http://{{ $agg }}:{{ $sub.Values.aggregator.service.ports.health }}/health/ready"
+          ver="http://{{ $ver }}:8100/health"
+          deadline=$(( $(date +%s) + 300 ))
+          for url in "$agg" "$ver"; do
+            until curl -m1 -fsS -o /dev/null "$url"; do
+              [ "$(date +%s)" -ge "$deadline" ] && echo "timed out waiting for $url" && exit 1
+              echo "waiting for $url"; sleep 5
+            done
+            echo "ok: $url"
+          done