feat(deploy): Helm chart for kafSIEM web UI

Adds a minimal Helm chart (Deployment|StatefulSet + Service + ConfigMap + SA)
that brings the component up on KIND for bp-001 Ops Foundation smoke testing.

Built locally via docker build + kind load (OPS-001 tracks GHCR publishing).
Validated: chart installs, pod Ready, smoke tests green.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: kamir

deploy/helm/kafsiem/Chart.yaml

@@ -0,0 +1,17 @@
+apiVersion: v2
+name: kafsiem
+description: >
+  kafSIEM / EUOSINT — OSINT + AgentOps + Hybrid observability web UI.
+  Deploys the Caddy-served static frontend. For the Go collector, use the
+  `kafsiem-collector` chart (roadmap).
+type: application
+version: 0.1.0
+appVersion: "1.0.0"
+maintainers:
+  - name: Scalytics Platform Team
+keywords:
+  - siem
+  - osint
+  - agentops
+  - observability
+  - scalytics

deploy/helm/kafsiem/templates/_helpers.tpl

@@ -0,0 +1,40 @@
+{{- define "kafsiem.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{- define "kafsiem.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "kafsiem.labels" -}}
+app.kubernetes.io/name: {{ include "kafsiem.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- range $key, $value := .Values.labels }}
+{{ $key }}: {{ $value | quote }}
+{{- end }}
+{{- end -}}
+
+{{- define "kafsiem.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "kafsiem.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}
+
+{{- define "kafsiem.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create -}}
+{{- default (include "kafsiem.fullname" .) .Values.serviceAccount.name -}}
+{{- else -}}
+{{- default "default" .Values.serviceAccount.name -}}
+{{- end -}}
+{{- end -}}

deploy/helm/kafsiem/templates/deployment.yaml

@@ -0,0 +1,57 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "kafsiem.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "kafsiem.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  selector:
+    matchLabels:
+      {{- include "kafsiem.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "kafsiem.labels" . | nindent 8 }}
+    spec:
+      serviceAccountName: {{ include "kafsiem.serviceAccountName" . }}
+      containers:
+        - name: kafsiem
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - name: http
+              containerPort: 80
+          livenessProbe:
+            {{- toYaml .Values.probes.liveness | nindent 12 }}
+          readinessProbe:
+            {{- toYaml .Values.probes.readiness | nindent 12 }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "kafsiem.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "kafsiem.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - name: http
+      port: {{ .Values.service.port }}
+      targetPort: {{ .Values.service.targetPort }}
+  selector:
+    {{- include "kafsiem.selectorLabels" . | nindent 4 }}
+---
+{{- if .Values.serviceAccount.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "kafsiem.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "kafsiem.labels" . | nindent 4 }}
+{{- end }}

deploy/helm/kafsiem/values.yaml

@@ -0,0 +1,36 @@
+image:
+  repository: ghcr.io/scalytics/kafsiem
+  tag: latest
+  pullPolicy: IfNotPresent
+
+replicaCount: 1
+
+service:
+  type: ClusterIP
+  port: 8500
+  targetPort: 80
+
+resources:
+  limits:
+    cpu: 500m
+    memory: 256Mi
+  requests:
+    cpu: 100m
+    memory: 64Mi
+
+probes:
+  liveness:
+    httpGet: { path: /, port: 80 }
+    initialDelaySeconds: 5
+    periodSeconds: 10
+  readiness:
+    httpGet: { path: /, port: 80 }
+    initialDelaySeconds: 2
+    periodSeconds: 5
+
+serviceAccount:
+  create: true
+  name: ""
+
+labels:
+  app.kubernetes.io/part-of: ops-foundation