feat: integrate EdgeX Foundry 4.0 (Odessa) by Copilot · Pull Request #7 · perspikapps/edgekit

Copilot · 2026-05-25T21:29:11Z

Integrates EdgeX Foundry 4.0 into EdgeKit with a clear split: edge nodes run a minimal no-security EdgeX platform; the central server hosts the EdgeX Security Services.

Edge node (`docker-compose.edgex-client.yml`)

Minimal all-in-one EdgeX stack, no security:

Core Services: core-keeper, core-common-config-bootstrapper, core-data, core-metadata, core-command
Supporting Services: support-notifications, support-scheduler
Device Services: device-modbus (Modbus TCP/RTU)
Infrastructure: Eclipse Mosquitto (internal message bus), PostgreSQL

./scripts/start-edgex-client.sh
curl http://localhost:59901/api/v3/ping   # device-modbus
curl http://localhost:59880/api/v3/ping   # core-data

Central server (`docker-compose.edgex-server.yml`)

EdgeX Security Services only:

OpenBao (Vault-compatible secret store) — replaces HashiCorp Vault
security-bootstrapper + security-secretstore-setup — staged secure boot
security-proxy-auth — JWT/token validation
nginx — TLS API gateway on :8443

./scripts/start-edgex-server.sh
curl http://localhost:8200/v1/sys/health   # OpenBao

Helm & GitOps

values-client.yaml — disables in-cluster broker; agent connects to central server via ws://edgekit-server.edgekit.svc.cluster.local:9001
values-server.yaml — enables broker as LoadBalancer; disables agent
fleet.yaml — Rancher Fleet targets by label: edgekit/role=central → server profile, edgekit/role=edge → client profile

Docs

docs/edgex.md — full integration guide: service table, local dev, Helm deploy, Fleet labelling, Modbus device registration
docs/architecture.md / README.md updated with revised architecture diagrams

- Add docker-compose.edgex-client.yml: minimal no-security EdgeX stack for edge nodes (Core Services + Supporting Services + device-modbus) - Add docker-compose.edgex-server.yml: EdgeX Security Services (OpenBao, nginx gateway, bootstrapper, proxy-auth) for central server - Add helm/edgekit/values-client.yaml: Helm overrides for edge clusters - Add helm/edgekit/values-server.yaml: Helm overrides for central server - Add fleet.yaml: Rancher Fleet GitOps multi-cluster config - Add scripts: start/stop helpers for both EdgeX stacks - Add docs/edgex.md: full EdgeX integration guide - Update docs/architecture.md and README.md

tomgrv

@copilot there will be 2 edgex clients: a full k3s client and a thin single-container client.

Both of them carry the same function, but thin client is standalone, hardened and not extendable with additional services.

Update accordingly

Introduces a standalone, hardened single-container EdgeX client (edgekit-thin-client) alongside the existing full k3s multi-container client, as requested. Thin client bundles all EdgeX Core Services, Supporting Services, device-modbus, embedded PostgreSQL 16, and Mosquitto MQTT broker into one Alpine-based Docker image managed by supervisord. Key properties: - Standalone: no external service dependencies - Hardened: read-only root FS, no-new-privileges, minimal Alpine base, internal MQTT not published - Fixed service set: not extendable without rebuilding (contrast with full k3s client which uses separate containers and compose overrides) - Same EdgeX API ports as full client (59880/59881/59882/59860/59863/59901) New files: - edgex-thin-client/Dockerfile (multi-stage build) - edgex-thin-client/supervisord.conf - edgex-thin-client/mosquitto.conf - edgex-thin-client/entrypoint.sh - docker-compose.edgex-thin-client.yml - helm/edgekit/values-thin-client.yaml - scripts/start-edgex-thin-client.sh - scripts/stop-edgex-thin-client.sh Updated: - fleet.yaml: add edge-thin target (edgekit/role=edge-thin) - docs/edgex.md: document both client variants with comparison table - docs/architecture.md: add thin client architecture section - README.md: update architecture diagram and EdgeX section

Copilot · 2026-05-26T07:04:43Z

@copilot there will be 2 edgex clients: a full k3s client and a thin single-container client.

Both of them carry the same function, but thin client is standalone, hardened and not extendable with add...

Done. Two EdgeX client variants are now available:

Full k3s client (docker-compose.edgex-client.yml) — 10 separate containers (one per service), extendable via compose overrides, suitable for k3s clusters and dev environments. Fleet label: edgekit/role=edge.

Thin client (docker-compose.edgex-thin-client.yml) — single hardened edgekit-thin-client container built from edgex-thin-client/Dockerfile. It bundles all EdgeX Core Services, Supporting Services, device-modbus, embedded PostgreSQL 16, and Mosquitto (localhost-only) managed by supervisord. Properties:

Standalone — no external service dependencies
Hardened — read-only root FS, no-new-privileges, internal MQTT not published externally
Fixed — service set is baked into the image; not extendable without rebuilding

Fleet label: edgekit/role=edge-thin → helm/edgekit/values-thin-client.yaml.

Comparison table and updated architecture diagram added to docs/edgex.md and docs/architecture.md.

Commit: the latest commit on this branch.

Copilot

Pull request overview

Integrates EdgeX Foundry 4.0 (Odessa) into EdgeKit by adding Docker Compose stacks for edge (no-security), thin edge (single-container), and central security services, plus supporting Helm/Fleet configuration and documentation.

Changes:

Added Docker Compose stacks for edgex-client, edgex-server (security), and edgex-thin-client (single-container) plus start/stop helper scripts.
Introduced a new edgex-thin-client/ image (Alpine + supervisord) bundling EdgeX core/support/device-modbus with embedded PostgreSQL + Mosquitto.
Added Helm values overrides (values-client.yaml, values-server.yaml, values-thin-client.yaml) and Rancher Fleet targeting, with updated docs/README architecture guidance.

Reviewed changes

Copilot reviewed 20 out of 20 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
scripts/stop-edgex-thin-client.sh	Adds stop/purge helper for the thin-client compose stack.
scripts/stop-edgex-server.sh	Adds stop helper for the central security compose stack.
scripts/stop-edgex-client.sh	Adds stop helper for the edge (no-security) compose stack.
scripts/start-edgex-thin-client.sh	Adds build/start + basic smoke-test helper for the thin-client stack.
scripts/start-edgex-server.sh	Adds start helper for the central security compose stack.
scripts/start-edgex-client.sh	Adds start helper for the edge (no-security) compose stack.
README.md	Updates architecture and repo layout; documents EdgeX integration and how to run stacks.
helm/edgekit/values-thin-client.yaml	Adds Helm override values intended for “edge-thin” nodes.
helm/edgekit/values-server.yaml	Adds Helm override values for central/server profile (broker enabled, agent disabled).
helm/edgekit/values-client.yaml	Adds Helm override values for edge/client profile (agent enabled, broker disabled).
fleet.yaml	Adds Rancher Fleet targets mapping cluster labels to Helm values files.
edgex-thin-client/supervisord.conf	Defines process supervision + startup ordering for bundled EdgeX services and infra.
edgex-thin-client/mosquitto.conf	Configures embedded Mosquitto to listen on localhost only.
edgex-thin-client/entrypoint.sh	Initializes/chowns PostgreSQL data dir and starts supervisord.
edgex-thin-client/Dockerfile	Builds the thin-client image via multi-stage extraction of EdgeX binaries/configs.
docs/edgex.md	Adds detailed EdgeX integration guide (architecture, local compose, Helm, Fleet, Modbus setup).
docs/architecture.md	Extends overall system architecture docs with EdgeX deployment modes.
docker-compose.edgex-thin-client.yml	Adds single-container thin-client compose definition with hardening settings.
docker-compose.edgex-server.yml	Adds central security-services compose definition (OpenBao + security bootstrap/proxy/nginx).
docker-compose.edgex-client.yml	Adds edge no-security EdgeX compose definition (core/support/device-modbus + PG + MQTT).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

tomgrv · 2026-05-26T16:12:18Z

+[program:core-keeper]
+command=/edgex/bin/core-keeper
+directory=/edgex/services/core-keeper
+priority=20
+autostart=true
+autorestart=true
+startsecs=5
+startretries=10


Run rootless

Fixed in the latest commit. All EdgeX programs in supervisord.conf now have user=edgex set; Mosquitto has user=mosquitto. Supervisord itself still starts as root so it can apply the per-program privilege-drop directives (this is a supervisord requirement).

tomgrv · 2026-05-26T16:12:37Z

+    # Run as root so entrypoint.sh can chown the PostgreSQL data directory;
+    # supervisord then drops individual services to the edgex user (uid 2002)
+    # or postgres user as appropriate.


Run rootless

Fixed. supervisord.conf now sets user=edgex on every EdgeX program and user=mosquitto on the Mosquitto program, so the compose comment accurately describes what happens at runtime.

tomgrv · 2026-05-26T16:14:08Z

+x-stagegate-env: &stagegate-env
+  STAGEGATE_BOOTSTRAPPER_HOST: edgex-security-bootstrapper
+  STAGEGATE_BOOTSTRAPPER_STARTPORT: "54321"
+  STAGEGATE_DATABASE_HOST: edgex-postgres
+  STAGEGATE_DATABASE_PORT: "5432"
+  STAGEGATE_DATABASE_READYPORT: "5432"
+  STAGEGATE_PROXYSETUP_READYPORT: "54325"
+  STAGEGATE_READY_TORUNPORT: "54329"
+  STAGEGATE_REGISTRY_HOST: edgex-core-keeper
+  STAGEGATE_REGISTRY_PORT: "59890"
+  STAGEGATE_REGISTRY_READYPORT: "54324"


Add missing registry/db services

Done. Added mqtt-broker (Mosquitto), database (PostgreSQL 16), and core-keeper to docker-compose.edgex-server.yml. The stage-gate env variables (STAGEGATE_DATABASE_HOST, STAGEGATE_REGISTRY_HOST) now resolve to actual services in the stack, and security-proxy-auth can reach edgex-core-keeper:59890.

tomgrv · 2026-05-26T16:15:27Z

+      # Add routes for the EdgeX core services exposed by this proxy
+      EDGEX_ADD_PROXY_ROUTE: >-
+        core-data.http://edgex-core-data:59880,
+        core-metadata.http://edgex-core-metadata:59881,
+        core-command.http://edgex-core-command:59882,
+        support-notifications.http://edgex-support-notifications:59860,
+        support-scheduler.http://edgex-support-scheduler:59863,
+        device-modbus.http://edgex-device-modbus:59901


Align routes with server services

Fixed. EDGEX_ADD_PROXY_ROUTE now only includes core-keeper.http://edgex-core-keeper:59890 — the only EdgeX service present in this server-side stack. Routes for core-data, core-metadata, core-command, support-notifications, support-scheduler, and device-modbus have been removed.

tomgrv · 2026-05-26T16:16:05Z

@copilot see comments & reply, and update accordingly

…erver; align proxy routes - supervisord.conf: add user=edgex to all EdgeX programs and user=mosquitto to mosquitto; supervisord continues to start as root (needed for entrypoint chown) so privilege-drop directives take effect - docker-compose.edgex-thin-client.yml: update comment to match the now-correct per-program user-drop behaviour - docker-compose.edgex-server.yml: add mqtt-broker, database (postgres), and core-keeper services required by the stage-gate scripts and security-proxy-auth; also add db-data volume and restrict EDGEX_ADD_PROXY_ROUTE to only core-keeper (the sole EdgeX service actually present in this stack)

Copilot · 2026-05-26T16:21:47Z

@copilot see comments & reply, and update accordingly

All four review items addressed in the latest commit:

Rootless thin client (supervisord.conf + docker-compose.edgex-thin-client.yml): every EdgeX program now has user=edgex, Mosquitto has user=mosquitto, PostgreSQL retains user=postgres. Supervisord still starts as root (required to apply per-program privilege-drop) then drops each process.
Missing registry/db services (docker-compose.edgex-server.yml): added mqtt-broker, database (PostgreSQL 16), and core-keeper so stage-gate waits and security-proxy-auth resolve correctly.
Aligned proxy routes: EDGEX_ADD_PROXY_ROUTE trimmed to core-keeper only — the sole EdgeX service in the server stack.

Initial plan

fffe043

Copilot AI assigned Copilot and tomgrv May 25, 2026

Copilot started work on behalf of tomgrv May 25, 2026 21:29 View session

Copilot AI linked an issue May 25, 2026 that may be closed by this pull request

integrate edgex #6

Open

Copilot AI changed the title ~~[WIP] Integrate EdgeX platform with client and server setup~~ feat: integrate EdgeX Foundry 4.0 (Odessa) May 25, 2026

Copilot finished work on behalf of tomgrv May 25, 2026 21:37

Copilot AI requested a review from tomgrv May 25, 2026 21:37

tomgrv requested changes May 26, 2026

View reviewed changes

Copilot started work on behalf of tomgrv May 26, 2026 06:54 View session

Copilot AI requested a review from tomgrv May 26, 2026 07:05

Copilot finished work on behalf of tomgrv May 26, 2026 07:05

tomgrv approved these changes May 26, 2026

View reviewed changes

tomgrv marked this pull request as ready for review May 26, 2026 07:08

tomgrv requested a review from Copilot May 26, 2026 07:08

Copilot started reviewing on behalf of tomgrv May 26, 2026 07:08 View session

Copilot AI reviewed May 26, 2026

View reviewed changes

Copilot started work on behalf of tomgrv May 26, 2026 16:16 View session

Copilot finished work on behalf of tomgrv May 26, 2026 16:22

Copilot AI requested a review from tomgrv May 26, 2026 16:22

Conversation

Copilot AI commented May 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Edge node (docker-compose.edgex-client.yml)

Central server (docker-compose.edgex-server.yml)

Helm & GitOps

Docs

Uh oh!

tomgrv left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented May 26, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

tomgrv May 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI May 26, 2026

Choose a reason for hiding this comment

Uh oh!

tomgrv May 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI May 26, 2026

Choose a reason for hiding this comment

Uh oh!

tomgrv May 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI May 26, 2026

Choose a reason for hiding this comment

Uh oh!

tomgrv May 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI May 26, 2026

Choose a reason for hiding this comment

Uh oh!

tomgrv commented May 26, 2026

Uh oh!

Copilot AI commented May 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented May 25, 2026 •

edited

Loading

Edge node (`docker-compose.edgex-client.yml`)

Central server (`docker-compose.edgex-server.yml`)