bootnode/infra/k8s/lux-fleet.yaml

# Lux Fleet API — read-only live overview of the managed luxd fleet.
#
# One Go binary (cmd/fleet), no Python runtime. It runs INSIDE lux-k8s, where
# the fleet is, so a node's dial address is simply its pod IP: no endpoint file
# to go stale, no cross-cluster credential to mint, and no API-server pod proxy
# carrying chain RPC. Every chain fact comes from the node itself over luxd's
# /v1 HTTP surface — /ext was removed in luxd 1.36 and 404s — plus the pod list
# and the LuxNetwork CR for the operator's declared shape.
#
# Nothing is mutated: every call is a GET or a read-only JSON-RPC query. The
# ClusterRole grants list/get on pods and luxnetworks and nothing else — no
# pods/proxy, no exec, no writes.
#
# Public URL. api.cloud.lux.network resolves to bootnode-k8s, so that cluster's
# nginx forwards only the /v1/fleets/lux path here, across the two clusters —
# see lux-fleet-bridge.yaml. Every other path on that host keeps going to
# web3-platform-api, untouched.
#
# Apply to: do-sfo3-lux-k8s.

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: lux-fleet
  namespace: lux-cloud

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: lux-fleet
rules:
  - apiGroups: [""]
    resources: [pods]
    verbs: [get, list]
  - apiGroups: [lux.cloud]
    resources: [luxnetworks]
    verbs: [get, list]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: lux-fleet
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: lux-fleet
subjects:
  - kind: ServiceAccount
    name: lux-fleet
    namespace: lux-cloud

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: lux-fleet
  namespace: lux-cloud
  labels:
    app: lux-fleet
spec:
  replicas: 2
  selector:
    matchLabels:
      app: lux-fleet
  template:
    metadata:
      labels:
        app: lux-fleet
    spec:
      serviceAccountName: lux-fleet
      containers:
        - name: lux-fleet
          # Built by hanzo.yml from Dockerfile.fleet. Pinned, so a rollout is
          # a deliberate act.
          image: ghcr.io/hanzoai/bootnode:fleet-6291e97
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 8000
              name: http
          readinessProbe:
            httpGet: { path: /health, port: 8000 }
            initialDelaySeconds: 2
            periodSeconds: 15
          livenessProbe:
            httpGet: { path: /health, port: 8000 }
            initialDelaySeconds: 5
            periodSeconds: 30
          resources:
            requests: { cpu: 25m, memory: 32Mi }
            limits: { cpu: 500m, memory: 128Mi }
          securityContext:
            runAsNonRoot: true
            runAsUser: 65532
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities: { drop: [ALL] }

---
apiVersion: v1
kind: Service
metadata:
  name: lux-fleet
  namespace: lux-cloud
  labels:
    app: lux-fleet
spec:
  type: ClusterIP
  selector:
    app: lux-fleet
  ports:
    - name: http
      port: 80
      targetPort: 8000

---
# Claims only the fleet path on the shared host. TLS for api.cloud.lux.network
# is terminated on bootnode-k8s; this cluster is reached over its own ingress,
# which serves its default certificate for an SNI it does not own. The hop is
# routed by Host header, not by certificate, and the forwarder does not verify.
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: lux-fleet
  namespace: lux-cloud
spec:
  ingressClassName: ingress
  rules:
    - host: api.cloud.lux.network
      http:
        paths:
          - path: /v1/fleets/lux
            pathType: Prefix
            backend:
              service:
                name: lux-fleet
                port:
                  number: 80