mpc/k8s/mpc-statefulset.yaml

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: mpc-node
  namespace: lux-mpc
  labels:
    app: mpc-node
    app.kubernetes.io/part-of: lux-mpc
spec:
  serviceName: mpc-node-headless
  replicas: 5
  podManagementPolicy: Parallel
  selector:
    matchLabels:
      app: mpc-node
  template:
    metadata:
      labels:
        app: mpc-node
        app.kubernetes.io/part-of: lux-mpc
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
        seccompProfile:
          type: RuntimeDefault
      imagePullSecrets:
        - name: registry-hanzo
      initContainers:
        - name: init-config
          image: alpine:3.20
          command:
            - sh
            - -c
            - |
              # Determine node index from hostname
              INDEX=${HOSTNAME##*-}
              NODE_ID="node${INDEX}"
              echo "Initializing ${NODE_ID}"

              # Build peer list (all other nodes)
              PEERS=""
              for i in 0 1 2 3 4; do
                if [ "$i" != "$INDEX" ]; then
                  PEERS="${PEERS}node${i}@mpc-node-${i}.mpc-node-headless.lux-mpc.svc:9999,"
                fi
              done
              # Remove trailing comma
              PEERS=${PEERS%,}

              # Write args file
              cat > /config/args.env <<EOF
              NODE_ID=${NODE_ID}
              LISTEN=:9999
              PEERS=${PEERS}
              EOF

              echo "Config written for ${NODE_ID} with peers: ${PEERS}"
          volumeMounts:
            - name: config
              mountPath: /config
      containers:
        - name: mpc-node
          image: ghcr.io/luxfi/mpc:v1.10.0
          imagePullPolicy: Always
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
          command:
            - sh
            - -c
            - |
              # Read config
              INDEX=${HOSTNAME##*-}
              NODE_ID="node${INDEX}"

              PEERS=""
              for i in 0 1 2 3 4; do
                if [ "$i" != "$INDEX" ]; then
                  PEERS="${PEERS} --peer node${i}@mpc-node-${i}.mpc-node-headless.lux-mpc.svc:9999"
                fi
              done

              # Build command (v1.10.0: consensus is the only mode; flag dropped)
              CMD="mpcd start --node-id ${NODE_ID} --listen :9999 --api :9800 --data /data/mpc --threshold 3 ${PEERS}"

              # Node 0 also serves the Dashboard API
              if [ "$INDEX" = "0" ]; then
                CMD="${CMD} --api-listen :8081 --jwt-secret ${JWT_SECRET}"
              fi

              echo "Starting: ${CMD}"
              exec ${CMD}
          ports:
            - containerPort: 9999
              name: p2p
              protocol: TCP
            - containerPort: 9800
              name: mpc-api
              protocol: TCP
            - containerPort: 8081
              name: dashboard-api
              protocol: TCP
          env:
            - name: DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: mpc-secrets
                  key: DATABASE_URL
            - name: JWT_SECRET
              valueFrom:
                secretKeyRef:
                  name: mpc-secrets
                  key: jwt-secret
            - name: KV_URL
              valueFrom:
                secretKeyRef:
                  name: mpc-secrets
                  key: KV_URL
            - name: MPC_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: mpc-secrets
                  key: mpc-password
                  optional: true
            - name: S3_ENDPOINT
              valueFrom:
                secretKeyRef:
                  name: mpc-secrets
                  key: s3-endpoint
                  optional: true
            - name: S3_BUCKET
              valueFrom:
                secretKeyRef:
                  name: mpc-secrets
                  key: s3-bucket
                  optional: true
            - name: S3_ACCESS_KEY
              valueFrom:
                secretKeyRef:
                  name: mpc-secrets
                  key: s3-access-key
                  optional: true
            - name: S3_SECRET_KEY
              valueFrom:
                secretKeyRef:
                  name: mpc-secrets
                  key: s3-secret-key
                  optional: true
            - name: MPC_KMS_MASTER_KEY
              valueFrom:
                secretKeyRef:
                  name: mpc-secrets
                  key: kms-master-key
                  optional: true
            - name: MPC_INTERNAL_API_KEY
              valueFrom:
                secretKeyRef:
                  name: mpc-secrets
                  key: internal-api-key
                  optional: true
          livenessProbe:
            httpGet:
              path: /healthz
              port: 9800
            initialDelaySeconds: 30
            periodSeconds: 30
            timeoutSeconds: 5
            failureThreshold: 5
          readinessProbe:
            httpGet:
              path: /healthz
              port: 9800
            initialDelaySeconds: 15
            periodSeconds: 10
            timeoutSeconds: 5
            failureThreshold: 3
          resources:
            requests:
              cpu: 200m
              memory: 512Mi
            limits:
              cpu: "1"
              memory: 1Gi
          volumeMounts:
            - name: data
              mountPath: /data/mpc
            - name: config
              mountPath: /config
            - name: tmp
              mountPath: /tmp
      volumes:
        - name: config
          emptyDir: {}
        - name: tmp
          emptyDir:
            sizeLimit: 50Mi
  volumeClaimTemplates:
    - metadata:
        name: data
      spec:
        accessModes: ["ReadWriteOnce"]
        storageClassName: do-block-storage
        resources:
          requests:
            storage: 10Gi
---
apiVersion: v1
kind: Service
metadata:
  name: mpc-node-headless
  namespace: lux-mpc
  labels:
    app: mpc-node
    app.kubernetes.io/part-of: lux-mpc
spec:
  clusterIP: None
  publishNotReadyAddresses: true
  selector:
    app: mpc-node
  ports:
    - name: p2p
      port: 9999
      targetPort: 9999
    - name: mpc-api
      port: 9800
      targetPort: 9800
    - name: dashboard-api
      port: 8081
      targetPort: 8081