Merge remote-tracking branch 'github/main'
github.com/luxfi/universe is canonical from here. git.hanzo.ai/lux/universe is unreachable, and this merge carries its lineage over. The rule applied, per area: Workflows: one set, under .hanzo/workflows; .github/workflows is gone. LLM.md, README.md, deploy/README.md: the forge's. GitHub's sections were the ones the forge had already rewritten (the /mainnet/v1/bc path table, the auto-bump flow), not divergent content. Counts brought to what this tree holds; LLM.md records the rules below. deploy/applicationset.yaml: the forge's object (apps.hanzo.ai/v1, destination name lux-cluster) with repoURL https://github.com/luxfi/universe. deploy/*.yaml modified on both sides: a three-way merge, not a whole-file pick. Where both moved the pin, the newer semver wins; at the same semver, the side that pinned a digest (exchange-api 2.3.34 is sha256:3eae48ac, which the registry confirms; GitHub's zoo copy carried 007beb83, the pre-repush bytes). Where both wrote cd.automated, GitHub's false wins: it is the later decision (909d3bd) and the one about the cluster CD now runs on. true stays only on the static sites GitHub verified there. The forge's /v1/bc -> /v1/chain rename and its digests are carried into files whose other hunks came from GitHub (explorer, exchange-api x3, rpc-tip-gate, lux-market). lux-bank/lux-financial: GitHub's v1.5.5 is not in the registry (the newest published tag is v1.5.3), so the pin is v1.5.3 with its digest. A pin never names an image the registry does not have. Static sites (lux-audio, lux-cloud/cloud, lux-credit, lux-fund, lux-lps, lux-network, zoo/zoo-exchange): GitHub's three-object declaration — a staticFiles Middleware, the route that names it, the endpoint-less Service, no image — replaces the forge's pod. A union would put an Ingress and a priority-100 IngressRoute on one host with a pod behind it serving nothing. The forge's last pins, for the record: lux-audio ghcr.io/luxfi/audio:latest@sha256:48265c37c91f lux-cloud ghcr.io/luxfi/cloud-web:v1.5.34@sha256:54a586fbd4d6 lux-credit ghcr.io/lux-apps/credit:36b1c2dffd62 lux-fund ghcr.io/lux-apps/fund:20cb7cb988b3 (amd64 only) lux-lps ghcr.io/luxfi/lps:1.0.2 lux-network ghcr.io/lux-apps/network:latest@sha256:b52dd80f59d7 zoo-exchange ghcr.io/luxfi/exchange:5.149.73@sha256:baefb1903851 Lifted objects (lux-mainnet/{explorer,lux-build,lux-market,rpc-tip-gate}): the forge's file — the claim, routes, middlewares and rbac it lifted out of k8s/ — with GitHub's cd.automated: false. deploy/hanzo/{cloud,commerce-site,iam,lux-bitcoin,lux-coin,lux-finance, lux-industries,lux-market,lux-safe}.yaml, deploy/lux-ns/lux-exchange.yaml, deploy/lux-web/lux-network.yaml: deleted, as GitHub did in2079731. Each Lux site is declared once, as files, in its own namespace; hanzo's own services are hanzo/universe's to declare. What the forge had changed in them, so it is not lost: hanzo/cloud v1.801.476@sha256:0743f907; hanzo/iam IAM_DATABASE_URL from Secret iam-db; lux-safe ghcr.io/luxfi/safe:v2.2.14; lux-exchange 5.149.83@sha256:7c1bd0e9 with a rateLimit Middleware and the hosts app.lux.exchange, trade.lux.exchange, exchange.lux.network, markets.lux.network; lux-web/lux-network at sha 1028f82e. deploy/zoo-mainnet/: removed. Every Zoo workload is declared in zooai/universe. Floating tags: every one carries a digest. lux-market and rpc-tip-gate take the forge's frozen digests back; the rest already had theirs. k8s/lux-*: the forge lifted k8s duplicates into deploy/ values and deleted them. luxd-statefulset x3, lux-mainnet/explorer, lux-testnet/{chain-traffic, exchange-api} stay deleted; what GitHub changed in them (node v1.36.125 pins, exchange-api 2.3.28, the 50Gi claim, a comment) is behind the values files (node 1.36.181, exchange-api 2.3.34, the explorer claim). The gateway configs, luxd-startup ConfigMaps, lux-testnet/explorer and the mainnet kustomization are the forge's: GitHub's content is a subset of them up to /v1/bc -> /v1/chain and /v1/health/liveness -> /v1/health/ops/liveness, and network.yaml, which GitHub's kustomization still lists, no longer exists. scripts/roll_luxd.sh: the forge's quorum-preserving roll (eviction API, one pod at a time, digest + version + every-chain bootstrap, devnet -> testnet -> mainnet) plus GitHub's closing height-and-restart report. The tag is written in the spelling the values files use (bare 1.36.181) and the digest resolved for that spelling; a leading v is accepted and stripped. The push remote is GIT_REMOTE (default origin). Validated: 123 deploy YAMLs parse; 122 values files render against chart app 0.1.11; no floating tag without a digest; every kustomization that built before builds now; pin.sh --verify reads 92 pins, 79 agree, 6 are frozen moving tags whose pointer has since moved (their digests still name real bytes), 6 are registries a luxfi token cannot read, and lux-financial is the one it caught. Co-authored-by: Hanzo Dev <[email protected]>
This commit is contained in:
Hanzo Dev
@@ -0,0 +1,63 @@
|
||||
# A universe is a set of values files, so CI proves they still render.
|
||||
#
|
||||
# There is no binary here to compile. What can break is a values file that the
|
||||
# chart cannot template — a bad key, a removed field, a chart version that moved
|
||||
# under it — and that failure is invisible until CD tries to sync and the service
|
||||
# is already down. Rendering every file against the chart CD will use turns that
|
||||
# into a red build on the push that caused it.
|
||||
#
|
||||
# CI DOES NOT DEPLOY, and there is no kubectl below. Applying is CD's one job:
|
||||
# the ApplicationSet in deploy/applicationset.yaml turns each values file into an
|
||||
# Application, pulls the SAME chart by version, and reconciles it. A workflow that
|
||||
# also applied would be a second delivery path, and two paths mean the cluster can
|
||||
# disagree with git while both report success.
|
||||
name: CI/CD
|
||||
on:
|
||||
push:
|
||||
branches: [main]
|
||||
workflow_dispatch:
|
||||
|
||||
jobs:
|
||||
render:
|
||||
runs-on: [self-hosted, hanzo-build-linux-amd64]
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Install helm
|
||||
run: |
|
||||
curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
|
||||
|
||||
- name: Every values file renders against the chart
|
||||
run: |
|
||||
set -euo pipefail
|
||||
# The chart and version CD will actually use, read from the generator
|
||||
# rather than repeated here — a second copy is a second thing to drift.
|
||||
# Parsed as YAML, not grepped: `targetRevision` sits several keys below
|
||||
# `chart:`, so a line-window match silently returns nothing and the
|
||||
# check then renders against whatever the registry calls latest.
|
||||
cat > /tmp/readchart.py <<'PY'
|
||||
import yaml
|
||||
d = yaml.safe_load(open("deploy/applicationset.yaml"))
|
||||
for src in d["spec"]["template"]["spec"]["sources"]:
|
||||
if src.get("chart") == "app":
|
||||
print("CHART=oci://%s/app" % src["repoURL"])
|
||||
print("VERSION=%s" % src["targetRevision"])
|
||||
PY
|
||||
sed -i 's/^ //' /tmp/readchart.py
|
||||
eval "$(python3 /tmp/readchart.py)"
|
||||
echo "chart ${CHART:?} version ${VERSION:?}"
|
||||
|
||||
fail=0
|
||||
for f in deploy/*/*.yaml; do
|
||||
[ "$(basename "$f")" = applicationset.yaml ] && continue
|
||||
ns="$(basename "$(dirname "$f")")"
|
||||
rel="$(basename "$f" .yaml)"
|
||||
if ! helm template "$rel" "$CHART" --version "$VERSION" \
|
||||
-n "$ns" -f "$f" >/dev/null 2>/tmp/err; then
|
||||
echo "::error file=$f::does not render"
|
||||
sed 's/^/ /' /tmp/err | head -5
|
||||
fail=1
|
||||
fi
|
||||
done
|
||||
[ "$fail" = 0 ] || { echo "some values files do not render"; exit 1; }
|
||||
echo "all values files render"
|
||||
@@ -1027,3 +1027,26 @@ already exist on hanzo-k8s.
|
||||
**No cluster is deleted by any commit in this repo.** DOKS deletion is effectively
|
||||
irreversible; each teardown is its own reviewed change after its migration is
|
||||
verified green.
|
||||
|
||||
## One repository: github.com/luxfi/universe (2026-09-04)
|
||||
|
||||
`github.com/luxfi/universe` is the canonical remote. `git.hanzo.ai/lux/universe`
|
||||
is unreachable; its lineage was merged into GitHub's in one commit, and
|
||||
`deploy/applicationset.yaml` reads GitHub. The rules that merge applied hold
|
||||
from here on:
|
||||
|
||||
- A static site is three objects and no image: a `staticFiles` Middleware, the
|
||||
route that names it, and the endpoint-less Service the route schema requires
|
||||
(`deploy/lux-credit/lux-credit.yaml` is the reference). The DigitalOcean-era
|
||||
pod declarations of those sites are gone; their last image pins are recorded
|
||||
in the merge commit's message.
|
||||
- `cd.automated: true` only on a file verified to run on the current cluster.
|
||||
Every pod-based file is `false` until that is shown; a newer pin does not opt
|
||||
a file back in.
|
||||
- A chain answers under `/v1/chain/<alias>/rpc` and the gateway asks luxd for
|
||||
health at `/v1/health/ops/liveness`; every declaration and script says so.
|
||||
- luxd moves only through `scripts/roll_luxd.sh`, which writes the tag in the
|
||||
spelling the values files already use (bare `1.36.181`) and one digest to all
|
||||
three fleets.
|
||||
- `k8s/` never redeclares what `deploy/` declares. A k8s manifest that
|
||||
duplicated a values file is deleted, not merged back.
|
||||
|
||||
+9
-9
@@ -34,11 +34,13 @@ syncPolicy:
|
||||
selfHeal: true
|
||||
```
|
||||
|
||||
**81 of the 134 values files set `cd.automated: true`**, so auto-sync is on for
|
||||
most of the fleet. This file previously said the ApplicationSet "deliberately
|
||||
has no `automated` block" and that "there is no CD in this repository yet";
|
||||
neither has been true since the templatePatch was added, and reading it that way
|
||||
is how a hand-edited object gets healed back and nobody knows why.
|
||||
**19 of the 122 values files set `cd.automated: true`**: the static sites,
|
||||
each verified answering from the edge on the current cluster. Every pod-based
|
||||
file is `false` until it is shown to run there; a pin bump does not opt a file
|
||||
back in. This file previously said the ApplicationSet "deliberately has no
|
||||
`automated` block" and that "there is no CD in this repository yet"; neither has
|
||||
been true since the templatePatch was added, and reading it that way is how a
|
||||
hand-edited object gets healed back and nobody knows why.
|
||||
|
||||
`prune: false` throughout. Nothing here deletes: a values file that stops
|
||||
declaring an object leaves that object running, which is why removing a service
|
||||
@@ -119,12 +121,10 @@ truthful state; a values file claiming otherwise is worse than an absence.
|
||||
|
||||
## Why the chart is pinned at 0.1.11 and not 0.1.13
|
||||
|
||||
Three values files do not render under 0.1.13, all for one reason:
|
||||
One values file does not render under 0.1.13:
|
||||
|
||||
```
|
||||
deploy/app-lux-finance/app-lux-finance.yaml
|
||||
deploy/lux-cloud/price.yaml
|
||||
deploy/lux-ns/lux-exchange.yaml
|
||||
kms: Additional property hostAPI is not allowed
|
||||
kms: Additional property credentialsSecret is not allowed
|
||||
```
|
||||
@@ -141,7 +141,7 @@ established.
|
||||
So the bump is a migration with a cluster prerequisite, and it is not done here.
|
||||
The rest of 0.1.13 is already satisfied: `image.digest` is present wherever the
|
||||
chart's claim guard requires it, and `lux-explorer/lux-faucet` no longer carries
|
||||
its version inside `image.repository`. Under 0.1.11 all 134 files render.
|
||||
its version inside `image.repository`. Under 0.1.11 all 122 files render.
|
||||
|
||||
## Pins still to move
|
||||
|
||||
|
||||
@@ -1,88 +0,0 @@
|
||||
# Generated from the live app-lux-finance/app-lux-finance Deployment on do-sfo3-lux-k8s
|
||||
# by hack/live2values.py. Live is the source: a repo of hand-applied
|
||||
# manifests has unknown currency, the running fleet does not.
|
||||
replicas: 2
|
||||
selectorLabels:
|
||||
app: app-lux-finance
|
||||
containerName: app
|
||||
image:
|
||||
repository: ghcr.io/luxfi/finance
|
||||
tag: 1.0.3-amd64
|
||||
pullPolicy: IfNotPresent
|
||||
partOf: lux-finance
|
||||
# hanzo-cd's ownership markers, carried so a chart apply re-asserts them rather
|
||||
# than pruning the app out of CD's inventory. live2values.py did not read them.
|
||||
annotations:
|
||||
apps.hanzo.ai/installation-id: hanzo-cd
|
||||
apps.hanzo.ai/tracking-id: lux-app-lux-finance-app-lux-finance:apps/Deployment:app-lux-finance/app-lux-finance
|
||||
# SPA_* env is templated into /public/config.json at boot by hanzoai/spa, which
|
||||
# is what this image runs. A build-time key cannot be rotated without a rebuild,
|
||||
# so the key is a reference to KMS and the pod is the only place it exists.
|
||||
env:
|
||||
- name: PORT
|
||||
value: '3000'
|
||||
- name: ROOT
|
||||
value: /public
|
||||
- name: SPA_INFURA_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: app-lux-finance-secrets
|
||||
key: INFURA_KEY
|
||||
# Org `lux` lives on the cloud-embedded KMS (kms.hanzo.ai), not on the
|
||||
# near-empty lux-kms-go store that kms.lux.cloud now resolves to.
|
||||
kms:
|
||||
hostAPI: https://kms.hanzo.ai
|
||||
credentialsSecret: lux-platform-iam-creds
|
||||
projectSlug: lux
|
||||
envSlug: prod
|
||||
kmsSecrets:
|
||||
- name: app-lux-finance-kms-sync
|
||||
secretsPath: /finance
|
||||
secretName: app-lux-finance-secrets
|
||||
keys:
|
||||
- INFURA_KEY
|
||||
resources:
|
||||
limits:
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 32Mi
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /health
|
||||
port: 3000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 30
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /health
|
||||
port: 3000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 3
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: http
|
||||
servicePort: 80
|
||||
imagePullSecrets:
|
||||
- name: ghcr-pull
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 25%
|
||||
topologySpread:
|
||||
enabled: false
|
||||
lifecycle: null
|
||||
terminationGracePeriodSeconds: 30
|
||||
ingress:
|
||||
enabled: true
|
||||
hosts:
|
||||
- app.lux.finance
|
||||
tls: true
|
||||
className: ingress
|
||||
@@ -64,4 +64,4 @@ ingress:
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
@@ -2,15 +2,10 @@
|
||||
# that lives in hanzo-cd on the control-plane cluster and turns every
|
||||
# deploy/<namespace>/<app>.yaml below into an Application.
|
||||
#
|
||||
# It described a DIFFERENT object until now: named `fleet` rather than
|
||||
# `lux-fleet`, sourced from github.com/luxfi/universe rather than this repo's
|
||||
# own forge, and destined for whatever cluster read it rather than for Lux's.
|
||||
# Applying it would have created a second generator pointed at a mirror, and
|
||||
# CD would then reconcile Lux from a repo nobody pushes to — the exchange spent
|
||||
# months in exactly that shape, tagging releases on a forge that built nothing.
|
||||
#
|
||||
# git.hanzo.ai is the source. Each org's fleet reads its own universe from it:
|
||||
# hanzo/universe, lux/universe, zoo/universe, one ApplicationSet each.
|
||||
# github.com/luxfi/universe is the source. The forge copy at git.hanzo.ai is
|
||||
# unreachable and its lineage was merged into this one, so there is one history
|
||||
# and one repoURL. Each org's fleet reads its own universe — hanzo/universe,
|
||||
# luxfi/universe, zooai/universe — one ApplicationSet each.
|
||||
apiVersion: apps.hanzo.ai/v1
|
||||
kind: ApplicationSet
|
||||
metadata:
|
||||
@@ -21,7 +16,7 @@ spec:
|
||||
- git:
|
||||
files:
|
||||
- path: deploy/*/*.yaml
|
||||
repoURL: https://git.hanzo.ai/lux/universe
|
||||
repoURL: https://github.com/luxfi/universe
|
||||
revision: main
|
||||
goTemplate: true
|
||||
goTemplateOptions:
|
||||
@@ -80,7 +75,7 @@ spec:
|
||||
repoURL: oci.hanzo.ai/charts
|
||||
targetRevision: 0.1.11
|
||||
- ref: values
|
||||
repoURL: https://git.hanzo.ai/lux/universe
|
||||
repoURL: https://github.com/luxfi/universe
|
||||
targetRevision: main
|
||||
syncPolicy:
|
||||
syncOptions:
|
||||
|
||||
@@ -44,4 +44,4 @@ imagePullSecrets: []
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
@@ -1,118 +0,0 @@
|
||||
# Generated from the live hanzo/cloud Deployment on do-sfo3-lux-k8s
|
||||
# by hack/live2values.py. Live is the source: a repo of hand-applied
|
||||
# manifests has unknown currency, the running fleet does not.
|
||||
replicas: 1
|
||||
selectorLabels:
|
||||
app: cloud
|
||||
image:
|
||||
repository: ghcr.io/hanzoai/cloud
|
||||
tag: v1.801.476
|
||||
digest: sha256:0743f907a3f12b469a538d52b7685c43cd2ffdb9cfc53a4c06e2ccb773a8f173
|
||||
pullPolicy: IfNotPresent
|
||||
partOf: lux-cloud
|
||||
env:
|
||||
- name: CLOUD_LISTEN
|
||||
value: :8000
|
||||
- name: CLOUD_HEALTH_LISTEN
|
||||
value: :9090
|
||||
- name: CLOUD_DATA_DIR
|
||||
value: /var/lib/cloud
|
||||
- name: RUNNING_IN_DOCKER
|
||||
value: 'true'
|
||||
- name: IAM_URL
|
||||
value: https://lux.id
|
||||
- name: IAM_ISSUER
|
||||
value: https://lux.id
|
||||
- name: CLOUD_IAM_ISSUER
|
||||
value: https://lux.id
|
||||
- name: AUTH_ISSUER
|
||||
value: https://lux.id
|
||||
- name: JWT_ISSUER
|
||||
value: https://lux.id
|
||||
- name: JWKS_URL
|
||||
value: https://lux.id/v1/iam/.well-known/jwks
|
||||
- name: IAM_KEYS_URL
|
||||
value: https://lux.id/v1/iam/.well-known/jwks
|
||||
- name: CLOUD_KMS_MASTER_KEY_REF
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: MASTER_KEY_B64
|
||||
name: cloud-kms-master-key
|
||||
- name: IAM_AUDIENCE
|
||||
value: lux-cloud
|
||||
- name: GATEWAY_ALLOWED_AUDIENCES
|
||||
value: lux-cloud,lux-console,lux-id,https://api.lux.cloud
|
||||
- name: AUTH_PUBLIC_PATHS
|
||||
value: /healthz,/readyz,/__stats,/.well-known/,/favicon
|
||||
- name: CLOUD_SITES_APEX
|
||||
value: lux.link
|
||||
- name: CLOUD_SITES_SELF_DOMAINS
|
||||
value: lux.link,lux.network,lux.cloud,lux.id
|
||||
- name: CLOUD_SITES_FIRSTPARTY_APEX
|
||||
value: lux.network
|
||||
- name: CLOUD_SITES_FIRSTPARTY
|
||||
- name: CLOUD_SITES_FIRSTPARTY_ORG
|
||||
value: lux
|
||||
- name: driverName
|
||||
value: sqlite
|
||||
- name: dbName
|
||||
value: hanzo_cloud
|
||||
- name: modelConfigPath
|
||||
value: /conf/models.yaml
|
||||
- name: TIKTOKEN_CACHE_DIR
|
||||
value: /var/lib/cloud/tiktoken
|
||||
resources:
|
||||
limits:
|
||||
cpu: '2'
|
||||
memory: 2Gi
|
||||
requests:
|
||||
cpu: 500m
|
||||
memory: 1Gi
|
||||
volumeMounts:
|
||||
- mountPath: /var/lib/cloud
|
||||
name: cloud-data
|
||||
- mountPath: /data/cloud
|
||||
name: cloud-data
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 9090
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 30
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 10
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: 9090
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 10
|
||||
ports:
|
||||
- containerPort: 8000
|
||||
name: http
|
||||
- containerPort: 9090
|
||||
name: ops
|
||||
volumes:
|
||||
- name: cloud-data
|
||||
persistentVolumeClaim:
|
||||
claimName: cloud-data
|
||||
imagePullSecrets:
|
||||
- name: ghcr-secret
|
||||
fsGroup: 1000
|
||||
strategy: Recreate
|
||||
topologySpread:
|
||||
enabled: false
|
||||
lifecycle: null
|
||||
terminationGracePeriodSeconds: 30
|
||||
# Live runs this pod with these settings and the chart renders only fsGroup
|
||||
# unless podSecurityContext is set, so omitting them is a silent drop to uid 0
|
||||
# (or to seccomp Unconfined) on the first server-side sync.
|
||||
podSecurityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
@@ -1,33 +0,0 @@
|
||||
# Generated from the live hanzo/commerce-admin Deployment on do-sfo3-lux-k8s
|
||||
# by hack/live2values.py. Live is the source: a repo of hand-applied
|
||||
# manifests has unknown currency, the running fleet does not.
|
||||
replicas: 1
|
||||
selectorLabels:
|
||||
app: commerce-admin
|
||||
containerName: admin
|
||||
image:
|
||||
repository: ghcr.io/hanzoai/commerce-admin
|
||||
digest: sha256:4cca2b4ff528f97037e9bb22f664f00a80fb424570ccdd869ec07002cbce727e
|
||||
pullPolicy: Always
|
||||
resources:
|
||||
limits:
|
||||
cpu: 200m
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 64Mi
|
||||
ports:
|
||||
- containerPort: 80
|
||||
strategy: Recreate
|
||||
topologySpread:
|
||||
enabled: false
|
||||
lifecycle: null
|
||||
terminationGracePeriodSeconds: 30
|
||||
defaultReadinessProbe: false
|
||||
imagePullSecrets: []
|
||||
ingress:
|
||||
enabled: true
|
||||
hosts:
|
||||
- admin.commerce.hanzo.ai
|
||||
tls: true
|
||||
className: hanzo
|
||||
@@ -1,40 +0,0 @@
|
||||
# Generated from the live hanzo/commerce-site Deployment on do-sfo3-lux-k8s
|
||||
# by hack/live2values.py. Live is the source: a repo of hand-applied
|
||||
# manifests has unknown currency, the running fleet does not.
|
||||
replicas: 1
|
||||
selectorLabels:
|
||||
app: commerce-site
|
||||
containerName: site
|
||||
image:
|
||||
repository: ghcr.io/hanzoai/commerce-site
|
||||
digest: sha256:17de0b0c143aeeda101215bdbb10c4b32098f033943e1683ffa4e590bb6f75cc
|
||||
pullPolicy: Always
|
||||
resources:
|
||||
limits:
|
||||
cpu: 200m
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 64Mi
|
||||
ports:
|
||||
- containerPort: 80
|
||||
strategy: Recreate
|
||||
topologySpread:
|
||||
enabled: false
|
||||
lifecycle: null
|
||||
terminationGracePeriodSeconds: 30
|
||||
defaultReadinessProbe: false
|
||||
imagePullSecrets: []
|
||||
ingress:
|
||||
enabled: true
|
||||
hosts:
|
||||
- commerce.hanzo.ai
|
||||
tls: true
|
||||
className: hanzo
|
||||
|
||||
# Enforcement switch, read by the lux-fleet ApplicationSet's templatePatch —
|
||||
# not by the chart. On while this Application already read Synced, so it
|
||||
# applies nothing today; what it adds is selfHeal, which returns a
|
||||
# hand-edited object to what is written here. prune stays off.
|
||||
cd:
|
||||
automated: true
|
||||
@@ -1,319 +0,0 @@
|
||||
# Generated from the live hanzo/console Deployment on do-sfo3-lux-k8s
|
||||
# by hack/live2values.py. Live is the source: a repo of hand-applied
|
||||
# manifests has unknown currency, the running fleet does not.
|
||||
replicas: 1
|
||||
selectorLabels:
|
||||
app: console
|
||||
image:
|
||||
repository: ghcr.io/hanzoai/console
|
||||
tag: v8.5.22
|
||||
pullPolicy: Always
|
||||
partOf: hanzo-universe
|
||||
env:
|
||||
- name: NEXT_PUBLIC_ANALYTICS_SITE_ID
|
||||
value: 7dce54ee-41f6-4751-96bf-fe005067c7c7
|
||||
- name: NEXT_PUBLIC_ANALYTICS_URL
|
||||
value: https://analytics.hanzo.ai/script.js
|
||||
- name: NODE_ENV
|
||||
value: production
|
||||
- name: PORT
|
||||
value: '4000'
|
||||
- name: NEXTAUTH_URL
|
||||
value: https://console.lux.cloud
|
||||
- name: NEXTAUTH_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: NEXTAUTH_SECRET
|
||||
name: console-secrets
|
||||
- name: SALT
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: SALT
|
||||
name: console-secrets
|
||||
- name: ENCRYPTION_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: ENCRYPTION_KEY
|
||||
name: console-secrets
|
||||
- name: AUTH_DISABLE_USERNAME_PASSWORD
|
||||
value: 'true'
|
||||
- name: AUTH_DISABLE_SIGNUP
|
||||
value: 'false'
|
||||
- name: IAM_URL
|
||||
value: https://lux.id
|
||||
- name: IAM_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: IAM_CLIENT_ID
|
||||
name: console-secrets
|
||||
- name: IAM_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: IAM_CLIENT_SECRET
|
||||
name: console-secrets
|
||||
- name: IAM_ORG
|
||||
value: hanzo
|
||||
- name: IAM_APP
|
||||
value: app-console
|
||||
- name: IAM_SERVER_URL
|
||||
value: https://lux.id
|
||||
- name: IAM_ORG_NAME
|
||||
value: hanzo
|
||||
- name: IAM_APP_NAME
|
||||
value: app-console
|
||||
- name: IAM_ALLOW_ACCOUNT_LINKING
|
||||
value: 'true'
|
||||
- name: HANZO_INIT_ORG_IDS
|
||||
value: hanzo,lux,zoo,pars
|
||||
- name: HANZO_INIT_ORG_NAMES
|
||||
value: Hanzo,Lux,Zoo,Pars
|
||||
- name: HANZO_INIT_USER_EMAIL
|
||||
value: [email protected]
|
||||
- name: HANZO_INIT_ORG_OWNERS
|
||||
value: [email protected]:lux,[email protected]:zoo,[email protected]:pars,[email protected]:pars,[email protected]:pars
|
||||
- name: DATABASE_URL
|
||||
value: file:/data/console.db
|
||||
- name: REDIS_CONNECTION_STRING
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: REDIS_CONNECTION_STRING
|
||||
name: console-secrets
|
||||
- name: DATASTORE_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: DATASTORE_URL
|
||||
name: console-secrets
|
||||
- name: DATASTORE_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: DATASTORE_USER
|
||||
name: console-secrets
|
||||
- name: DATASTORE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: DATASTORE_PASSWORD
|
||||
name: console-secrets
|
||||
- name: DATASTORE_MIGRATION_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: DATASTORE_MIGRATION_URL
|
||||
name: console-secrets
|
||||
- name: DATASTORE_DB
|
||||
value: console
|
||||
- name: DATASTORE_CLUSTER_ENABLED
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: DATASTORE_CLUSTER_ENABLED
|
||||
name: console-secrets
|
||||
optional: true
|
||||
- name: DATASTORE_AUTO_MIGRATION_DISABLED
|
||||
value: 'true'
|
||||
- name: CLICKHOUSE_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: DATASTORE_URL
|
||||
name: console-secrets
|
||||
- name: CLICKHOUSE_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: DATASTORE_USER
|
||||
name: console-secrets
|
||||
- name: CLICKHOUSE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: DATASTORE_PASSWORD
|
||||
name: console-secrets
|
||||
- name: CLICKHOUSE_MIGRATION_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: DATASTORE_MIGRATION_URL
|
||||
name: console-secrets
|
||||
- name: CLICKHOUSE_DB
|
||||
value: console
|
||||
- name: S3_EVENT_UPLOAD_BUCKET
|
||||
value: hanzo-events
|
||||
- name: S3_EVENT_UPLOAD_ENDPOINT
|
||||
value: http://s3:9000
|
||||
- name: S3_EVENT_UPLOAD_REGION
|
||||
value: us-east-1
|
||||
- name: S3_EVENT_UPLOAD_ACCESS_KEY_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: HANZO_S3_EVENT_UPLOAD_ACCESS_KEY_ID
|
||||
name: console-secrets
|
||||
- name: S3_EVENT_UPLOAD_SECRET_ACCESS_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: HANZO_S3_EVENT_UPLOAD_SECRET_ACCESS_KEY
|
||||
name: console-secrets
|
||||
- name: S3_EVENT_UPLOAD_FORCE_PATH_STYLE
|
||||
value: 'true'
|
||||
- name: S3_MEDIA_UPLOAD_ENDPOINT
|
||||
value: http://s3:9000
|
||||
- name: S3_MEDIA_UPLOAD_REGION
|
||||
value: us-east-1
|
||||
- name: S3_MEDIA_UPLOAD_BUCKET
|
||||
value: hanzo-media
|
||||
- name: S3_MEDIA_UPLOAD_ACCESS_KEY_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: HANZO_S3_MEDIA_UPLOAD_ACCESS_KEY_ID
|
||||
name: console-secrets
|
||||
- name: S3_MEDIA_UPLOAD_SECRET_ACCESS_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: HANZO_S3_MEDIA_UPLOAD_SECRET_ACCESS_KEY
|
||||
name: console-secrets
|
||||
- name: S3_MEDIA_UPLOAD_FORCE_PATH_STYLE
|
||||
value: 'true'
|
||||
- name: CASVISOR_API_URL
|
||||
value: http://visor:19000
|
||||
- name: KMS_API_URL
|
||||
value: https://kms.hanzo.ai
|
||||
- name: KMS_PROJECT_ID
|
||||
value: 2928fb55-6b08-454a-a338-a48d99a699a4
|
||||
- name: KMS_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: KMS_CLIENT_ID
|
||||
name: kms-console-credentials
|
||||
- name: KMS_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: KMS_CLIENT_SECRET
|
||||
name: kms-console-credentials
|
||||
- name: KMS_SERVICE_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: KMS_SERVICE_TOKEN
|
||||
name: kms-console-credentials
|
||||
optional: true
|
||||
- name: COMMERCE_API_URL
|
||||
value: http://commerce.hanzo.svc:8001
|
||||
- name: COMMERCE_SERVICE_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: COMMERCE_TOKEN
|
||||
name: console-secrets
|
||||
optional: true
|
||||
- name: AGENTS_API_URL
|
||||
value: http://agents:8080/api
|
||||
- name: NEXT_PUBLIC_HANZO_CLOUD_REGION
|
||||
value: US
|
||||
- name: NEXT_TELEMETRY_DISABLED
|
||||
value: '1'
|
||||
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
||||
value: http://otel-collector.hanzo.svc:4318
|
||||
- name: OTEL_EXPORTER_OTLP_PROTOCOL
|
||||
value: http/protobuf
|
||||
- name: OTEL_SERVICE_NAME
|
||||
value: console
|
||||
- name: OTEL_RESOURCE_ATTRIBUTES
|
||||
value: service.namespace=hanzo,deployment.environment=production
|
||||
- name: OTEL_TRACE_SAMPLING_RATIO
|
||||
value: '0.1'
|
||||
- name: INSIGHTS_HOST
|
||||
value: http://insights-capture.hanzo.svc:3000
|
||||
- name: INSIGHTS_API_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: API_KEY
|
||||
name: insights-client-secrets
|
||||
optional: true
|
||||
- name: NEXT_PUBLIC_INSIGHTS_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: INSIGHTS_KEY
|
||||
name: insights-client-secrets
|
||||
optional: true
|
||||
- name: NEXT_PUBLIC_INSIGHTS_HOST
|
||||
value: https://insights.hanzo.ai
|
||||
- name: ANALYTICS_API_URL
|
||||
value: http://analytics.hanzo.svc:3000
|
||||
- name: ANALYTICS_SERVICE_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: ANALYTICS_SERVICE_TOKEN
|
||||
name: console-secrets
|
||||
optional: true
|
||||
- name: INSIGHTS_API_URL
|
||||
value: http://insights-web.hanzo.svc:8000
|
||||
- name: INSIGHTS_SERVICE_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: INSIGHTS_SERVICE_TOKEN
|
||||
name: console-secrets
|
||||
optional: true
|
||||
- name: NEXT_PUBLIC_HANZO_RUN_NEXT_INIT
|
||||
value: 'false'
|
||||
resources:
|
||||
limits:
|
||||
cpu: '1'
|
||||
memory: 1Gi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
volumeMounts:
|
||||
- mountPath: /data
|
||||
name: data
|
||||
livenessProbe:
|
||||
failureThreshold: 6
|
||||
httpGet:
|
||||
path: /api/public/ready
|
||||
port: http
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 300
|
||||
periodSeconds: 30
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /api/public/ready
|
||||
port: http
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
startupProbe:
|
||||
failureThreshold: 60
|
||||
httpGet:
|
||||
path: /api/public/ready
|
||||
port: http
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1001
|
||||
ports:
|
||||
- containerPort: 4000
|
||||
name: http
|
||||
servicePort: 80
|
||||
volumes:
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: console-data
|
||||
imagePullSecrets:
|
||||
- name: ghcr-secret
|
||||
fsGroup: 1001
|
||||
strategy: Recreate
|
||||
topologySpread:
|
||||
enabled: false
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- sleep 15
|
||||
terminationGracePeriodSeconds: 45
|
||||
# Live runs this pod with these settings and the chart renders only fsGroup
|
||||
# unless podSecurityContext is set, so omitting them is a silent drop to uid 0
|
||||
# (or to seccomp Unconfined) on the first server-side sync.
|
||||
podSecurityContext:
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
@@ -1,76 +0,0 @@
|
||||
# Generated from the live hanzo/hanzo-login Deployment on do-sfo3-lux-k8s
|
||||
# by hack/live2values.py. Live is the source: a repo of hand-applied
|
||||
# manifests has unknown currency, the running fleet does not.
|
||||
replicas: 2
|
||||
selectorLabels:
|
||||
app: hanzo-login
|
||||
image:
|
||||
repository: ghcr.io/hanzoai/login
|
||||
tag: 1.1.6
|
||||
pullPolicy: Always
|
||||
partOf: hanzo-universe
|
||||
env:
|
||||
- name: IAM_ORIGIN
|
||||
value: https://iam.hanzo.ai
|
||||
- name: NEXT_PUBLIC_IAM_URL
|
||||
value: https://iam.hanzo.ai
|
||||
- name: NEXT_PUBLIC_ORG
|
||||
value: hanzo
|
||||
- name: NEXT_PUBLIC_CLIENT_ID
|
||||
value: app-hanzo
|
||||
- name: NEXT_PUBLIC_ANALYTICS_URL
|
||||
value: https://analytics.hanzo.ai/script.js
|
||||
- name: NEXT_PUBLIC_ANALYTICS_SITE_ID
|
||||
value: 9c0befac-aba7-4dcb-b350-c348f7a89b01
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 256Mi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 128Mi
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /login
|
||||
port: 3000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 30
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /login
|
||||
port: 3000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
servicePort: 80
|
||||
imagePullSecrets:
|
||||
- name: ghcr-secret
|
||||
rollingUpdate:
|
||||
maxSurge: 1
|
||||
maxUnavailable: 0
|
||||
topologySpread:
|
||||
enabled: false
|
||||
lifecycle: null
|
||||
terminationGracePeriodSeconds: 30
|
||||
ingress:
|
||||
enabled: true
|
||||
hosts:
|
||||
- id.pars.network
|
||||
- id.lux-dev.network
|
||||
- id.lux-test.network
|
||||
- id.hanzo.network
|
||||
- id.hanzo-dev.network
|
||||
- id.hanzo-test.network
|
||||
- id.zoo-dev.network
|
||||
- id.zoo-test.network
|
||||
tls: true
|
||||
className: ingress
|
||||
@@ -1,167 +0,0 @@
|
||||
# Generated from the live hanzo/iam Deployment on do-sfo3-lux-k8s
|
||||
# by hack/live2values.py. Live is the source: a repo of hand-applied
|
||||
# manifests has unknown currency, the running fleet does not.
|
||||
replicas: 1
|
||||
selectorLabels:
|
||||
app: iam
|
||||
image:
|
||||
repository: ghcr.io/hanzoai/iam
|
||||
# Identity for id.hanzo.network, id.lux.cloud, id.pars.network and the zoo
|
||||
# networks all resolve to this one deployment, so it is the estate's shared
|
||||
# login plane and it sat nineteen minor versions behind.
|
||||
#
|
||||
# v1.33.38 is the newest git tag and has NO image — ghcr 404s it, the same
|
||||
# tagged-but-never-built gap that left luxfi/node v1.36.38/39/41 and
|
||||
# hanzoai/git v1.26.29 without artifacts. v1.33.24 is the newest tag that
|
||||
# actually built, verified present before being written here.
|
||||
tag: v1.33.24
|
||||
pullPolicy: Always
|
||||
partOf: hanzo-universe
|
||||
component: iam
|
||||
env:
|
||||
- name: GOOGLE_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: GOOGLE_CLIENT_ID
|
||||
name: iam-provider-creds
|
||||
optional: true
|
||||
- name: GOOGLE_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: GOOGLE_CLIENT_SECRET
|
||||
name: iam-provider-creds
|
||||
optional: true
|
||||
- name: GITHUB_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: GITHUB_CLIENT_ID
|
||||
name: iam-provider-creds
|
||||
optional: true
|
||||
- name: GITHUB_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: GITHUB_CLIENT_SECRET
|
||||
name: iam-provider-creds
|
||||
optional: true
|
||||
- name: GOMEMLIMIT
|
||||
value: 3750MiB
|
||||
- name: GOMAXPROCS
|
||||
value: '2'
|
||||
- name: REGISTRY_SIGNING_KEY_FILE
|
||||
value: /etc/registry-signing/signing.key
|
||||
- name: redisEndpoint
|
||||
value: hanzo-kv:6379
|
||||
- name: INSIGHTS_HOST
|
||||
value: http://insights-capture.hanzo.svc:3000
|
||||
- name: INSIGHTS_API_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: API_KEY
|
||||
name: insights-client-secrets
|
||||
optional: true
|
||||
- name: IAM_DATABASE_URL
|
||||
# Read from a secret, like every other credential in this file. It was
|
||||
# written here in the clear because this file is generated from the live
|
||||
# Deployment and the live Deployment carries it in the clear — so the value
|
||||
# in git is a copy of the exposure, not the exposure itself. Both need
|
||||
# fixing, and the credential needs ROTATING: it is in this repository's
|
||||
# history, where removing a line does not reach.
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: IAM_DATABASE_URL
|
||||
name: iam-db
|
||||
resources:
|
||||
limits:
|
||||
cpu: '2'
|
||||
memory: 4Gi
|
||||
requests:
|
||||
cpu: 200m
|
||||
memory: 1Gi
|
||||
volumeMounts:
|
||||
- mountPath: /data/iam
|
||||
name: iam-data
|
||||
- mountPath: /etc/registry-signing
|
||||
name: registry-signing-key
|
||||
readOnly: true
|
||||
- mountPath: /etc/kms/auth
|
||||
name: kms-auth
|
||||
readOnly: true
|
||||
- mountPath: /etc/iam-init-data
|
||||
name: init-data
|
||||
readOnly: true
|
||||
- mountPath: /conf
|
||||
name: iam-conf
|
||||
readOnly: true
|
||||
livenessProbe:
|
||||
failureThreshold: 5
|
||||
httpGet:
|
||||
path: /api/health
|
||||
port: 8000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 30
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 10
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /api/health
|
||||
port: 8000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
ports:
|
||||
- containerPort: 8000
|
||||
name: http
|
||||
servicePort: 80
|
||||
volumes:
|
||||
- name: iam-data
|
||||
- name: registry-signing-key
|
||||
secret:
|
||||
items:
|
||||
- key: SIGNING_KEY
|
||||
path: signing.key
|
||||
secretName: registry-signing-key
|
||||
- name: kms-auth
|
||||
secret:
|
||||
items:
|
||||
- key: CLIENTID
|
||||
path: clientId
|
||||
optional: true
|
||||
secretName: iam-kms-auth
|
||||
- configMap:
|
||||
name: iam-init-data
|
||||
name: init-data
|
||||
- configMap:
|
||||
items:
|
||||
- key: app.prod.conf
|
||||
path: app.conf
|
||||
name: iam-conf
|
||||
name: iam-conf
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- podAffinityTerm:
|
||||
labelSelector:
|
||||
matchExpressions:
|
||||
- key: app
|
||||
operator: In
|
||||
values:
|
||||
- iam
|
||||
topologyKey: kubernetes.io/hostname
|
||||
weight: 100
|
||||
fsGroup: 1000
|
||||
strategy: Recreate
|
||||
topologySpread:
|
||||
enabled: false
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- sleep 5
|
||||
terminationGracePeriodSeconds: 45
|
||||
imagePullSecrets: []
|
||||
@@ -53,4 +53,4 @@ terminationGracePeriodSeconds: 30
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
@@ -1,68 +0,0 @@
|
||||
# Generated from the live hanzo/lux-bitcoin Deployment on do-sfo3-lux-k8s
|
||||
# by hack/live2values.py. Live is the source: a repo of hand-applied
|
||||
# manifests has unknown currency, the running fleet does not.
|
||||
replicas: 2
|
||||
selectorLabels:
|
||||
app: lux-bitcoin
|
||||
containerName: spa
|
||||
image:
|
||||
repository: ghcr.io/luxfi/lux-bitcoin
|
||||
tag: v2.0.0
|
||||
pullPolicy: Always
|
||||
partOf: lux-bitcoin
|
||||
env:
|
||||
- name: PORT
|
||||
value: '3000'
|
||||
- name: ROOT
|
||||
value: /public
|
||||
resources:
|
||||
limits:
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 32Mi
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /health
|
||||
port: 3000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 30
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /
|
||||
port: 3000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 3
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: http
|
||||
servicePort: 80
|
||||
imagePullSecrets:
|
||||
- name: ghcr-secret
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 25%
|
||||
topologySpread:
|
||||
enabled: false
|
||||
lifecycle: null
|
||||
terminationGracePeriodSeconds: 30
|
||||
ingress:
|
||||
enabled: true
|
||||
hosts:
|
||||
- bitcoin.lux.network
|
||||
tls: true
|
||||
className: ingress
|
||||
|
||||
# Enforcement switch, read by the lux-fleet ApplicationSet's templatePatch --
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
cd:
|
||||
automated: true
|
||||
@@ -9,6 +9,11 @@ image:
|
||||
repository: ghcr.io/luxfi/blog
|
||||
digest: sha256:972764b37d73bd81cbce4301457890580cf42c969258d31bd7b6d4d7a7b7e18e
|
||||
pullPolicy: Always
|
||||
# That digest resolves to ONE manifest, linux/amd64. Stating it here is a fact
|
||||
# about the bytes, not a placement preference: an all-amd64 cluster is unchanged,
|
||||
# and a mixed one stops binding this pod to a node that cannot run it.
|
||||
nodeSelector:
|
||||
kubernetes.io/arch: amd64
|
||||
partOf: lux-blog
|
||||
env:
|
||||
- name: PORT
|
||||
@@ -66,4 +71,4 @@ ingress:
|
||||
# applies nothing today; what it adds is selfHeal, which returns a
|
||||
# hand-edited object to what is written here. prune stays off.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
@@ -1,68 +0,0 @@
|
||||
# Generated from the live hanzo/lux-coin Deployment on do-sfo3-lux-k8s
|
||||
# by hack/live2values.py. Live is the source: a repo of hand-applied
|
||||
# manifests has unknown currency, the running fleet does not.
|
||||
replicas: 2
|
||||
selectorLabels:
|
||||
app: lux-coin
|
||||
containerName: spa
|
||||
image:
|
||||
repository: ghcr.io/luxfi/lux-coin
|
||||
tag: v2.0.0
|
||||
pullPolicy: Always
|
||||
partOf: lux-coin
|
||||
env:
|
||||
- name: PORT
|
||||
value: '3000'
|
||||
- name: ROOT
|
||||
value: /public
|
||||
resources:
|
||||
limits:
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 32Mi
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /health
|
||||
port: 3000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 30
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /
|
||||
port: 3000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 3
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: http
|
||||
servicePort: 80
|
||||
imagePullSecrets:
|
||||
- name: ghcr-secret
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 25%
|
||||
topologySpread:
|
||||
enabled: false
|
||||
lifecycle: null
|
||||
terminationGracePeriodSeconds: 30
|
||||
ingress:
|
||||
enabled: true
|
||||
hosts:
|
||||
- coin.lux.network
|
||||
tls: true
|
||||
className: ingress
|
||||
|
||||
# Enforcement switch, read by the lux-fleet ApplicationSet's templatePatch --
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
cd:
|
||||
automated: true
|
||||
@@ -1,74 +0,0 @@
|
||||
# Generated from the live hanzo/lux-finance Deployment on do-sfo3-lux-k8s
|
||||
# by hack/live2values.py. Live is the source: a repo of hand-applied
|
||||
# manifests has unknown currency, the running fleet does not.
|
||||
replicas: 2
|
||||
selectorLabels:
|
||||
app: lux-finance
|
||||
containerName: spa
|
||||
image:
|
||||
repository: ghcr.io/luxfi/lux-finance
|
||||
tag: v2.0.0
|
||||
pullPolicy: Always
|
||||
partOf: lux-finance
|
||||
env:
|
||||
- name: PORT
|
||||
value: '3000'
|
||||
- name: ROOT
|
||||
value: /public
|
||||
resources:
|
||||
limits:
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 32Mi
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 3000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 30
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /
|
||||
port: 3000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 3
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: http
|
||||
servicePort: 80
|
||||
imagePullSecrets:
|
||||
- name: ghcr-secret
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 25%
|
||||
topologySpread:
|
||||
enabled: false
|
||||
lifecycle: null
|
||||
terminationGracePeriodSeconds: 30
|
||||
# lux.finance belongs to bank-dash. Two Ingresses claimed this host — this one
|
||||
# and k8s/lux-k8s/bank-dash/ingress.yaml — and a host with two claims goes to
|
||||
# whichever was admitted first, so bank-dash's claim has been dead on arrival
|
||||
# and the apex has been serving the standalone Liquid page instead of the app.
|
||||
# The Liquid story now lives in bank-dash's own landing, so this surface has
|
||||
# nothing left to serve. Once the apex is confirmed on bank-dash, delete this
|
||||
# file and the app with it.
|
||||
ingress:
|
||||
enabled: false
|
||||
hosts: []
|
||||
tls: true
|
||||
className: ingress
|
||||
|
||||
# Enforcement switch, read by the lux-fleet ApplicationSet's templatePatch --
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
cd:
|
||||
automated: true
|
||||
@@ -1,69 +0,0 @@
|
||||
# Generated from the live hanzo/lux-industries Deployment on do-sfo3-lux-k8s
|
||||
# by hack/live2values.py. Live is the source: a repo of hand-applied
|
||||
# manifests has unknown currency, the running fleet does not.
|
||||
replicas: 2
|
||||
selectorLabels:
|
||||
app: lux-industries
|
||||
containerName: spa
|
||||
image:
|
||||
repository: ghcr.io/luxfi/lux-industries
|
||||
tag: v2.0.0
|
||||
pullPolicy: Always
|
||||
partOf: lux-industries
|
||||
env:
|
||||
- name: PORT
|
||||
value: '3000'
|
||||
- name: ROOT
|
||||
value: /public
|
||||
resources:
|
||||
limits:
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 32Mi
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /health
|
||||
port: 3000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 30
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /
|
||||
port: 3000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 3
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: http
|
||||
servicePort: 80
|
||||
imagePullSecrets:
|
||||
- name: ghcr-secret
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 25%
|
||||
topologySpread:
|
||||
enabled: false
|
||||
lifecycle: null
|
||||
terminationGracePeriodSeconds: 30
|
||||
ingress:
|
||||
enabled: true
|
||||
hosts:
|
||||
- lux.industries
|
||||
- www.lux.industries
|
||||
tls: true
|
||||
className: ingress
|
||||
|
||||
# Enforcement switch, read by the lux-fleet ApplicationSet's templatePatch --
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
cd:
|
||||
automated: true
|
||||
@@ -65,4 +65,4 @@ ingress:
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
@@ -1,69 +0,0 @@
|
||||
# Generated from the live hanzo/lux-market Deployment on do-sfo3-lux-k8s
|
||||
# by hack/live2values.py. Live is the source: a repo of hand-applied
|
||||
# manifests has unknown currency, the running fleet does not.
|
||||
replicas: 2
|
||||
selectorLabels:
|
||||
app: lux-market
|
||||
containerName: spa
|
||||
image:
|
||||
repository: ghcr.io/luxfi/lux-market
|
||||
tag: v2.0.0
|
||||
pullPolicy: Always
|
||||
partOf: lux-market
|
||||
env:
|
||||
- name: PORT
|
||||
value: '3000'
|
||||
- name: ROOT
|
||||
value: /public
|
||||
resources:
|
||||
limits:
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 32Mi
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /health
|
||||
port: 3000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 30
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /
|
||||
port: 3000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 3
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: http
|
||||
servicePort: 80
|
||||
imagePullSecrets:
|
||||
- name: ghcr-secret
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 25%
|
||||
topologySpread:
|
||||
enabled: false
|
||||
lifecycle: null
|
||||
terminationGracePeriodSeconds: 30
|
||||
ingress:
|
||||
enabled: true
|
||||
hosts:
|
||||
- lux.market
|
||||
- www.lux.market
|
||||
tls: true
|
||||
className: ingress
|
||||
|
||||
# Enforcement switch, read by the lux-fleet ApplicationSet's templatePatch --
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
cd:
|
||||
automated: true
|
||||
@@ -4,7 +4,7 @@
|
||||
# sync. prune stays off (the chart is not the only owner of objects in the
|
||||
# namespace); selfHeal returns a hand-edited Deployment to what is written here.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
replicas: 2
|
||||
selectorLabels:
|
||||
|
||||
@@ -1,65 +0,0 @@
|
||||
# CD applies this file within ~90s, so THIS is the source now, not the cluster.
|
||||
# Without this the app is manual-sync: the gateway ran v0.1.2 for weeks while
|
||||
# this file said v0.1.5, and nothing was wrong except that nobody had pressed
|
||||
# sync. prune stays off (the chart is not the only owner of objects in the
|
||||
# namespace); selfHeal returns a hand-edited Deployment to what is written here.
|
||||
cd:
|
||||
automated: true
|
||||
|
||||
replicas: 2
|
||||
selectorLabels:
|
||||
app: lux-safe
|
||||
containerName: spa
|
||||
image:
|
||||
repository: ghcr.io/luxfi/safe
|
||||
tag: v2.2.14
|
||||
pullPolicy: Always
|
||||
partOf: lux-safe
|
||||
env:
|
||||
- name: PORT
|
||||
value: '3000'
|
||||
resources:
|
||||
limits:
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 32Mi
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /
|
||||
port: 3000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 30
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /
|
||||
port: 3000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 3
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: http
|
||||
servicePort: 80
|
||||
imagePullSecrets:
|
||||
- name: ghcr-secret
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 25%
|
||||
topologySpread:
|
||||
enabled: false
|
||||
lifecycle: null
|
||||
terminationGracePeriodSeconds: 30
|
||||
ingress:
|
||||
enabled: true
|
||||
hosts:
|
||||
- safe.lux.network
|
||||
tls: true
|
||||
className: ingress
|
||||
@@ -1,72 +1,32 @@
|
||||
# Generated from the live lux-audio/lux-audio Deployment on do-sfo3-lux-k8s
|
||||
# by hack/live2values.py. Live is the source: a repo of hand-applied
|
||||
# manifests has unknown currency, the running fleet does not.
|
||||
replicas: 2
|
||||
selectorLabels:
|
||||
app.kubernetes.io/name: lux-audio
|
||||
containerName: spa
|
||||
image:
|
||||
repository: ghcr.io/luxfi/audio
|
||||
tag: latest
|
||||
digest: sha256:48265c37c91f34663479bdebdbf1d1e9ca6d07aec912d5846c4882b6d564f962
|
||||
pullPolicy: IfNotPresent
|
||||
partOf: lux-audio
|
||||
env:
|
||||
- name: PORT
|
||||
value: '3000'
|
||||
- name: ROOT
|
||||
value: /public
|
||||
- name: REDIRECTS
|
||||
value: /earbuds=/,/earphones=/
|
||||
resources:
|
||||
limits:
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 32Mi
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /health
|
||||
port: 3000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 30
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /health
|
||||
port: 3000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 3
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: http
|
||||
servicePort: 80
|
||||
imagePullSecrets:
|
||||
- name: ghcr-pull
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 25%
|
||||
topologySpread:
|
||||
enabled: false
|
||||
lifecycle: null
|
||||
terminationGracePeriodSeconds: 30
|
||||
ingress:
|
||||
enabled: true
|
||||
hosts:
|
||||
- lux.audio
|
||||
- www.lux.audio
|
||||
tls: true
|
||||
className: ingress
|
||||
|
||||
# Enforcement switch, read by the lux-fleet ApplicationSet's templatePatch --
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
# lux.audio is files: one Middleware that serves them, one route that names it,
|
||||
# and the endpoint-less Service the route schema requires. No image, so the
|
||||
# chart renders no Deployment -- a static site is not a pod.
|
||||
cd:
|
||||
automated: true
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
middlewares:
|
||||
- name: audio
|
||||
spec:
|
||||
staticFiles:
|
||||
root: /var/www/audio
|
||||
spaMode: true
|
||||
spaIndex: index.html
|
||||
indexFiles:
|
||||
- index.html
|
||||
routes:
|
||||
- name: audio
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`lux.audio`) || Host(`www.lux.audio`)
|
||||
kind: Rule
|
||||
priority: 100
|
||||
middlewares:
|
||||
- name: audio
|
||||
services:
|
||||
- name: lux-audio
|
||||
port: 80
|
||||
tls: {}
|
||||
|
||||
@@ -53,4 +53,4 @@ terminationGracePeriodSeconds: 30
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
@@ -8,6 +8,11 @@ image:
|
||||
repository: ghcr.io/luxfi/bank-dash
|
||||
tag: v1.0.12
|
||||
pullPolicy: Always
|
||||
# One manifest under that tag, linux/amd64 — a property of the image, so it is
|
||||
# written beside it. Selects every node of an all-amd64 cluster; on a mixed one
|
||||
# it keeps the pod off the node with no manifest to run.
|
||||
nodeSelector:
|
||||
kubernetes.io/arch: amd64
|
||||
partOf: lux-bank
|
||||
env:
|
||||
- name: NEXT_PUBLIC_BASE_URL
|
||||
@@ -69,4 +74,4 @@ terminationGracePeriodSeconds: 30
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
@@ -8,6 +8,11 @@ image:
|
||||
repository: ghcr.io/luxfi/bank
|
||||
tag: v1.0.11
|
||||
pullPolicy: IfNotPresent
|
||||
# One manifest under that tag, linux/amd64 — stated beside the image because it
|
||||
# describes the bytes. A cluster that is all amd64 is unaffected; a mixed one
|
||||
# stops scheduling this onto a node that cannot run it.
|
||||
nodeSelector:
|
||||
kubernetes.io/arch: amd64
|
||||
command:
|
||||
- bankd
|
||||
args:
|
||||
@@ -60,6 +65,22 @@ ports:
|
||||
- containerPort: 8070
|
||||
name: http
|
||||
servicePort: 80
|
||||
# The volume bankd keeps its ledger on. It was the one object live2values.py
|
||||
# could not see — it reads the Deployment, and a claim a Deployment merely MOUNTS
|
||||
# is not part of it — so the values described a pod that names a volume nobody
|
||||
# declares, and the scheduler refuses such a pod outright: no node is available,
|
||||
# forever, with no image ever pulled. 20Gi RWO is what k8s/lux-k8s/bankd carried
|
||||
# before that directory was superseded.
|
||||
#
|
||||
# No storageClass on purpose. Naming one binds this file to one cluster's
|
||||
# provisioner; omitting it takes the cluster's default, which is the block class
|
||||
# in the cloud and local-path on k3s. Same text, both places. The spec is
|
||||
# immutable once bound, so this is a statement made at creation and never edited.
|
||||
claims:
|
||||
- name: bankd-data
|
||||
size: 20Gi
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
volumes:
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
|
||||
@@ -7,7 +7,11 @@ selectorLabels:
|
||||
containerName: spa
|
||||
image:
|
||||
repository: ghcr.io/luxfi/lux-financial
|
||||
# v1.5.5 was declared on 2026-09-01 and never published: the registry's newest
|
||||
# tag is v1.5.3. A pin names an image the registry has, so this is v1.5.3 with
|
||||
# the digest that tag resolves to.
|
||||
tag: v1.5.3
|
||||
digest: sha256:762ffc430238e7ffcf4ff7ae20330ede39dca03acd0e6ee8ab56b0f0955ac913
|
||||
pullPolicy: Always
|
||||
partOf: lux-financial
|
||||
env:
|
||||
@@ -66,4 +70,4 @@ ingress:
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
@@ -0,0 +1,32 @@
|
||||
# bitcoin.lux.network is files: one Middleware that serves them, one route that names it,
|
||||
# and the endpoint-less Service the route schema requires. No image, so the
|
||||
# chart renders no Deployment -- a static site is not a pod.
|
||||
cd:
|
||||
automated: true
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
middlewares:
|
||||
- name: bitcoin
|
||||
spec:
|
||||
staticFiles:
|
||||
root: /var/www/bitcoin
|
||||
spaMode: true
|
||||
spaIndex: index.html
|
||||
indexFiles:
|
||||
- index.html
|
||||
routes:
|
||||
- name: bitcoin
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`bitcoin.lux.network`)
|
||||
kind: Rule
|
||||
priority: 100
|
||||
middlewares:
|
||||
- name: bitcoin
|
||||
services:
|
||||
- name: lux-bitcoin
|
||||
port: 80
|
||||
tls: {}
|
||||
@@ -107,4 +107,4 @@ livenessProbe:
|
||||
# applies nothing today; what it adds is selfHeal, which returns a
|
||||
# hand-edited object to what is written here. prune stays off.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
@@ -48,4 +48,4 @@ imagePullSecrets: []
|
||||
# applies nothing today; what it adds is selfHeal, which returns a
|
||||
# hand-edited object to what is written here. prune stays off.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
@@ -48,4 +48,4 @@ imagePullSecrets: []
|
||||
# applies nothing today; what it adds is selfHeal, which returns a
|
||||
# hand-edited object to what is written here. prune stays off.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
@@ -53,4 +53,4 @@ imagePullSecrets: []
|
||||
# applies nothing today; what it adds is selfHeal, which returns a
|
||||
# hand-edited object to what is written here. prune stays off.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
@@ -120,4 +120,4 @@ imagePullSecrets: []
|
||||
# against the running Deployment differs in exactly one field, HANZO_VERSION,
|
||||
# which the chart injects from the tag. prune stays off.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
@@ -0,0 +1,32 @@
|
||||
# lux.cash is files: one Middleware that serves them, one route that names it,
|
||||
# and the endpoint-less Service the route schema requires. No image, so the
|
||||
# chart renders no Deployment -- a static site is not a pod.
|
||||
cd:
|
||||
automated: true
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
middlewares:
|
||||
- name: cash
|
||||
spec:
|
||||
staticFiles:
|
||||
root: /var/www/cash
|
||||
spaMode: true
|
||||
spaIndex: index.html
|
||||
indexFiles:
|
||||
- index.html
|
||||
routes:
|
||||
- name: cash
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`lux.cash`) || Host(`www.lux.cash`)
|
||||
kind: Rule
|
||||
priority: 100
|
||||
middlewares:
|
||||
- name: cash
|
||||
services:
|
||||
- name: lux-cash
|
||||
port: 80
|
||||
tls: {}
|
||||
+30
-86
@@ -1,88 +1,32 @@
|
||||
# Generated from the live lux-cloud/cloud Deployment on do-sfo3-lux-k8s
|
||||
# by hack/live2values.py. Live is the source: a repo of hand-applied
|
||||
# manifests has unknown currency, the running fleet does not.
|
||||
replicas: 2
|
||||
selectorLabels:
|
||||
app: cloud
|
||||
image:
|
||||
repository: ghcr.io/luxfi/cloud-web
|
||||
tag: v1.5.34
|
||||
# v1.5.27 and its predecessor served a bundle that was NOT built from their
|
||||
# source: apps/web/dist travelled into the build context, so whatever was
|
||||
# last built on a laptop could reach the image. v1.5.28 is the first build
|
||||
# with only the source in the context, and it carries the validator set that
|
||||
# anyone -- signed in or not -- can now see.
|
||||
#
|
||||
# v1.5.31 added the Traffic view, which reads whether a network is building and
|
||||
# what its generator's account is doing ON the chain rather than asking the
|
||||
# generator, since a generator reports every send a success whether or not the
|
||||
# chain can ever run it.
|
||||
#
|
||||
# v1.5.32 (revision a1a2c6f, the first git-tagged Release-workflow build of the
|
||||
# landing polish) gives the hero an ambient aurora, stops the logo from
|
||||
# auto-erasing its wordmark, and lifts the feature cards. Verified by crane:
|
||||
# the built CSS carries `.hero::before` + `@keyframes heroDrift`, which the
|
||||
# deployed v1.5.31 lacked. It is a superset of v1.5.31 (Traffic view included).
|
||||
#
|
||||
# The tag is how a human says it; the digest is what the kubelet obeys.
|
||||
digest: sha256:54a586fbd4d6233b671ecd53ffc29b36c87821850695ea5f8741f9dccd08c97f
|
||||
pullPolicy: Always
|
||||
partOf: lux-cloud
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 256Mi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 64Mi
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /health
|
||||
port: 3000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 30
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /health
|
||||
port: 3000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 3
|
||||
periodSeconds: 5
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: http
|
||||
servicePort: 80
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 25%
|
||||
topologySpread:
|
||||
enabled: false
|
||||
lifecycle: null
|
||||
terminationGracePeriodSeconds: 30
|
||||
imagePullSecrets:
|
||||
- name: ghcr-secret
|
||||
ingress:
|
||||
enabled: true
|
||||
hosts:
|
||||
- lux.cloud
|
||||
- www.lux.cloud
|
||||
tls: true
|
||||
# The live certificate lives in this Secret. The chart would default to
|
||||
# <release>-tls, and cert-manager would then issue into a NEW empty Secret
|
||||
# while the host serves no cert at all until it succeeds.
|
||||
secretName: cloud-lux-tls
|
||||
className: ingress
|
||||
|
||||
# Enforcement switch, read by the lux-fleet ApplicationSet's templatePatch —
|
||||
# not by the chart. On while this Application already read Synced, so it
|
||||
# applies nothing today; what it adds is selfHeal, which returns a
|
||||
# hand-edited object to what is written here. prune stays off.
|
||||
# lux.cloud is files: one Middleware that serves them, one route that names it,
|
||||
# and the endpoint-less Service the route schema requires. No image, so the
|
||||
# chart renders no Deployment -- a static site is not a pod.
|
||||
cd:
|
||||
automated: true
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
middlewares:
|
||||
- name: cloud
|
||||
spec:
|
||||
staticFiles:
|
||||
root: /var/www/cloud
|
||||
spaMode: true
|
||||
spaIndex: index.html
|
||||
indexFiles:
|
||||
- index.html
|
||||
routes:
|
||||
- name: cloud
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`lux.cloud`) || Host(`www.lux.cloud`)
|
||||
kind: Rule
|
||||
priority: 100
|
||||
middlewares:
|
||||
- name: cloud
|
||||
services:
|
||||
- name: cloud
|
||||
port: 80
|
||||
tls: {}
|
||||
|
||||
@@ -31,7 +31,7 @@
|
||||
# prune: false, selfHeal: true), so CD converges this service and never deletes
|
||||
# anything it did not create.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
replicas: 2
|
||||
selectorLabels:
|
||||
|
||||
@@ -0,0 +1,32 @@
|
||||
# coin.lux.network is files: one Middleware that serves them, one route that names it,
|
||||
# and the endpoint-less Service the route schema requires. No image, so the
|
||||
# chart renders no Deployment -- a static site is not a pod.
|
||||
cd:
|
||||
automated: true
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
middlewares:
|
||||
- name: coin
|
||||
spec:
|
||||
staticFiles:
|
||||
root: /var/www/coin
|
||||
spaMode: true
|
||||
spaIndex: index.html
|
||||
indexFiles:
|
||||
- index.html
|
||||
routes:
|
||||
- name: coin
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`coin.lux.network`)
|
||||
kind: Rule
|
||||
priority: 100
|
||||
middlewares:
|
||||
- name: coin
|
||||
services:
|
||||
- name: lux-coin
|
||||
port: 80
|
||||
tls: {}
|
||||
@@ -1,43 +1,30 @@
|
||||
# Generated from the live lux-credit/lux-credit Deployment on do-sfo3-lux-k8s
|
||||
# by hack/live2values.py. Live is the source: a repo of hand-applied
|
||||
# manifests has unknown currency, the running fleet does not.
|
||||
replicas: 2
|
||||
selectorLabels:
|
||||
app.kubernetes.io/name: lux-credit
|
||||
image:
|
||||
repository: ghcr.io/lux-apps/credit
|
||||
tag: 36b1c2dffd62620600ae4912d73798d8b01e9384
|
||||
pullPolicy: Always
|
||||
env:
|
||||
- name: PORT
|
||||
value: '3000'
|
||||
- name: ROOT
|
||||
value: /public
|
||||
resources: {}
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: http
|
||||
servicePort: 80
|
||||
imagePullSecrets:
|
||||
- name: ghcr-pull
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 25%
|
||||
topologySpread:
|
||||
enabled: false
|
||||
lifecycle: null
|
||||
terminationGracePeriodSeconds: 30
|
||||
defaultReadinessProbe: false
|
||||
ingress:
|
||||
enabled: true
|
||||
hosts:
|
||||
- lux.credit
|
||||
- www.lux.credit
|
||||
tls: true
|
||||
className: ingress
|
||||
|
||||
# Enforcement switch, read by the lux-fleet ApplicationSet's templatePatch --
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
# lux.credit is files: one Middleware that serves them, one route that names it,
|
||||
# and the endpoint-less Service the route schema insists on. No image, so the
|
||||
# chart renders no Deployment -- a static site is not a pod.
|
||||
cd:
|
||||
automated: true
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
middlewares:
|
||||
- name: credit
|
||||
spec:
|
||||
staticFiles:
|
||||
root: /var/www/credit
|
||||
spaMode: true
|
||||
spaIndex: index.html
|
||||
indexFiles: [index.html]
|
||||
routes:
|
||||
- name: credit
|
||||
spec:
|
||||
entryPoints: [websecure]
|
||||
routes:
|
||||
- match: Host(`lux.credit`) || Host(`www.lux.credit`)
|
||||
kind: Rule
|
||||
priority: 100
|
||||
middlewares:
|
||||
- name: credit
|
||||
services:
|
||||
- name: lux-credit
|
||||
port: 80
|
||||
tls: {}
|
||||
|
||||
@@ -65,4 +65,4 @@ terminationGracePeriodSeconds: 30
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
@@ -81,4 +81,4 @@ terminationGracePeriodSeconds: 30
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
@@ -81,4 +81,4 @@ terminationGracePeriodSeconds: 30
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
@@ -81,4 +81,4 @@ terminationGracePeriodSeconds: 30
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
@@ -81,4 +81,4 @@ terminationGracePeriodSeconds: 30
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
@@ -61,4 +61,4 @@ imagePullSecrets: []
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
@@ -74,4 +74,4 @@ imagePullSecrets: []
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
@@ -59,4 +59,4 @@ volumes:
|
||||
# applies nothing today; what it adds is selfHeal, which returns a
|
||||
# hand-edited object to what is written here. prune stays off.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
@@ -0,0 +1,32 @@
|
||||
# lux.exchange is files: one Middleware that serves them, one route that names it,
|
||||
# and the endpoint-less Service the route schema requires. No image, so the
|
||||
# chart renders no Deployment -- a static site is not a pod.
|
||||
cd:
|
||||
automated: true
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
middlewares:
|
||||
- name: exchange
|
||||
spec:
|
||||
staticFiles:
|
||||
root: s3://hanzo-sites/lux/lux-exchange
|
||||
spaMode: true
|
||||
spaIndex: index.html
|
||||
indexFiles:
|
||||
- index.html
|
||||
routes:
|
||||
- name: exchange
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`lux.exchange`) || Host(`www.lux.exchange`)
|
||||
kind: Rule
|
||||
priority: 100
|
||||
middlewares:
|
||||
- name: exchange
|
||||
services:
|
||||
- name: lux-exchange
|
||||
port: 80
|
||||
tls: {}
|
||||
@@ -6,11 +6,6 @@ selectorLabels:
|
||||
app: lux-faucet
|
||||
containerName: faucet
|
||||
image:
|
||||
# A repository names a PATH, so the version comes out of it. Written as
|
||||
# `ghcr.io/luxfi/faucet:v1.0.1` the chart's suffix match never fired and the
|
||||
# reference assembled as `…faucet:v1.0.1@sha256:325a…` only by accident of
|
||||
# string concatenation; every check that reads image.tag saw nothing at all.
|
||||
# The digest below is the one v1.0.1 resolves to, confirmed against ghcr.
|
||||
repository: ghcr.io/luxfi/faucet
|
||||
tag: v1.0.1
|
||||
digest: sha256:325a83ccdf406459cdce870a8d2fd1c8d34c274811fa77568b0bf92905e68e56
|
||||
@@ -87,4 +82,4 @@ ingress:
|
||||
# applies nothing today; what it adds is selfHeal, which returns a
|
||||
# hand-edited object to what is written here. prune stays off.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
@@ -0,0 +1,32 @@
|
||||
# lux.finance is files: one Middleware that serves them, one route that names it,
|
||||
# and the endpoint-less Service the route schema requires. No image, so the
|
||||
# chart renders no Deployment -- a static site is not a pod.
|
||||
cd:
|
||||
automated: true
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
middlewares:
|
||||
- name: finance
|
||||
spec:
|
||||
staticFiles:
|
||||
root: /var/www/finance
|
||||
spaMode: true
|
||||
spaIndex: index.html
|
||||
indexFiles:
|
||||
- index.html
|
||||
routes:
|
||||
- name: finance
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`lux.finance`) || Host(`www.lux.finance`)
|
||||
kind: Rule
|
||||
priority: 100
|
||||
middlewares:
|
||||
- name: finance
|
||||
services:
|
||||
- name: lux-finance
|
||||
port: 80
|
||||
tls: {}
|
||||
@@ -41,4 +41,4 @@ ingress:
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
@@ -1,66 +1,32 @@
|
||||
# Was generated from the live lux-fund/lux-fund Deployment on do-sfo3-lux-k8s
|
||||
# by hack/live2values.py, on the principle that live is the source because a
|
||||
# repo of hand-applied manifests has unknown currency and a running fleet does
|
||||
# not.
|
||||
#
|
||||
# That premise no longer holds. The DigitalOcean account is suspended and the
|
||||
# estate moved to the evo/spark cluster, where lux-fund has no namespace and
|
||||
# nothing reconciles this file — there is no ApplicationSet there. So live is
|
||||
# not a source any more; it is an outage, and this file is the only statement of
|
||||
# what lux.fund should run.
|
||||
#
|
||||
# Which makes the tag below the thing that matters. It named
|
||||
# c30add15 — the image built on 22 July — while every change since has built and
|
||||
# published and gone nowhere. It names the current one now.
|
||||
#
|
||||
# One constraint the old cluster never had: the base image this app is built on,
|
||||
# ghcr.io/hanzoai/spa, is amd64-only, and spark is arm64. Whatever schedules this
|
||||
# has to keep it on evo.
|
||||
replicas: 2
|
||||
selectorLabels:
|
||||
app.kubernetes.io/name: lux-fund
|
||||
image:
|
||||
repository: ghcr.io/lux-apps/fund
|
||||
tag: 20cb7cb988b3fb36d6d310f88d623cae891c1f1d
|
||||
pullPolicy: Always
|
||||
env:
|
||||
- name: PORT
|
||||
value: '3000'
|
||||
- name: ROOT
|
||||
value: /public
|
||||
resources: {}
|
||||
|
||||
# The base image, ghcr.io/hanzoai/spa, is published for amd64 only. The old
|
||||
# cluster was uniformly amd64 so nothing had to say this; evo is amd64 and spark
|
||||
# is arm64, so now something does. Without it the scheduler is free to place
|
||||
# this where it cannot run.
|
||||
nodeSelector:
|
||||
kubernetes.io/arch: amd64
|
||||
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: http
|
||||
servicePort: 80
|
||||
imagePullSecrets:
|
||||
- name: ghcr-pull
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 25%
|
||||
topologySpread:
|
||||
enabled: false
|
||||
lifecycle: null
|
||||
terminationGracePeriodSeconds: 30
|
||||
defaultReadinessProbe: false
|
||||
ingress:
|
||||
enabled: true
|
||||
hosts:
|
||||
- lux.fund
|
||||
- www.lux.fund
|
||||
tls: true
|
||||
className: ingress
|
||||
|
||||
# Enforcement switch, read by the lux-fleet ApplicationSet's templatePatch --
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
# lux.fund is files: one Middleware that serves them, one route that names it,
|
||||
# and the endpoint-less Service the route schema requires. No image, so the
|
||||
# chart renders no Deployment -- a static site is not a pod.
|
||||
cd:
|
||||
automated: true
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
middlewares:
|
||||
- name: fund
|
||||
spec:
|
||||
staticFiles:
|
||||
root: /var/www/fund
|
||||
spaMode: true
|
||||
spaIndex: index.html
|
||||
indexFiles:
|
||||
- index.html
|
||||
routes:
|
||||
- name: fund
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`lux.fund`) || Host(`www.lux.fund`)
|
||||
kind: Rule
|
||||
priority: 100
|
||||
middlewares:
|
||||
- name: fund
|
||||
services:
|
||||
- name: lux-fund
|
||||
port: 80
|
||||
tls: {}
|
||||
|
||||
@@ -0,0 +1,32 @@
|
||||
# lux.industries is files: one Middleware that serves them, one route that names it,
|
||||
# and the endpoint-less Service the route schema requires. No image, so the
|
||||
# chart renders no Deployment -- a static site is not a pod.
|
||||
cd:
|
||||
automated: true
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
middlewares:
|
||||
- name: industries
|
||||
spec:
|
||||
staticFiles:
|
||||
root: /var/www/industries
|
||||
spaMode: true
|
||||
spaIndex: index.html
|
||||
indexFiles:
|
||||
- index.html
|
||||
routes:
|
||||
- name: industries
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`lux.industries`) || Host(`www.lux.industries`)
|
||||
kind: Rule
|
||||
priority: 100
|
||||
middlewares:
|
||||
- name: industries
|
||||
services:
|
||||
- name: lux-industries
|
||||
port: 80
|
||||
tls: {}
|
||||
+30
-60
@@ -1,62 +1,32 @@
|
||||
# Generated from the live lux-lps/lux-lps Deployment on do-sfo3-lux-k8s
|
||||
# by hack/live2values.py. Live is the source: a repo of hand-applied
|
||||
# manifests has unknown currency, the running fleet does not.
|
||||
replicas: 2
|
||||
selectorLabels:
|
||||
app.kubernetes.io/name: lux-lps
|
||||
image:
|
||||
repository: ghcr.io/luxfi/lps
|
||||
tag: 1.0.2
|
||||
pullPolicy: IfNotPresent
|
||||
env:
|
||||
- name: PORT
|
||||
value: '3000'
|
||||
- name: ROOT
|
||||
value: /public
|
||||
# The @hanzo/docs export is a Next.js app: its hydration script and critical
|
||||
# inline styles must run or the layout collapses (sidebar drops to the bottom,
|
||||
# body stays blank). hanzoai/static defaults CSP to `default-src 'none'` which
|
||||
# blocks all scripts, so widen it here for this JS site. connect-src allows the
|
||||
# client's RPC/search fetches.
|
||||
- name: HANZO_STATIC_CSP
|
||||
value: "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self' https://*.lux.network"
|
||||
resources: {}
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /
|
||||
port: 3000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 3
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: http
|
||||
servicePort: 80
|
||||
imagePullSecrets:
|
||||
- name: ghcr-pull
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 25%
|
||||
topologySpread:
|
||||
enabled: false
|
||||
lifecycle: null
|
||||
terminationGracePeriodSeconds: 30
|
||||
ingress:
|
||||
enabled: true
|
||||
hosts:
|
||||
- lps.lux.network
|
||||
tls: true
|
||||
# The live certificate lives in this Secret. The chart would default to
|
||||
# <release>-tls, and cert-manager would then issue into a NEW empty Secret
|
||||
# while the host serves no cert at all until it succeeds.
|
||||
secretName: lps-lux-tls
|
||||
className: ingress
|
||||
|
||||
# Enforcement switch, read by the lux-fleet ApplicationSet's templatePatch --
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
# lps.lux.network is files: one Middleware that serves them, one route that names it,
|
||||
# and the endpoint-less Service the route schema requires. No image, so the
|
||||
# chart renders no Deployment -- a static site is not a pod.
|
||||
cd:
|
||||
automated: true
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
middlewares:
|
||||
- name: lps
|
||||
spec:
|
||||
staticFiles:
|
||||
root: /var/www/lps
|
||||
spaMode: true
|
||||
spaIndex: index.html
|
||||
indexFiles:
|
||||
- index.html
|
||||
routes:
|
||||
- name: lps
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`lps.lux.network`)
|
||||
kind: Rule
|
||||
priority: 100
|
||||
middlewares:
|
||||
- name: lps
|
||||
services:
|
||||
- name: lux-lps
|
||||
port: 80
|
||||
tls: {}
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
# by hand — an automated pin BELOW what is running is a rollback that applies
|
||||
# itself, and every one of these files trailed the cluster before this bump.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
replicas: 1
|
||||
selectorLabels:
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
# by hand — an automated pin BELOW what is running is a rollback that applies
|
||||
# itself, and every one of these files trailed the cluster before this bump.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
replicas: 1
|
||||
selectorLabels:
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
# by hand — an automated pin BELOW what is running is a rollback that applies
|
||||
# itself, and every one of these files trailed the cluster before this bump.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
replicas: 1
|
||||
selectorLabels:
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
# by hand — an automated pin BELOW what is running is a rollback that applies
|
||||
# itself, and every one of these files trailed the cluster before this bump.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
replicas: 1
|
||||
selectorLabels:
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
# by hand — an automated pin BELOW what is running is a rollback that applies
|
||||
# itself, and every one of these files trailed the cluster before this bump.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
replicas: 1
|
||||
selectorLabels:
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
# reverse was true; regenerating it would undo that and re-import whatever has
|
||||
# been applied by hand, so bump the pin here instead.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
#
|
||||
# ⚠️ The ports/service block below is deliberate and load-bearing. This workload
|
||||
|
||||
@@ -57,7 +57,7 @@ terminationGracePeriodSeconds: 30
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
# The edge, lifted out of k8s/lux-mainnet/lux-build.yaml.
|
||||
#
|
||||
|
||||
@@ -45,4 +45,4 @@ defaultReadinessProbe: false
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
@@ -58,7 +58,7 @@ terminationGracePeriodSeconds: 30
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
# The edge, lifted out of k8s/lux-mainnet/lux-market.yaml. The two hosts carry
|
||||
# explicit priorities because they match in the same table and lux.market has to
|
||||
|
||||
@@ -66,4 +66,4 @@ imagePullSecrets: []
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
@@ -239,7 +239,7 @@ configMaps:
|
||||
# applies nothing today; what it adds is selfHeal, which returns a
|
||||
# hand-edited object to what is written here. prune stays off.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
# The identity the gate runs as, lifted out of k8s/lux-mainnet/rpc-tip-gate.yaml.
|
||||
# serviceAccountName above names it and nothing here created it, so the
|
||||
|
||||
@@ -74,4 +74,4 @@ ingress:
|
||||
# applies nothing today; what it adds is selfHeal, which returns a
|
||||
# hand-edited object to what is written here. prune stays off.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
@@ -0,0 +1,32 @@
|
||||
# lux.market is files: one Middleware that serves them, one route that names it,
|
||||
# and the endpoint-less Service the route schema requires. No image, so the
|
||||
# chart renders no Deployment -- a static site is not a pod.
|
||||
cd:
|
||||
automated: true
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
middlewares:
|
||||
- name: market
|
||||
spec:
|
||||
staticFiles:
|
||||
root: /var/www/market
|
||||
spaMode: true
|
||||
spaIndex: index.html
|
||||
indexFiles:
|
||||
- index.html
|
||||
routes:
|
||||
- name: market
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`lux.market`) || Host(`www.lux.market`)
|
||||
kind: Rule
|
||||
priority: 100
|
||||
middlewares:
|
||||
- name: market
|
||||
services:
|
||||
- name: lux-market
|
||||
port: 80
|
||||
tls: {}
|
||||
@@ -1,37 +1,32 @@
|
||||
# Generated from the live lux-network/lux-network Deployment on do-sfo3-lux-k8s
|
||||
# by hack/live2values.py. Live is the source: a repo of hand-applied
|
||||
# manifests has unknown currency, the running fleet does not.
|
||||
replicas: 2
|
||||
selectorLabels:
|
||||
app.kubernetes.io/name: lux-network
|
||||
image:
|
||||
repository: ghcr.io/lux-apps/network
|
||||
tag: latest
|
||||
digest: sha256:b52dd80f59d761f4407ab5774d914049ae66f32bc1ac9c2adf97c49e1324ae9d
|
||||
pullPolicy: IfNotPresent
|
||||
env:
|
||||
- name: PORT
|
||||
value: '3000'
|
||||
- name: ROOT
|
||||
value: /public
|
||||
resources: {}
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: http
|
||||
servicePort: 80
|
||||
imagePullSecrets:
|
||||
- name: ghcr-pull
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 25%
|
||||
topologySpread:
|
||||
enabled: false
|
||||
lifecycle: null
|
||||
terminationGracePeriodSeconds: 30
|
||||
defaultReadinessProbe: false
|
||||
|
||||
# Enforcement switch, read by the lux-fleet ApplicationSet's templatePatch --
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
# lux.network is files: one Middleware that serves them, one route that names it,
|
||||
# and the endpoint-less Service the route schema requires. No image, so the
|
||||
# chart renders no Deployment -- a static site is not a pod.
|
||||
cd:
|
||||
automated: true
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
middlewares:
|
||||
- name: network
|
||||
spec:
|
||||
staticFiles:
|
||||
root: s3://hanzo-sites/lux/network
|
||||
spaMode: true
|
||||
spaIndex: index.html
|
||||
indexFiles:
|
||||
- index.html
|
||||
routes:
|
||||
- name: network
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`lux.network`) || Host(`www.lux.network`)
|
||||
kind: Rule
|
||||
priority: 100
|
||||
middlewares:
|
||||
- name: network
|
||||
services:
|
||||
- name: lux-network
|
||||
port: 80
|
||||
tls: {}
|
||||
|
||||
@@ -67,4 +67,4 @@ terminationGracePeriodSeconds: 30
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
@@ -40,4 +40,4 @@ imagePullSecrets: []
|
||||
# applies nothing today; what it adds is selfHeal, which returns a
|
||||
# hand-edited object to what is written here. prune stays off.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
@@ -22,7 +22,7 @@
|
||||
# live, which is why CD reports this application Missing; applying it at
|
||||
# replicas 0 restores the declaration and starts no pod.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
replicas: 0
|
||||
selectorLabels:
|
||||
|
||||
@@ -28,4 +28,4 @@ defaultReadinessProbe: false
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
@@ -1,178 +0,0 @@
|
||||
# Generated from the live lux-ns/lux-exchange Deployment on do-sfo3-lux-k8s
|
||||
# by hack/live2values.py. Live is the source: a repo of hand-applied
|
||||
# manifests has unknown currency, the running fleet does not.
|
||||
replicas: 2
|
||||
selectorLabels:
|
||||
app: lux-exchange
|
||||
containerName: exchange
|
||||
image:
|
||||
repository: ghcr.io/luxfi/exchange
|
||||
# 5.149.27. Declared state had drifted far below live (5.149.16-amd64 here
|
||||
# against v5.149.25 running), so this app read OutOfSync and a sync would have
|
||||
# rolled the site BACKWARDS by nine patches. Setting the tag forward first is
|
||||
# what makes the sync safe.
|
||||
#
|
||||
# What 5.149.27 carries: every Lux token page crashed before painting, because
|
||||
# chainInfo names GraphQLApi.Chain.Lux and that enum — generated from the
|
||||
# upstream gateway schema — has no Lux, Zoo, Hanzo, Pars or Spc member. The
|
||||
# `as GqlChainId` cast made the missing member a runtime undefined instead of
|
||||
# a compile error, and TokenDetailsPage dereferenced it. Also: pool pages died
|
||||
# on an empty address, and the market endpoints now answer on lux.cloud.
|
||||
#
|
||||
# The v prefix is gone because the tag now comes from docker/metadata-action's
|
||||
# {{version}}, the same convention explorer already uses.
|
||||
#
|
||||
# 5.149.33: Explore opens on the exchange's own chain. A bare /explore/tokens
|
||||
# resolved to NO chain, which renders the upstream-gateway table — and the
|
||||
# gateway carries none of our chains, so the Lux exchange opened on a token
|
||||
# list with no LUX in it and the Transactions tab fell back to Ethereum.
|
||||
# Absence and "every network" were the same URL state; now the segment says
|
||||
# which, and `all` still reaches everything. Pool detail pages stop bouncing
|
||||
# to /explore/pools for the same reason the token pages did. Each brand reads
|
||||
# the exchange-api its own brand.json names.
|
||||
#
|
||||
# 5.149.56: a token page draws the token's mark. The header asked the upstream
|
||||
# gateway for a project logo, and the gateway carries none of our chains, so
|
||||
# every Lux and Zoo token drew three letters in a grey circle — while the swap
|
||||
# panel beside it drew the real mark. It asks buildPartialCurrencyInfo now —
|
||||
# the function the token constants themselves are built with, so every token
|
||||
# the constants know, and the native coin, draws the same mark everywhere. No
|
||||
# artwork was added; the marks were already on the CDN and already correct.
|
||||
#
|
||||
# 5.149.57: the exchange wears LX. Two letters, the Lux wordmark's own L and
|
||||
# X with the U taken out (@luxfi/logo 1.0.10) — header mark, tab icon and the
|
||||
# PNG icon slots. It replaces a triangle, which said nothing about who this
|
||||
# is; that is why the brand's name was set beside it, and why the name comes
|
||||
# out now that the mark says it. lux.exchange is the only Lux surface that
|
||||
# wears two letters; everything else keeps the full LUX.
|
||||
#
|
||||
# zoo-exchange runs this same image and stays on 5.149.56. It mounts its own
|
||||
# logo.svg, so the mark is safe either way, but its header name comes from
|
||||
# the line this drops — Zoo needs a lockup of its own before it follows.
|
||||
#
|
||||
# 5.149.83: the wallet list shows the wallets, and none of them is another
|
||||
# exchange. Binance's connector is gone — registering it opened a socket to
|
||||
# its relay on page load, for every visitor without the extension, before
|
||||
# anyone clicked anything. In its place a visitor can sign in with the wallet
|
||||
# they actually have: Ethereum, Solana, Bitcoin, TON and XRP, each its own
|
||||
# row, each chain's wallet library fetched only when its row is clicked
|
||||
# (@luxwallet/connect 0.2.0 imports its connectors dynamically).
|
||||
#
|
||||
# Those rows now render at all. They were written against a metadata path
|
||||
# with no production caller, so the single sign-in row that shipped before
|
||||
# had never once appeared on screen. The wallet icon resolves too: its
|
||||
# override was keyed on a name that does not exist, so it was undefined for
|
||||
# every consumer — and the file behind it was byte-identical to Uniswap's
|
||||
# unicorn, which is what the mark had been all along.
|
||||
#
|
||||
# Built from 411b14add, verified against the registry's own revision label
|
||||
# rather than the build's say-so.
|
||||
tag: 5.149.83
|
||||
digest: sha256:7c1bd0e9d423fc5889101fdeebb9f09750bbbdf5d57c666825f4c0fe414423be
|
||||
pullPolicy: Always
|
||||
# hanzo-cd's ownership markers, carried so a chart apply re-asserts them rather
|
||||
# than pruning the app out of CD's inventory. live2values.py did not read them.
|
||||
annotations:
|
||||
apps.hanzo.ai/installation-id: hanzo-cd
|
||||
apps.hanzo.ai/tracking-id: lux-lux-ns-lux-exchange:apps/Deployment:lux-ns/lux-exchange
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: exchange-config
|
||||
# SPA_* env is templated into /public/config.json at boot by hanzoai/spa, which
|
||||
# is what this image runs. A build-time key cannot be rotated without a rebuild,
|
||||
# so the key is a reference to KMS and the pod is the only place it exists.
|
||||
env:
|
||||
- name: SPA_INFURA_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: lux-exchange-secrets
|
||||
key: INFURA_KEY
|
||||
# Org `lux` lives on the cloud-embedded KMS (kms.hanzo.ai), not on the
|
||||
# near-empty lux-kms-go store that kms.lux.cloud now resolves to.
|
||||
kms:
|
||||
hostAPI: https://kms.hanzo.ai
|
||||
credentialsSecret: lux-platform-iam-creds
|
||||
projectSlug: lux
|
||||
envSlug: prod
|
||||
kmsSecrets:
|
||||
- name: lux-exchange-kms-sync
|
||||
secretsPath: /exchange
|
||||
secretName: lux-exchange-secrets
|
||||
keys:
|
||||
- INFURA_KEY
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 512Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 5
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 3
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: http
|
||||
imagePullSecrets:
|
||||
- name: ghcr-luxfi-fresh
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 25%
|
||||
topologySpread:
|
||||
enabled: false
|
||||
lifecycle: null
|
||||
terminationGracePeriodSeconds: 30
|
||||
ingress:
|
||||
enabled: true
|
||||
annotations:
|
||||
# Bind the rateLimit Middleware below to this Ingress' router. Format is
|
||||
# <namespace>-<middleware-name>@kubernetescrd, and hanzoai/ingress reads
|
||||
# ingress.kubernetes.io/ — NOT traefik.ingress.kubernetes.io/, which it
|
||||
# ignores silently, so the wrong prefix reads as a rate limit that is on.
|
||||
ingress.kubernetes.io/router.middlewares: lux-ns-lux-exchange-rate-limit@kubernetescrd
|
||||
hosts:
|
||||
- lux.exchange
|
||||
- www.lux.exchange
|
||||
- app.lux.exchange
|
||||
- trade.lux.exchange
|
||||
- exchange.lux.network
|
||||
- markets.lux.network
|
||||
tls: true
|
||||
className: ingress
|
||||
|
||||
# Enforcement switch, read by the lux-fleet ApplicationSet's templatePatch —
|
||||
# not by the chart. On while this Application already read Synced, so it
|
||||
# applies nothing today; what it adds is selfHeal, which returns a
|
||||
# hand-edited object to what is written here. prune stays off.
|
||||
cd:
|
||||
automated: true
|
||||
|
||||
# The rate limit, lifted out of k8s/lux-ns/lux-exchange.yaml — which held this
|
||||
# Middleware and an Ingress the chart already renders identically, name and TLS
|
||||
# secret included. Light because this is a SPA and no body POSTs reach it: 100
|
||||
# rps sustained absorbs one client's page-load fan-out (chunk JS, CSS, fonts)
|
||||
# without false 429s, while capping an abusive client at 100x normal.
|
||||
middlewares:
|
||||
- name: lux-exchange-rate-limit
|
||||
spec:
|
||||
rateLimit:
|
||||
average: 100
|
||||
burst: 200
|
||||
period: 1s
|
||||
@@ -62,4 +62,4 @@ terminationGracePeriodSeconds: 30
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
@@ -0,0 +1,32 @@
|
||||
# lux.partners is files: one Middleware that serves them, one route that names it,
|
||||
# and the endpoint-less Service the route schema requires. No image, so the
|
||||
# chart renders no Deployment -- a static site is not a pod.
|
||||
cd:
|
||||
automated: true
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
middlewares:
|
||||
- name: partners
|
||||
spec:
|
||||
staticFiles:
|
||||
root: /var/www/partners
|
||||
spaMode: true
|
||||
spaIndex: index.html
|
||||
indexFiles:
|
||||
- index.html
|
||||
routes:
|
||||
- name: partners
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`lux.partners`) || Host(`www.lux.partners`)
|
||||
kind: Rule
|
||||
priority: 100
|
||||
middlewares:
|
||||
- name: partners
|
||||
services:
|
||||
- name: lux-partners
|
||||
port: 80
|
||||
tls: {}
|
||||
@@ -0,0 +1,32 @@
|
||||
# safe.lux.network is files: one Middleware that serves them, one route that names it,
|
||||
# and the endpoint-less Service the route schema requires. No image, so the
|
||||
# chart renders no Deployment -- a static site is not a pod.
|
||||
cd:
|
||||
automated: true
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
middlewares:
|
||||
- name: safe
|
||||
spec:
|
||||
staticFiles:
|
||||
root: /var/www/safe
|
||||
spaMode: true
|
||||
spaIndex: index.html
|
||||
indexFiles:
|
||||
- index.html
|
||||
routes:
|
||||
- name: safe
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`safe.lux.network`)
|
||||
kind: Rule
|
||||
priority: 100
|
||||
middlewares:
|
||||
- name: safe
|
||||
services:
|
||||
- name: lux-safe
|
||||
port: 80
|
||||
tls: {}
|
||||
@@ -0,0 +1,32 @@
|
||||
# lux.shop is files: one Middleware that serves them, one route that names it,
|
||||
# and the endpoint-less Service the route schema requires. No image, so the
|
||||
# chart renders no Deployment -- a static site is not a pod.
|
||||
cd:
|
||||
automated: true
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
middlewares:
|
||||
- name: shop
|
||||
spec:
|
||||
staticFiles:
|
||||
root: s3://hanzo-sites/lux/shop
|
||||
spaMode: true
|
||||
spaIndex: index.html
|
||||
indexFiles:
|
||||
- index.html
|
||||
routes:
|
||||
- name: shop
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`lux.shop`) || Host(`www.lux.shop`)
|
||||
kind: Rule
|
||||
priority: 100
|
||||
middlewares:
|
||||
- name: shop
|
||||
services:
|
||||
- name: lux-shop
|
||||
port: 80
|
||||
tls: {}
|
||||
@@ -65,4 +65,4 @@ cd:
|
||||
# Without this the Application is created and never synced — born
|
||||
# OutOfSync, never taking ownership. It did not matter while the
|
||||
# Deployment already existed; it does now that this file has to CREATE it.
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
@@ -70,4 +70,4 @@ terminationGracePeriodSeconds: 30
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
@@ -303,4 +303,4 @@ configMaps:
|
||||
level: info
|
||||
encoding: json
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
@@ -205,4 +205,4 @@ configMaps:
|
||||
level: info
|
||||
encoding: json
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
@@ -0,0 +1,32 @@
|
||||
# lux.tel is files: one Middleware that serves them, one route that names it,
|
||||
# and the endpoint-less Service the route schema requires. No image, so the
|
||||
# chart renders no Deployment -- a static site is not a pod.
|
||||
cd:
|
||||
automated: true
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
middlewares:
|
||||
- name: tel
|
||||
spec:
|
||||
staticFiles:
|
||||
root: /var/www/tel
|
||||
spaMode: true
|
||||
spaIndex: index.html
|
||||
indexFiles:
|
||||
- index.html
|
||||
routes:
|
||||
- name: tel
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`lux.tel`) || Host(`www.lux.tel`)
|
||||
kind: Rule
|
||||
priority: 100
|
||||
middlewares:
|
||||
- name: tel
|
||||
services:
|
||||
- name: lux-tel
|
||||
port: 80
|
||||
tls: {}
|
||||
@@ -79,4 +79,4 @@ podLabels:
|
||||
# applies nothing today; what it adds is selfHeal, which returns a
|
||||
# hand-edited object to what is written here. prune stays off.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
# nothing to roll. It converges the declaration and proves the sync path
|
||||
# on a service that cannot be disturbed by it.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
replicas: 0
|
||||
selectorLabels:
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
# nothing to roll. It converges the declaration and proves the sync path
|
||||
# on a service that cannot be disturbed by it.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
replicas: 0
|
||||
selectorLabels:
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
# nothing to roll. It converges the declaration and proves the sync path
|
||||
# on a service that cannot be disturbed by it.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
replicas: 0
|
||||
selectorLabels:
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
# nothing to roll. It converges the declaration and proves the sync path
|
||||
# on a service that cannot be disturbed by it.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
replicas: 0
|
||||
selectorLabels:
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
# nothing to roll. It converges the declaration and proves the sync path
|
||||
# on a service that cannot be disturbed by it.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
replicas: 0
|
||||
selectorLabels:
|
||||
|
||||
@@ -58,4 +58,4 @@ volumes:
|
||||
# applies nothing today; what it adds is selfHeal, which returns a
|
||||
# hand-edited object to what is written here. prune stays off.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
@@ -65,4 +65,4 @@ ingress:
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
@@ -1,72 +0,0 @@
|
||||
# Generated from the live lux-web/lux-network Deployment on do-sfo3-lux-k8s
|
||||
# by hack/live2values.py. Live is the source: a repo of hand-applied
|
||||
# manifests has unknown currency, the running fleet does not.
|
||||
replicas: 2
|
||||
selectorLabels:
|
||||
app: lux-network
|
||||
containerName: web
|
||||
image:
|
||||
repository: ghcr.io/lux-apps/network
|
||||
tag: 1028f82e5d8790dd960efea4bbb40ce6e5b2eb7c
|
||||
pullPolicy: IfNotPresent
|
||||
partOf: lux-web
|
||||
env:
|
||||
- name: PORT
|
||||
value: '3000'
|
||||
- name: HOSTNAME
|
||||
value: 0.0.0.0
|
||||
- name: NODE_ENV
|
||||
value: production
|
||||
resources:
|
||||
limits:
|
||||
cpu: '1'
|
||||
memory: 512Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 20
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: http
|
||||
servicePort: 80
|
||||
imagePullSecrets:
|
||||
- name: ghcr-pull
|
||||
rollingUpdate:
|
||||
maxSurge: 1
|
||||
maxUnavailable: 0
|
||||
topologySpread:
|
||||
enabled: false
|
||||
lifecycle: null
|
||||
terminationGracePeriodSeconds: 30
|
||||
ingress:
|
||||
enabled: true
|
||||
hosts:
|
||||
- lux.network
|
||||
- www.lux.network
|
||||
tls: true
|
||||
className: ingress
|
||||
|
||||
# Enforcement switch, read by the lux-fleet ApplicationSet's templatePatch --
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
cd:
|
||||
automated: true
|
||||
@@ -0,0 +1,32 @@
|
||||
# yadota.tech is files: one Middleware that serves them, one route that names it,
|
||||
# and the endpoint-less Service the route schema requires. No image, so the
|
||||
# chart renders no Deployment -- a static site is not a pod.
|
||||
cd:
|
||||
automated: true
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
middlewares:
|
||||
- name: yadota
|
||||
spec:
|
||||
staticFiles:
|
||||
root: /var/www/yadota
|
||||
spaMode: true
|
||||
spaIndex: index.html
|
||||
indexFiles:
|
||||
- index.html
|
||||
routes:
|
||||
- name: yadota
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`yadota.tech`) || Host(`www.yadota.tech`)
|
||||
kind: Rule
|
||||
priority: 100
|
||||
middlewares:
|
||||
- name: yadota
|
||||
services:
|
||||
- name: yadota
|
||||
port: 80
|
||||
tls: {}
|
||||
@@ -67,4 +67,4 @@ ingress:
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
@@ -67,4 +67,4 @@ ingress:
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
@@ -71,4 +71,4 @@ ingress:
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
@@ -63,4 +63,4 @@ ingress:
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
@@ -31,7 +31,7 @@
|
||||
# server.js that luxfi/exchange's release matrix pushes to the same package
|
||||
# under the SPA's 5.149.x versions. That one has no /v1/graphql route at all.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
replicas: 2
|
||||
image:
|
||||
|
||||
@@ -17,6 +17,11 @@ image:
|
||||
# logo/favicon field, and neither parser rejects a key it does not know.
|
||||
tag: v1.1.17
|
||||
pullPolicy: Always
|
||||
# One manifest under that tag, linux/amd64. A property of the image, so it lives
|
||||
# beside it: no effect on an all-amd64 cluster, and on a mixed one it stops the
|
||||
# pod binding to a node that has no manifest to run.
|
||||
nodeSelector:
|
||||
kubernetes.io/arch: amd64
|
||||
env:
|
||||
- name: GATUS_CONFIG_PATH
|
||||
value: /config/config.yaml
|
||||
@@ -57,6 +62,21 @@ ports:
|
||||
- containerPort: 8080
|
||||
name: http
|
||||
servicePort: 80
|
||||
# Gatus writes its uptime history here, and the claim was the object
|
||||
# live2values.py could not reach: it reads the Deployment, and a claim a
|
||||
# Deployment only MOUNTS is not part of one. So the values named a volume nothing
|
||||
# declared, and the scheduler answered that no node is available — indefinitely,
|
||||
# without ever attempting a pull. 2Gi RWO matches the claim this page already has
|
||||
# wherever it runs; a request below an existing volume's capacity is refused.
|
||||
#
|
||||
# storageClass is deliberately absent: naming one would pin this file to a single
|
||||
# cluster's provisioner, while the default resolves to the block class in the
|
||||
# cloud and to local-path on k3s. One text, either place.
|
||||
claims:
|
||||
- name: status-data
|
||||
size: 2Gi
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
volumes:
|
||||
- configMap:
|
||||
name: status-config
|
||||
|
||||
@@ -99,4 +99,4 @@ ingress:
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
cd:
|
||||
automated: true
|
||||
automated: false
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user