Files

T

CI/CD / render (push) Waiting to run

The primary-network chains answer to either case; one spelling beats two.
/v1/chain/c/rpc, /v1/chain/p, /v1/chain/x across the estate.

Co-authored-by: Hanzo AI <[email protected]>

2026-09-08 15:23:20 -07:00

2.7 KiB

Raw Permalink Blame History

Lux validator release runbook

This is the only supported path for changing the Lux node image on mainnet, testnet, or devnet.

Source of truth

The three validator fleets are CD-managed from:

deploy/lux-devnet/luxd.yaml
deploy/lux-testnet/luxd.yaml
deploy/lux-mainnet/luxd.yaml

Each file pins both a release tag and its immutable registry digest. The files under k8s/ contain supporting resources only; they must not define or roll a luxd StatefulSet or LuxNetwork workload.

All networks run five validators on do-sfo3-lux-k8s:

Network	Namespace	Network ID	HTTP port	CD Application
Devnet	`lux-devnet`	3	9650	`lux-devnet-luxd`
Testnet	`lux-testnet`	2	9640	`lux-testnet-luxd`
Mainnet	`lux-mainnet`	1	9630	`lux-mainnet-luxd`

Release gate

Do not deploy an untagged commit or a mutable tag. A release is eligible only after all node CI jobs pass and the release workflow proves that the image:

was built from the tagged commit;
starts successfully with all required VM plugins;
has no luxfi/vm version skew between luxd and its plugins; and
resolves from GHCR by immutable digest.

Pin and roll

Run from a clean universe checkout:

scripts/roll_luxd.sh vX.Y.Z

The script resolves the tag to one digest, writes that same immutable image to all active node and init-container pins, commits the values, and promotes in this order:

devnet;
testnet;
mainnet.

Within a network it replaces one validator at a time. Before touching the next pod it requires the replacement to be Ready, C-Chain bootstrapped, running the requested luxd version, and using the requested digest. It refuses to proceed if the five-node fleet is not fully Ready, and it requires block production after each network roll.

The StatefulSets use OnDelete; syncing CD updates the pod template but does not restart the fleet. Do not use rollout restart, force deletion, parallel pod deletion, or kubectl set image as alternate release paths.

Verification

A network is healthy only when all five pods satisfy all of these conditions:

Ready and info.isBootstrapped(C)=true;
info.getNodeVersion matches the released semver;
the running container imageID matches the pinned digest;
all validators answer C-Chain RPC at a converged tip; and
a later height sample is greater than the earlier sample.

CD must report the corresponding Application Synced and Healthy at the universe commit containing the pin. CI and CD control-plane guards must also be green before the release is declared complete.

Mainnet storage is never wiped. PVC retention remains Retain/Retain, and no release operation may modify genesis, staking keys, or chain configuration.