zeekayandHanzo Dev
425b96f66e
Every provenance line and manifest still named a DigitalOcean context, and the ARC values described a pool that died with it. A cluster gets a name here; the address it answers on belongs to the private record. Co-authored-by: Hanzo Dev <[email protected]>
106 lines
4.0 KiB
YAML
106 lines
4.0 KiB
YAML
# Lux Cloud console — hanzoai/console 8.x (brand-agnostic image; brand resolved
|
|
# at runtime from the request host: console.lux.cloud → `lux`). This is the SAME
|
|
# image as console.hanzo.ai; the per-brand catalog scope makes the Lux console a
|
|
# WEB3 / BOOTNODE admin (Web3 + Network + Security + Dev + Settings — networks,
|
|
# on-chain, keys/HSM, dev keys, org), not the AI cloud surface.
|
|
#
|
|
# Blue-green: this deploys a NEW `console2` Deployment/Service alongside the live
|
|
# v1 Langfuse `console`. Verify console2 serves, then repoint the `console-lux`
|
|
# Ingress (below) and retire v1. No live break until the Ingress is cut over.
|
|
#
|
|
# GO-LIVE PREREQUISITE (secret): `IAM_MINT_CLIENT_*` below reference the secret
|
|
# `lux-console-iam-creds` — a confidential `lux-console` IAM app (registered in
|
|
# lux.id, allow-listed for issue-user-token) whose clientSecret is synced from
|
|
# KMS. Until it exists, the console DEPLOYS and signs in (browser PKCE against
|
|
# lux.id), and the server-proxied surfaces (Networks via /bootnode, Base) show
|
|
# honest "not configured" states rather than fabricated data.
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: console2
|
|
namespace: hanzo
|
|
labels:
|
|
app.kubernetes.io/name: console2
|
|
app.kubernetes.io/part-of: lux-cloud
|
|
spec:
|
|
replicas: 2
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: console2
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: console2
|
|
spec:
|
|
imagePullSecrets:
|
|
- name: ghcr-secret
|
|
containers:
|
|
- name: console
|
|
image: ghcr.io/hanzoai/console:v8.2.0
|
|
ports:
|
|
- name: http
|
|
containerPort: 4000
|
|
env:
|
|
# Server-only (never NEXT_PUBLIC_). In-cluster service URLs on lux-k8s.
|
|
- name: IAM_URL
|
|
value: http://iam.hanzo.svc
|
|
- name: CLOUD_API_URL
|
|
value: http://cloud-api.hanzo.svc.cluster.local:8000
|
|
- name: AI_GATEWAY_URL
|
|
value: http://cloud-api.hanzo.svc.cluster.local:8000
|
|
# Bootnode control plane (the Web3 Networks module proxies here).
|
|
- name: BOOTNODE_URL
|
|
value: http://bootnode-api.bootnode.svc.cluster.local
|
|
- name: COMMERCE_URL
|
|
value: http://commerce.hanzo.svc:8001
|
|
# Confidential lux-console client for the server-side mint/issue path.
|
|
- name: IAM_MINT_CLIENT_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: lux-console-iam-creds
|
|
key: clientId
|
|
optional: true
|
|
- name: IAM_MINT_CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: lux-console-iam-creds
|
|
key: clientSecret
|
|
optional: true
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /signin
|
|
port: 4000
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
memory: 512Mi
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: console2
|
|
namespace: hanzo
|
|
labels:
|
|
app.kubernetes.io/name: console2
|
|
spec:
|
|
selector:
|
|
app.kubernetes.io/name: console2
|
|
ports:
|
|
- name: http
|
|
port: 4000
|
|
targetPort: 4000
|
|
# ── Cut-over (apply after verifying console2 serves) ──────────────────────────
|
|
# The live `console-lux` Ingress currently routes console.lux.cloud → console:80
|
|
# (v1 Langfuse). Repoint it to console2:4000:
|
|
#
|
|
# kubectl --context lux-k8s -n hanzo patch ingress console-lux --type=json \
|
|
# -p '[{"op":"replace","path":"/spec/rules/0/http/paths/0/backend/service/name","value":"console2"},
|
|
# {"op":"replace","path":"/spec/rules/0/http/paths/0/backend/service/port/number","value":4000}]'
|
|
#
|
|
# Verify console.lux.cloud serves the 8.x web3 console, then delete the v1
|
|
# `console` + `console-worker` Deployments/Services.
|