zeekayandHanzo Dev
774f93e998
exchange/markets on lux-dev and lux-test, and the mpc-api hosts, all served Traefik's self-signed default and were unreachable over HTTPS (curl 000) while their backends ran. lux-devnet/lux-exchange was 2/2 the whole time, serving traffic nobody could reach. Root cause: their IngressRoutes ask for `certResolver: letsencrypt`, and that resolver does not exist. hanzo-ingress carries NO --certificatesresolvers.* argument at all -- TLS issuance was migrated to cert-manager (88 Certificates on this cluster) and the certResolver lines are un-migrated residue. Traefik cannot resolve a named resolver that was never configured, so it falls back to its default certificate. That the resolver's absence is deliberate, not decay, is worth stating: acme.json is frozen at 2026-07-14 and CF_API_* env linger from the old DNS-01 setup. Every host that WORKS today is covered by a cert-manager Certificate and renews normally -- I checked before concluding otherwise. Proof it was only ever the missing Certificate: each issued in ~100 seconds. ACME validation was never the problem. mpc-api is a SEPARATE route, not a tls change on lux-mpc, because that route matches six hosts on one tls block and three of them already work with their own Certificates. A single secretName there would have served all six from a cert covering only the mpc-api names. Verified after: devnet trio 200 with a real cert; mpc-api.lux/pars 200; mpc.lux.network unchanged at 200 with its own cert. The testnet trio now presents a valid cert and returns 503 -- its backend is scaled 0/0, which is a separate decision, but TLS is no longer the blocker. mpc-api.zoo.network is untouched: its DNS points at the ZOO load balancer, and zoo-k8s has zoo-mpc/mpc-node 5/5 but no Ingress or IngressRoute for mpc at all. That is a routing question, not a certificate one. Co-authored-by: Hanzo Dev <[email protected]>
17 lines
322 B
YAML
17 lines
322 B
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
namespace: lux-devnet
|
|
namePrefix: lux-
|
|
|
|
images:
|
|
- name: ghcr.io/luxfi/exchange
|
|
# bare semver (no `v`); v5.147.4 does not exist in GHCR.
|
|
newTag: "5.149.2"
|
|
|
|
resources:
|
|
- certificate.yaml
|
|
- ../../base
|
|
- configmap-env.yaml
|
|
- ingressroute.yaml
|