zeekayandHanzo Dev
561dcc1173
The pod spec is declared twice — here and in deploy/app-lux-finance. deploy/ is the authority, but a manual apply of this file is a supported thing to do, and it would have dropped SPA_INFURA_KEY without any error: an absent key reads as an empty string, so the SPA would go back to dialling .../v3/ with nothing after it and only external-chain reads would quietly fail. The reference is repeated, never the value. Collapsing the duplication is the real fix and is still owed. Co-authored-by: Hanzo Dev <[email protected]>
113 lines
3.5 KiB
YAML
113 lines
3.5 KiB
YAML
# app.lux.finance — the Liquid Protocol SPA (luxfi/finance).
|
|
#
|
|
# This is the deployment that actually serves app.lux.finance on lux-k8s. It
|
|
# existed only as a hand-applied object (kubectl.kubernetes.io/last-applied-
|
|
# configuration, no owning repo), which is how it ran ghcr.io/luxfi/finance
|
|
# 1.0.3-amd64 — the build containing the hard-coded "$125M+ Total Value
|
|
# Locked" strip — for 33 days after the fix was written. Recorded here so the
|
|
# image tag is a reviewable change and not an untracked cluster edit.
|
|
#
|
|
# NOTE the sibling k8s/lux-k8s/finance/ deployment (ns hanzo, name lux-finance,
|
|
# ghcr.io/luxfi/lux-finance:v2.0.0) serves the bare lux.finance host from a
|
|
# different, older image. Two deployments of one app; collapsing them is a
|
|
# separate change and must not be done blind.
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: app-lux-finance
|
|
labels:
|
|
app.kubernetes.io/part-of: lux
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: app-lux-finance
|
|
namespace: app-lux-finance
|
|
labels:
|
|
app: app-lux-finance
|
|
app.kubernetes.io/managed-by: lux-universe
|
|
app.kubernetes.io/part-of: lux-finance
|
|
spec:
|
|
replicas: 2
|
|
selector:
|
|
matchLabels:
|
|
app: app-lux-finance
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: app-lux-finance
|
|
spec:
|
|
containers:
|
|
- name: app
|
|
# v1.0.4 is the first tag off main that reads locked value from the
|
|
# C-Chain instead of printing a literal. Bump this only to a tag that
|
|
# exists in ghcr.io/luxfi/finance.
|
|
image: ghcr.io/luxfi/finance:1.0.4-amd64
|
|
imagePullPolicy: IfNotPresent
|
|
ports:
|
|
- containerPort: 3000
|
|
name: http
|
|
# deploy/app-lux-finance/app-lux-finance.yaml is the authority on this
|
|
# pod spec. SPA_INFURA_KEY is repeated here only because applying THIS
|
|
# file would otherwise prune it and leave the SPA with no Infura key
|
|
# again — silently, since an absent key reads as an empty string.
|
|
# It resolves through the app-lux-finance-kms-sync KMSSecret; the value
|
|
# is in KMS (org lux, env prod, path /finance) and nowhere else.
|
|
env:
|
|
- name: PORT
|
|
value: "3000"
|
|
- name: ROOT
|
|
value: /public
|
|
- name: SPA_INFURA_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: app-lux-finance-secrets
|
|
key: INFURA_KEY
|
|
resources:
|
|
requests: { cpu: 50m, memory: 32Mi }
|
|
limits: { memory: 128Mi }
|
|
readinessProbe:
|
|
httpGet: { path: /health, port: 3000 }
|
|
initialDelaySeconds: 3
|
|
periodSeconds: 10
|
|
livenessProbe:
|
|
httpGet: { path: /health, port: 3000 }
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 30
|
|
imagePullSecrets:
|
|
- name: ghcr-pull
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: app-lux-finance
|
|
namespace: app-lux-finance
|
|
spec:
|
|
selector:
|
|
app: app-lux-finance
|
|
ports:
|
|
- name: http
|
|
port: 80
|
|
targetPort: 3000
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: app-lux-finance
|
|
namespace: app-lux-finance
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
spec:
|
|
ingressClassName: ingress
|
|
tls:
|
|
- hosts: [app.lux.finance]
|
|
secretName: app-lux-finance-tls
|
|
rules:
|
|
- host: app.lux.finance
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service: { name: app-lux-finance, port: { number: 80 } }
|