279 lines
6.6 KiB
YAML
279 lines
6.6 KiB
YAML
# Lux Operator — thin shim translating lux.cloud/v1 → bootno.de/v1
|
|
# Image: ghcr.io/luxfi/operator:v0.8.2
|
|
#
|
|
# v0.8.2 is the Wave-1C thin shim: it watches the Gate-0 lux.cloud/v1
|
|
# compat parents (LuxNetwork, Chain, Gateway, MPC) and materializes
|
|
# bootno.de/v1 child CRs via server-side-apply with owner references.
|
|
# It NEVER mutates lux.network/* legacy resources and writes only status
|
|
# (not spec) on lux.cloud/* parents. The bootno.de CRDs (26, from
|
|
# bootnode/operator @ fa401c37) MUST be installed before this rolls out
|
|
# or every SSA of a child 403-fails. See luxfi/operator LLM.md +
|
|
---
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: lux-system
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: lux-operator
|
|
namespace: lux-system
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: lux-operator
|
|
rules:
|
|
# v0.6.3 canonical API group is `lux.cloud` (was `lux.network` in v0.3.x).
|
|
# Canonical plurals are unprefixed (chains, networks, validators);
|
|
# Hanzo-style legacy plurals are at v1alpha1 (hanzoservices, hanzodatastores,
|
|
# hanzodnses).
|
|
- apiGroups: ["lux.cloud"]
|
|
resources:
|
|
- networks
|
|
- networks/status
|
|
- luxnetworks
|
|
- luxnetworks/status
|
|
- chains
|
|
- chains/status
|
|
- validators
|
|
- validators/status
|
|
- services
|
|
- services/status
|
|
- datastores
|
|
- datastores/status
|
|
- gateways
|
|
- gateways/status
|
|
- mpcs
|
|
- mpcs/status
|
|
- ingresses
|
|
- ingresses/status
|
|
- dns
|
|
- dns/status
|
|
- baseapps
|
|
- baseapps/status
|
|
- sqls
|
|
- sqls/status
|
|
- kvs
|
|
- kvs/status
|
|
- docdbs
|
|
- docdbs/status
|
|
- s3s
|
|
- s3s/status
|
|
- iams
|
|
- iams/status
|
|
- kmsapps
|
|
- kmsapps/status
|
|
- llms
|
|
- llms/status
|
|
- indexers
|
|
- indexers/status
|
|
- explorers
|
|
- explorers/status
|
|
verbs: ["*"]
|
|
# bootno.de/v1 CHILD CRs the shim materializes via server-side-apply.
|
|
# FIXED group (never brand-flipped). Without these the shim's SSA Patch
|
|
# is 403-forbidden and ZERO children materialize.
|
|
- apiGroups: ["bootno.de"]
|
|
resources:
|
|
- networks
|
|
- networks/status
|
|
- luxruntimes
|
|
- luxruntimes/status
|
|
- chains
|
|
- chains/status
|
|
- nodefleets
|
|
- nodefleets/status
|
|
- gateways
|
|
- gateways/status
|
|
- mpcs
|
|
- mpcs/status
|
|
- explorers
|
|
- indexers
|
|
- validators
|
|
- bridges
|
|
verbs: ["*"]
|
|
- apiGroups: ["apps"]
|
|
resources: ["statefulsets", "deployments", "daemonsets", "replicasets"]
|
|
verbs: ["*"]
|
|
- apiGroups: [""]
|
|
resources: ["pods", "services", "configmaps", "secrets", "persistentvolumeclaims", "events", "serviceaccounts"]
|
|
verbs: ["*"]
|
|
- apiGroups: [""]
|
|
resources: ["namespaces"]
|
|
verbs: ["get", "list", "watch"]
|
|
- apiGroups: ["batch"]
|
|
resources: ["jobs", "cronjobs"]
|
|
verbs: ["*"]
|
|
- apiGroups: ["coordination.k8s.io"]
|
|
resources: ["leases"]
|
|
verbs: ["*"]
|
|
- apiGroups: ["rbac.authorization.k8s.io"]
|
|
resources: ["roles", "rolebindings", "clusterroles", "clusterrolebindings"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: lux-operator
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: lux-operator
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: lux-operator
|
|
namespace: lux-system
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
# Name MUST match what's already in the cluster (lux-operator) so
|
|
# `kubectl apply -f` updates the existing rollout instead of creating
|
|
# a parallel `operator` Deployment. Selector + labels updated in
|
|
# lockstep.
|
|
name: lux-operator
|
|
namespace: lux-system
|
|
labels:
|
|
app: lux-operator
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: lux-operator
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: lux-operator
|
|
spec:
|
|
serviceAccountName: lux-operator
|
|
imagePullSecrets:
|
|
- name: ghcr-luxfi
|
|
containers:
|
|
- name: operator
|
|
image: ghcr.io/luxfi/operator:v0.8.2
|
|
imagePullPolicy: IfNotPresent
|
|
# v0.8.2 flag surface (cmd/operator/main.go):
|
|
# --api-group, --namespace, --operator-namespace,
|
|
# --metrics-bind-address, --health-probe-bind-address,
|
|
# --leader-elect, --leader-election-id
|
|
# --operator-namespace=lux-system pins the leader-election Lease
|
|
# to lux-system (the binary default is hanzo-operator-system).
|
|
args:
|
|
- --api-group=lux.cloud
|
|
- --namespace=
|
|
- --metrics-bind-address=:8080
|
|
- --health-probe-bind-address=:8081
|
|
- --leader-elect=true
|
|
- --leader-election-id=lux-operator-leader
|
|
- --operator-namespace=lux-system
|
|
ports:
|
|
- containerPort: 8080
|
|
name: metrics
|
|
- containerPort: 8081
|
|
name: health
|
|
env:
|
|
- name: OPERATOR_NAMESPACE
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.namespace
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /readyz
|
|
port: 8081
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /healthz
|
|
port: 8081
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 30
|
|
---
|
|
# S3 storage for snapshots
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: s3
|
|
namespace: lux-system
|
|
labels:
|
|
app: s3
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: s3
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: s3
|
|
spec:
|
|
containers:
|
|
- name: s3
|
|
image: ghcr.io/hanzoai/s3:1.0.1
|
|
args: ["server", "/data", "--console-address", ":9001"]
|
|
ports:
|
|
- containerPort: 9000
|
|
name: api
|
|
- containerPort: 9001
|
|
name: console
|
|
env:
|
|
- name: S3_ROOT_USER
|
|
value: hanzo
|
|
- name: S3_ROOT_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: hanzo-s3-secret
|
|
key: password
|
|
volumeMounts:
|
|
- name: data
|
|
mountPath: /data
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 1Gi
|
|
volumes:
|
|
- name: data
|
|
persistentVolumeClaim:
|
|
claimName: s3-data
|
|
---
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: s3-data
|
|
namespace: lux-system
|
|
spec:
|
|
accessModes: ["ReadWriteOnce"]
|
|
storageClassName: do-block-storage-retain
|
|
resources:
|
|
requests:
|
|
storage: 100Gi
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: s3
|
|
namespace: lux-system
|
|
spec:
|
|
type: ClusterIP
|
|
ports:
|
|
- name: api
|
|
port: 9000
|
|
targetPort: 9000
|
|
- name: console
|
|
port: 9001
|
|
targetPort: 9001
|
|
selector:
|
|
app: s3
|