zeekay
51460827d4
The two mains shared no history, so this is a per-file three-way merge:
for each file the 65 forge-only commits touched (by patch-id), the base is
the newest version both histories held. 105 files merged or took one side
cleanly, 48 were already identical, and the 45 true conflicts and 31
modify/delete pairs were resolved by what runs on the cluster:
- The forge wins where it is live: explorer 1.5.56 (digest 45db11ff) and
its archive readers, explore-fe-hanzo's ConfigMap env (AI coin,
/v1/indexer/hanzo, /v1/chain/hanzo/rpc), exchange-api reading
luxd-archive, and explore-fe-{lux,zoo}-testnet, pinned to what they run
(v2.8.5-lux / v2.8.4-lux).
- GitHub wins where it is live: explore-fe-lux v2.8.5-lux, explore-fe-zoo
v2.8.4-lux, bankd v1.0.18, lux-build's routes.
- The forge's retirement of workloads that run nowhere stands: lux-mainnet
dex, lux-hb2, lux-market, traffic, wallet-web; the lux-testnet frontends,
indexer, exchange and gateways; lux-operator. deploy/lux-testnet/luxd.yaml
stays, since roll_luxd.sh reads it.
- GitHub's deletions stand: lux-finance and lux-financial (static sites
now), the k8s/ operator manifests, .hanzo/workflows/cicd.yml.
- Paths are /v1/chain/C/rpc where the forge had written /v1/chain/c. All
four spellings answer; this one is the documented form. The forge's
/{network}/v1 doc lines are dropped: a network is a host, and the prefix
404s.
Dry-run against the running objects (server-side, as CD applies), the
merged explorer shows no change where GitHub's showed 152 lines, and no
other live workload moves further from what runs. Every deploy/*/*.yaml
renders with charts/app; price.yaml, which failed on GitHub, now renders.
Claude-Session: https://claude.ai/code/session_01TzirYkGmD88w4GipqivUtV
124 lines
4.2 KiB
YAML
124 lines
4.2 KiB
YAML
# Generated from the live lux-ns/exchange-api Deployment on lux-k8s
|
|
# by hack/live2values.py. Live is the source: a repo of hand-applied
|
|
# manifests has unknown currency, the running fleet does not.
|
|
replicas: 2
|
|
selectorLabels:
|
|
app: exchange-api
|
|
image:
|
|
repository: ghcr.io/luxfi/exchange-api
|
|
tag: 2.3.34
|
|
digest: sha256:3eae48ac6f4be340d94751d6b52c8fab0aeaddaff2a5b6c52e5c1305af3b3538
|
|
pullPolicy: IfNotPresent
|
|
env:
|
|
- name: PORT
|
|
value: '4000'
|
|
# One AMM source on every network: the native graph in the explorer image, which
|
|
# bundles luxfi/graph and luxfi/indexer. It reads each token's decimals from the
|
|
# token, so a pool is priced by what the chain says rather than by a figure
|
|
# carried beside it.
|
|
- name: SUBGRAPH_URL
|
|
value: http://explorer.lux-mainnet.svc.cluster.local:8090/v1/graph/cchain/amm/graphql
|
|
- name: DEX_SUBGRAPH_URL
|
|
value: http://explorer.lux-mainnet.svc.cluster.local:8090/v1/graph/cchain/dex/graphql
|
|
- name: NETWORK
|
|
value: mainnet
|
|
- name: LUX_RPC_URL
|
|
value: http://luxd-archive.lux-mainnet.svc.cluster.local:9630/v1/chain/C/rpc
|
|
resources:
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
requests:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
livenessProbe:
|
|
failureThreshold: 3
|
|
httpGet:
|
|
path: /health
|
|
port: 4000
|
|
scheme: HTTP
|
|
periodSeconds: 30
|
|
successThreshold: 1
|
|
timeoutSeconds: 1
|
|
readinessProbe:
|
|
failureThreshold: 3
|
|
httpGet:
|
|
path: /health
|
|
port: 4000
|
|
scheme: HTTP
|
|
periodSeconds: 10
|
|
successThreshold: 1
|
|
timeoutSeconds: 1
|
|
ports:
|
|
- containerPort: 4000
|
|
nodeSelector:
|
|
kubernetes.io/arch: amd64
|
|
imagePullSecrets:
|
|
- name: ghcr-secret
|
|
- name: ghcr-luxfi-fresh
|
|
- name: ghcr-luxfi
|
|
rollingUpdate:
|
|
maxSurge: 25%
|
|
maxUnavailable: 25%
|
|
topologySpread:
|
|
enabled: false
|
|
lifecycle: null
|
|
terminationGracePeriodSeconds: 30
|
|
|
|
# Enforcement switch, read by the lux-fleet ApplicationSet's templatePatch --
|
|
# not by the chart. selfHeal returns a hand-edited object to what is written
|
|
# here; prune stays off, so nothing is ever deleted.
|
|
cd:
|
|
automated: false
|
|
|
|
# exchange.lux.cloud. v1.lux.exchange reads every market, chart, quote and swap
|
|
# through this host, and until now the only thing that named it was a
|
|
# hand-applied Ingress in k8s/lux-ns that nothing reconciles -- so the host
|
|
# answered 404 and every chart on the exchange was empty. One rule, one backend:
|
|
# the old Ingress sent /v1/graph/, /v1/quote, /v1/swap, /v1/swappable_tokens,
|
|
# /v1/check_approval and / to the same exchange-api:4000, so the prefixes said
|
|
# nothing the bare host does not. exchange-gw (hanzoai/gateway) is not in the
|
|
# path: the edge is the ingress, the service is this one.
|
|
routes:
|
|
- name: exchange-lux-cloud
|
|
spec:
|
|
entryPoints: [websecure]
|
|
routes:
|
|
- match: Host(`exchange.lux.cloud`)
|
|
kind: Rule
|
|
services:
|
|
- name: exchange-api
|
|
port: 4000
|
|
tls: {}
|
|
|
|
# ghcr.io/luxfi/exchange-api is published for linux/amd64 only. Unpinned, both
|
|
# replicas landed on spark, where the kubelet ran them through the qemu-x86_64
|
|
# binfmt handler and each died before listening -- `QEMU internal SIGSEGV
|
|
# {code=MAPERR}` -- so the Service had no ready endpoint and exchange.lux.cloud
|
|
# answered 503. Emulation is not a scheduling strategy: an image that exists for
|
|
# one architecture may only be scheduled where that architecture is.
|
|
nodeSelector:
|
|
kubernetes.io/arch: amd64
|
|
|
|
# Stated here, not left to the chart default. evo carries hanzo.ai/no-ci to
|
|
# keep CI off the node that serves production, and evo is the only amd64 node
|
|
# this image can run on (see nodeSelector above). The chart defaults this
|
|
# toleration from 0.1.14, but the render CD produced for this app did not carry
|
|
# it -- the pod sat Pending, "1 node(s) had untolerated taint(s)" -- so the
|
|
# workload says it itself. One place, no dependence on which artifact was cut.
|
|
tolerations:
|
|
- key: hanzo.ai/no-ci
|
|
operator: Exists
|
|
effect: NoSchedule
|
|
|
|
# Pull credential for ghcr.io/luxfi/exchange-api. lux-ns holds no KMS identity of
|
|
# its own; this projects the shared hanzo ghcr-secret (which reads luxfi images)
|
|
# as a dockerconfigjson the kubelet honours. Interim: a hand-applied Secret of the
|
|
# same name carries until the kms projector reconciles this.
|
|
kmsSecrets:
|
|
- name: ghcr-secret-kms-sync
|
|
secretsPath: /ghcr-secret
|
|
keys: [.dockerconfigjson]
|
|
secretName: ghcr-secret
|
|
secretType: kubernetes.io/dockerconfigjson
|