fix(zoo-explorer): the explorer takes -config, and it needs an RPC that resolves

zoo-explorer-explorer had restarted 600+ times in both zoo-system and
zoo-devnet. The operator (<=0.1.3) rendered the ZooExplorer CR as
container args --rpc/--chain/--port, but ghcr.io/luxfi/explorer is a Go
binary whose stdlib `flag` set defines only -config/-data/-http/-mdns/
-version. Every start therefore ended in:

    flag provided but not defined: -rpc
    Usage of explorer: ...

i.e. exit 2 before the listener ever bound. operator 0.1.4
(src/controller.rs::reconcile_explorer) renders the CR into a chains.yaml
ConfigMap and passes --config=/etc/explorer/chains.yaml instead. 62864bd
already pinned 0.1.4 for the readiness fix, so only the rationale is
added here — but that pin is what stops the crash, and the comment should
say so or the next person re-floats the tag.

The crash was hiding two further defects. Both pods now come up Running
and are still useless without these:

* base rpcEndpoint pointed at zoo-chain-rpc.zoo.svc.cluster.local. There
  is no `zoo` namespace on do-sfo3-zoo-k8s (`kubectl -n zoo get svc` ->
  "No resources found"), so the indexer logs `no such host` every 30s and
  has indexed zero blocks since it stopped crashing. `zoo` is not a
  blockchain alias either — the EVM answers on /ext/bc/C/rpc. The CR is
  applied into zoo-<env>, so the address is namespace-relative;
  zoo-testnet/zoo-mainnet keep their own tracked-blockchainID overrides.

* the devnet validator ran without --http-allowed-hosts, so luxd's
  localhost-only default 403s every in-cluster caller — the same
  eth_chainId POST returns 0x17872 with `Host: localhost` and 403
  Forbidden without it. spec.config renders as --kebab-case flags
  (operator 0.1.3+), so HTTP_ALLOWED_HOSTS there is the one source of
  truth; the unreferenced zoo-devnet/statefulset-patch.yaml is not.

Co-authored-by: Hanzo Dev <[email protected]>

k8s/base/network.yaml

@@ -74,7 +74,12 @@ metadata:
 spec:
   chainRef: zoo-evm
   image: ghcr.io/luxfi/explorer:1.2.18
-  rpcEndpoint: http://zoo-chain-rpc.zoo.svc.cluster.local:9630/ext/bc/zoo/rpc
+  # Namespace-relative on purpose: the CR is deployed into zoo-<env>, and there
+  # is no `zoo` namespace on the cluster, so the old
+  # zoo-chain-rpc.zoo.svc.cluster.local never resolved. `zoo` is also not a
+  # blockchain alias — the EVM answering on the validator is /ext/bc/C/rpc.
+  # zoo-testnet/zoo-mainnet override this with their tracked blockchainID.
+  rpcEndpoint: http://zoo-chain-rpc:9630/ext/bc/C/rpc
   chainName: zoo
   coinSymbol: ZOO
   service:

k8s/base/operator.yaml

@@ -40,10 +40,16 @@ spec:
           # track is what let a stale replica outlive its manifest (see above).
           # 0.1.3 renders the zoo-chain StatefulSet with luxd CLI flags derived
           # from the ZooNetwork CR (earlier images emitted only ZOO_* env, which
-          # luxd's viper EnvPrefix ignores). 0.1.4 unbraids readiness from
-          # leadership: /readyz used to 503 on every non-leader, so a healthy
-          # standby was NotReady forever and its Deployment never went available
-          # — zoo-system sat 0/1 for two days. Bump x.y.z+; never float.
+          # luxd's viper EnvPrefix ignores). 0.1.4 fixes two more: it unbraids
+          # readiness from leadership (/readyz used to 503 on every non-leader,
+          # so a healthy standby was NotReady forever and zoo-system sat 0/1 for
+          # two days), and it renders the ZooExplorer Deployment with
+          # --config=/etc/explorer/chains.yaml. Earlier images passed
+          # --rpc/--chain/--port, which luxfi/explorer's stdlib `flag` set does
+          # not define (only -config/-data/-http/-mdns/-version), so the binary
+          # printed usage and exited 2 on every start — 600+ restarts of
+          # zoo-explorer-explorer in zoo-system and zoo-devnet.
+          # Bump x.y.z+ on every operator change; never float.
           image: ghcr.io/zooai/operator:0.1.4
           imagePullPolicy: IfNotPresent
           args: ["--namespace", ""]

k8s/zoo-devnet/network-patch.yaml

@@ -32,6 +32,11 @@ spec:
   config:
     # Devnet has no sybil protection (Lux primary networkID 3 convention).
     SYBIL_PROTECTION_ENABLED: "false"
+    # luxd defaults --http-allowed-hosts to localhost, so every in-cluster
+    # caller addressing the node as `zoo-chain-rpc` got 403 Forbidden — the
+    # explorer could reach the Service and still index nothing. The Service is
+    # ClusterIP and devnet is not publicly routed.
+    HTTP_ALLOWED_HOSTS: "*"
 ---
 apiVersion: zoo.network/v1alpha1
 kind: ZooChain