Files
Hanzo AI 4646846e7a deploy: pin every resolvable image to the bytes it runs
A values file named a repository and a tag, and a tag is mutable. Under
pullPolicy: Always that means the fleet pulls whatever the name points at on the
morning it restarts; under IfNotPresent it means a node that pulled `:latest`
once keeps those bytes forever while its neighbour gets a newer build. Both
spellings of the same fault: the file does not say what runs.

41 of 50 image blocks now carry a digest beside the tag, resolved from the
registry, with pullPolicy: IfNotPresent throughout. The chart renders
repo:tag@digest and the reference resolves BY DIGEST -- the tag stays as the
name a human reads. 20 of those were floating (`latest`, `main`, `main-amd64`)
and now name specific bytes.

Four floating tags had a release naming the same digest, so they say it:
consul 1.20 -> 1.20.6, traefik v3.3 -> v3.3.7, zooai/docs latest -> 0.1.4. Each
was verified to be the same manifest, so this renames what is running and moves
nothing. gatus stays on `latest`: no v-tag names its bytes, so a version there
would have been a silent upgrade rather than a rename.

This is also what chart 0.1.13 requires. Its claimed list covers
ghcr.io/hanzoai/cloud:v*, and it refuses to RENDER one of those without a
digest -- so hanzo/cloud-api would have failed the render, which stops the sync
and leaves the running pods alone. Better than the alternative, but the pin is
the point.

Eight files name an image the registry does not have and are left alone rather
than guessed at; deploy/README.md lists them with what the registry does have.

Co-authored-by: Hanzo Dev <[email protected]>
2026-09-03 21:32:58 -07:00

96 lines
2.1 KiB
YAML

# Generated from the live zoo-devnet/zoo-explorer Deployment on do-sfo3-zoo-k8s
# by hack/live2values.py. Live is the source: a repo of hand-applied
# manifests has unknown currency, the running fleet does not.
replicas: 1
selectorLabels:
app: zoo-explorer
containerName: explorer
image:
repository: ghcr.io/luxfi/explorer
tag: 1.2.18
digest: sha256:907f3d42f84b829d58868a2fff421bdd97868e27a6dc18675412adac1b228461
pullPolicy: IfNotPresent
args:
- --config=/etc/explorer/chains.yaml
env:
- name: DISABLE_EXCHANGE_RATES
value: 'true'
- name: DISABLE_KNOWN_TOKENS
value: 'true'
- name: ECTO_USE_SSL
value: 'false'
- name: SECRET_KEY_BASE
value: f470a4264109ab506e4e476173ed73fc0e046c04a1d9e6e27c254ec3d0c5660d
- name: POOL_SIZE
value: '5'
- name: DISABLE_INDEXER
value: 'true'
- name: INDEXER_DISABLE_PENDING_TRANSACTIONS_FETCHER
value: 'true'
- name: CHAINS
value: zoo:https://api.zoo-dev.network/
- name: PORT
value: '8090'
- name: COIN
value: dZOO
- name: NETWORK
value: Zoo Devnet
- name: SUBNETWORK
value: Zoo EVM Devnet
resources:
limits:
cpu: '1'
memory: 512Mi
requests:
cpu: 100m
memory: 128Mi
volumeMounts:
- mountPath: /etc/explorer
name: config
readOnly: true
- mountPath: /data
name: data
livenessProbe:
failureThreshold: 3
initialDelaySeconds: 30
periodSeconds: 30
successThreshold: 1
tcpSocket:
port: 8090
timeoutSeconds: 1
readinessProbe:
failureThreshold: 3
initialDelaySeconds: 5
periodSeconds: 5
successThreshold: 1
tcpSocket:
port: 8090
timeoutSeconds: 1
ports:
- containerPort: 8090
name: http
volumes:
- configMap:
name: explorer-chains
name: config
- name: data
imagePullSecrets:
- name: ghcr-luxfi
- name: ghcr-secret
- name: hanzo
- name: gcr-pull-secret
fsGroup: 1000
rollingUpdate:
maxSurge: 25%
maxUnavailable: 25%
topologySpread:
enabled: false
lifecycle: null
terminationGracePeriodSeconds: 30
# Live runs this pod with these settings and the chart renders only fsGroup
# unless podSecurityContext is set, so omitting them is a silent drop to uid 0
# (or to seccomp Unconfined) on the first server-side sync.
podSecurityContext:
runAsGroup: 1000
runAsUser: 1000