Hanzo AI
4646846e7a
A values file named a repository and a tag, and a tag is mutable. Under pullPolicy: Always that means the fleet pulls whatever the name points at on the morning it restarts; under IfNotPresent it means a node that pulled `:latest` once keeps those bytes forever while its neighbour gets a newer build. Both spellings of the same fault: the file does not say what runs. 41 of 50 image blocks now carry a digest beside the tag, resolved from the registry, with pullPolicy: IfNotPresent throughout. The chart renders repo:tag@digest and the reference resolves BY DIGEST -- the tag stays as the name a human reads. 20 of those were floating (`latest`, `main`, `main-amd64`) and now name specific bytes. Four floating tags had a release naming the same digest, so they say it: consul 1.20 -> 1.20.6, traefik v3.3 -> v3.3.7, zooai/docs latest -> 0.1.4. Each was verified to be the same manifest, so this renames what is running and moves nothing. gatus stays on `latest`: no v-tag names its bytes, so a version there would have been a silent upgrade rather than a rename. This is also what chart 0.1.13 requires. Its claimed list covers ghcr.io/hanzoai/cloud:v*, and it refuses to RENDER one of those without a digest -- so hanzo/cloud-api would have failed the render, which stops the sync and leaves the running pods alone. Better than the alternative, but the pin is the point. Eight files name an image the registry does not have and are left alone rather than guessed at; deploy/README.md lists them with what the registry does have. Co-authored-by: Hanzo Dev <[email protected]>
118 lines
2.9 KiB
YAML
118 lines
2.9 KiB
YAML
# Generated from the live zoo-devnet/zoo-ingress Deployment on do-sfo3-zoo-k8s
|
|
# by hack/live2values.py. Live is the source: a repo of hand-applied
|
|
# manifests has unknown currency, the running fleet does not.
|
|
replicas: 1
|
|
selectorLabels:
|
|
app: zoo-ingress
|
|
containerName: ingress
|
|
image:
|
|
repository: traefik
|
|
tag: v3.3.7
|
|
digest: sha256:2cd5cc75530c8d07ae0587c743d23eb30cae2436d07017a5ff78498b1a43d09f
|
|
pullPolicy: IfNotPresent
|
|
partOf: zoo
|
|
labels:
|
|
app.kubernetes.io/cluster: zoo-k8s
|
|
app.kubernetes.io/env: devnet
|
|
args:
|
|
- --providers.kubernetesingress=true
|
|
- --providers.kubernetesingress.ingressclass=ingress
|
|
- --providers.kubernetesingress.allowemptyservices=true
|
|
- --providers.kubernetescrd=true
|
|
- --providers.kubernetescrd.allowcrossnamespace=true
|
|
- --entrypoints.web.address=:80
|
|
- --entrypoints.web.http.redirections.entrypoint.to=:443
|
|
- --entrypoints.web.http.redirections.entrypoint.scheme=https
|
|
- --entrypoints.web.http.redirections.entrypoint.permanent=true
|
|
- --entrypoints.websecure.address=:443
|
|
- --entrypoints.websecure.http.tls=true
|
|
- --entrypoints.websecure.http.tls.certresolver=letsencrypt
|
|
- --[email protected]
|
|
- --certificatesresolvers.letsencrypt.acme.storage=/data/acme.json
|
|
- --certificatesresolvers.letsencrypt.acme.dnschallenge=true
|
|
- --certificatesresolvers.letsencrypt.acme.dnschallenge.provider=cloudflare
|
|
- --certificatesresolvers.letsencrypt.acme.dnschallenge.resolvers=1.1.1.1:53,8.8.8.8:53
|
|
- --ping=true
|
|
- --ping.entryPoint=web
|
|
- --log.level=INFO
|
|
- --accesslog=true
|
|
env:
|
|
- name: CF_API_EMAIL
|
|
valueFrom:
|
|
secretKeyRef:
|
|
key: EMAIL
|
|
name: cloudflare-api-credentials
|
|
- name: CF_API_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
key: APIKEY
|
|
name: cloudflare-api-credentials
|
|
resources:
|
|
limits:
|
|
cpu: '1'
|
|
memory: 512Mi
|
|
requests:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
volumeMounts:
|
|
- mountPath: /data
|
|
name: data
|
|
livenessProbe:
|
|
failureThreshold: 3
|
|
httpGet:
|
|
path: /ping
|
|
port: 80
|
|
scheme: HTTP
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 10
|
|
successThreshold: 1
|
|
timeoutSeconds: 1
|
|
readinessProbe:
|
|
failureThreshold: 3
|
|
httpGet:
|
|
path: /ping
|
|
port: 80
|
|
scheme: HTTP
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 5
|
|
successThreshold: 1
|
|
timeoutSeconds: 1
|
|
securityContext:
|
|
capabilities:
|
|
add:
|
|
- NET_BIND_SERVICE
|
|
drop:
|
|
- ALL
|
|
runAsUser: 0
|
|
ports:
|
|
- containerPort: 80
|
|
name: web
|
|
- containerPort: 443
|
|
name: websecure
|
|
volumes:
|
|
- hostPath:
|
|
path: /var/lib/zoo-ingress
|
|
type: DirectoryOrCreate
|
|
name: data
|
|
affinity:
|
|
podAntiAffinity:
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
- labelSelector:
|
|
matchExpressions:
|
|
- key: app
|
|
operator: In
|
|
values:
|
|
- zoo-ingress
|
|
topologyKey: kubernetes.io/hostname
|
|
imagePullSecrets:
|
|
- name: ghcr-secret
|
|
- name: hanzo
|
|
serviceAccountName: zoo-ingress
|
|
rollingUpdate:
|
|
maxSurge: 1
|
|
maxUnavailable: 0
|
|
topologySpread:
|
|
enabled: false
|
|
lifecycle: null
|
|
terminationGracePeriodSeconds: 30
|