zeekayandHanzo Dev
b304b5ef30
Brand-agnostic console image (brand resolved from host: console.zoo.cloud → zoo), per-brand catalog scoped to web3/bootnode admin. Blue-green Deployment+ Service alongside any live v1; go-live = provision `zoo-console-iam-creds` (KMS) + ingress cutover (lux) / DNS+ingress (zoo). Validated client-side. Co-authored-by: Hanzo Dev <[email protected]>
114 lines
3.6 KiB
YAML
114 lines
3.6 KiB
YAML
# Zoo Cloud console — hanzoai/console 8.x (brand-agnostic image; brand resolved
|
|
# at runtime from the request host: console.zoo.cloud → `zoo`). SAME image as
|
|
# console.hanzo.ai / console.lux.cloud; the per-brand catalog scope makes the Zoo
|
|
# console a WEB3 / BOOTNODE admin (Web3 + Network + Security + Dev + Settings).
|
|
#
|
|
# GO-LIVE PREREQUISITES:
|
|
# 1. DNS: `console.zoo.cloud` does not resolve yet — add the record (Cloudflare
|
|
# zone) pointing at the zoo-k8s ingress LB, + a TLS cert.
|
|
# 2. Secret: `IAM_MINT_CLIENT_*` reference `zoo-console-iam-creds` — a
|
|
# confidential `zoo-console` IAM app (registered in zoolabs.id, allow-listed
|
|
# for issue-user-token) whose clientSecret is synced from KMS. Until it
|
|
# exists, the console deploys + signs in (browser PKCE against zoolabs.id);
|
|
# server-proxied surfaces show honest "not configured" states.
|
|
# 3. Bootnode: zoo-k8s has no bootnode-api yet — the Web3 Networks module shows
|
|
# an honest "not routed on this host" state until a zoo bootnode is deployed.
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: console2
|
|
namespace: hanzo
|
|
labels:
|
|
app.kubernetes.io/name: console2
|
|
app.kubernetes.io/part-of: zoo-cloud
|
|
spec:
|
|
replicas: 2
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: console2
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: console2
|
|
spec:
|
|
imagePullSecrets:
|
|
- name: ghcr-secret
|
|
containers:
|
|
- name: console
|
|
image: ghcr.io/hanzoai/console:v8.2.0
|
|
ports:
|
|
- name: http
|
|
containerPort: 4000
|
|
env:
|
|
- name: IAM_URL
|
|
value: http://iam.hanzo.svc
|
|
- name: CLOUD_API_URL
|
|
value: http://cloud.hanzo.svc
|
|
- name: AI_GATEWAY_URL
|
|
value: http://cloud.hanzo.svc
|
|
# Zoo bootnode (deploy one to light up the Web3 Networks module).
|
|
- name: BOOTNODE_URL
|
|
value: http://bootnode-api.bootnode.svc.cluster.local
|
|
- name: IAM_MINT_CLIENT_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: zoo-console-iam-creds
|
|
key: clientId
|
|
optional: true
|
|
- name: IAM_MINT_CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: zoo-console-iam-creds
|
|
key: clientSecret
|
|
optional: true
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /signin
|
|
port: 4000
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
memory: 512Mi
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: console2
|
|
namespace: hanzo
|
|
labels:
|
|
app.kubernetes.io/name: console2
|
|
spec:
|
|
selector:
|
|
app.kubernetes.io/name: console2
|
|
ports:
|
|
- name: http
|
|
port: 4000
|
|
targetPort: 4000
|
|
---
|
|
# console.zoo.cloud → console2. Add the DNS record + TLS cert (prereq #1) for
|
|
# this host, then apply. (Ingress class/annotations follow the zoo-k8s ingress
|
|
# convention — align with the other zoo hosts in this repo before applying.)
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: console-zoo
|
|
namespace: hanzo
|
|
annotations:
|
|
kubernetes.io/ingress.class: ingress
|
|
spec:
|
|
rules:
|
|
- host: console.zoo.cloud
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: console2
|
|
port:
|
|
number: 4000
|