tegwick
5ae1f4ffc5
The upgrade failed as `pre-upgrade hooks failed: timed out waiting for the
condition`. The migrate hook was in ImagePullBackOff: tag main-11f689d does not
exist. `.forgejo/workflows/image.yaml` has a `paths:` filter that excludes
deploy/**, so the chart-only commit was green in CI and built nothing — the two
green runs on it were host-smoke and container-smoke, not build-and-push.
470ece8 carries all the code; every commit after it touches only the chart and
generated docs.
scripts/verify_image_pin.py refuses a pin whose commit has no successful
build-and-push run, and says so in those terms rather than as a timeout five
minutes later. Verified against both the bad pin and the good one; treats an
unreachable forge as inconclusive rather than as failure.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
58 lines
2.1 KiB
YAML
58 lines
2.1 KiB
YAML
# Production values for the State Hub Railiance chart handoff.
|
|
# Non-secret values only. DATABASE_URL comes from the Secret `state-hub-env`.
|
|
|
|
namespace:
|
|
create: false
|
|
|
|
image:
|
|
repository: forgejo.coulomb.social/coulomb/state-hub
|
|
tag: "main-470ece8"
|
|
|
|
ingress:
|
|
enabled: false
|
|
|
|
# MCP layer on central (CUST-WP-0067-T08). Enabled together with the image tag
|
|
# above: MCP_HOST landed in main-6c1262e, and enabling this on an older image
|
|
# would deploy a pod that binds loopback and never becomes reachable.
|
|
# ClusterIP only — no ingress, same reason the API's is disabled.
|
|
mcp:
|
|
enabled: true
|
|
|
|
config:
|
|
# This deployment is the authoritative hub. Callers verify this rather than
|
|
# trusting that whatever answered on a port is central (CUST-WP-0067-T03).
|
|
instanceRole: primary
|
|
instanceLabel: railiance01
|
|
sbomNexusUrl: "http://sbom-nexus.sbom-nexus.svc.cluster.local:8010"
|
|
# Reversible T04 read cutover; set back to `legacy` to roll back.
|
|
sbomNexusReadMode: nexus
|
|
# Reversible T04 write cutover; set back to `legacy` to roll back future writes.
|
|
sbomNexusWriteMode: nexus
|
|
|
|
resources:
|
|
# The single 4-core node currently has less than 250m unallocated. Keep enough
|
|
# headroom for maxSurge=1 so State Hub can roll without an outage.
|
|
requests:
|
|
cpu: 100m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: 1000m
|
|
memory: 2Gi
|
|
|
|
sweep:
|
|
# RMGR-WP-0005-T11: disabled while railiance01 checkouts still target the
|
|
# stale gitea-remote lineage. Re-enable only after the governed remote
|
|
# reconciliation and registrar preflight are complete.
|
|
enabled: false
|
|
# Present in the live release but previously missing here, so deploying from
|
|
# this file alone silently dropped it. Inert while enabled is false.
|
|
hostname: 239.62.205.92.host.secureserver.net
|
|
hostname: 239.62.205.92.host.secureserver.net
|
|
hostPath: /home/tegwick
|
|
sshHostPath: /home/tegwick/.ssh
|
|
|
|
# Forge read credential (STATE-WP-0084-T02). Coordinates only — the token lives
|
|
# in OpenBao at platform/workloads/state-hub/forge-derivation and reaches the
|
|
# pod through Kubernetes auth, never through this file or a Secret.
|
|
forgeRead:
|
|
enabled: true
|