feat(infra): remove initContainers, mount shared foxhunt-binaries PVC

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

infra/k8s/services/api-gateway.yaml

@@ -37,63 +37,6 @@ spec:
         - name: scw-registry
       nodeSelector:
         k8s.scaleway.com/pool-name: foxhunt
-      initContainers:
-        - name: fetch-binary
-          securityContext:
-            runAsUser: 0
-            runAsNonRoot: false
-          image: rg.fr-par.scw.cloud/foxhunt-ci/foxhunt-runtime:latest
-          command: ["/bin/sh", "-c"]
-          args:
-            - |
-              set -e
-              SERVICE=api_gateway
-              if rclone copyto :s3:foxhunt-binaries/latest/services/$SERVICE /binaries/$SERVICE 2>/dev/null && [ -f /binaries/$SERVICE ]; then
-                chmod +x /binaries/$SERVICE
-                cp /binaries/$SERVICE /cache/$SERVICE
-                echo "Fetched $SERVICE from S3 ($(stat -c%s /binaries/$SERVICE) bytes)"
-              elif [ -f /cache/$SERVICE ]; then
-                cp /cache/$SERVICE /binaries/$SERVICE
-                chmod +x /binaries/$SERVICE
-                echo "WARNING: S3 unavailable, using cached $SERVICE"
-              else
-                echo "FATAL: No binary available for $SERVICE (S3 down + empty cache)"
-                exit 1
-              fi
-          env:
-            - name: RCLONE_S3_PROVIDER
-              value: Minio
-            - name: RCLONE_S3_ENDPOINT
-              value: "https://minio.foxhunt.svc.cluster.local:9000"
-            - name: RCLONE_CA_CERT
-              value: /etc/ssl/minio-ca/ca.crt
-            - name: RCLONE_S3_REGION
-              value: us-east-1
-            - name: RCLONE_S3_ACCESS_KEY_ID
-              valueFrom:
-                secretKeyRef:
-                  name: minio-credentials
-                  key: access-key
-            - name: RCLONE_S3_SECRET_ACCESS_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: minio-credentials
-                  key: secret-key
-          volumeMounts:
-            - name: binaries
-              mountPath: /binaries
-            - name: binary-cache
-              mountPath: /cache
-            - name: minio-ca
-              mountPath: /etc/ssl/minio-ca
-              readOnly: true
-          resources:
-            requests:
-              cpu: 100m
-              memory: 64Mi
-            limits:
-              cpu: 500m
-              memory: 128Mi
       containers:
         - name: api-gateway
           image: rg.fr-par.scw.cloud/foxhunt-ci/foxhunt-runtime:latest
@@ -169,14 +112,9 @@ spec:
               memory: 512Mi
       volumes:
         - name: binaries
-          emptyDir:
-            sizeLimit: 200Mi
-        - name: binary-cache
           persistentVolumeClaim:
-            claimName: binary-cache-api-gateway
-        - name: minio-ca
-          configMap:
-            name: minio-ca-cert
+            claimName: foxhunt-binaries
+            readOnly: true
         - name: tmp
           emptyDir:
             sizeLimit: 50Mi

infra/k8s/services/backtesting-service.yaml

@@ -37,63 +37,6 @@ spec:
         - name: scw-registry
       nodeSelector:
         k8s.scaleway.com/pool-name: foxhunt
-      initContainers:
-        - name: fetch-binary
-          securityContext:
-            runAsUser: 0
-            runAsNonRoot: false
-          image: rg.fr-par.scw.cloud/foxhunt-ci/foxhunt-runtime:latest
-          command: ["/bin/sh", "-c"]
-          args:
-            - |
-              set -e
-              SERVICE=backtesting_service
-              if rclone copyto :s3:foxhunt-binaries/latest/services/$SERVICE /binaries/$SERVICE 2>/dev/null && [ -f /binaries/$SERVICE ]; then
-                chmod +x /binaries/$SERVICE
-                cp /binaries/$SERVICE /cache/$SERVICE
-                echo "Fetched $SERVICE from S3 ($(stat -c%s /binaries/$SERVICE) bytes)"
-              elif [ -f /cache/$SERVICE ]; then
-                cp /cache/$SERVICE /binaries/$SERVICE
-                chmod +x /binaries/$SERVICE
-                echo "WARNING: S3 unavailable, using cached $SERVICE"
-              else
-                echo "FATAL: No binary available for $SERVICE (S3 down + empty cache)"
-                exit 1
-              fi
-          env:
-            - name: RCLONE_S3_PROVIDER
-              value: Minio
-            - name: RCLONE_S3_ENDPOINT
-              value: "https://minio.foxhunt.svc.cluster.local:9000"
-            - name: RCLONE_CA_CERT
-              value: /etc/ssl/minio-ca/ca.crt
-            - name: RCLONE_S3_REGION
-              value: us-east-1
-            - name: RCLONE_S3_ACCESS_KEY_ID
-              valueFrom:
-                secretKeyRef:
-                  name: minio-credentials
-                  key: access-key
-            - name: RCLONE_S3_SECRET_ACCESS_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: minio-credentials
-                  key: secret-key
-          volumeMounts:
-            - name: binaries
-              mountPath: /binaries
-            - name: binary-cache
-              mountPath: /cache
-            - name: minio-ca
-              mountPath: /etc/ssl/minio-ca
-              readOnly: true
-          resources:
-            requests:
-              cpu: 100m
-              memory: 64Mi
-            limits:
-              cpu: 500m
-              memory: 128Mi
       containers:
         - name: backtesting-service
           image: rg.fr-par.scw.cloud/foxhunt-ci/foxhunt-runtime:latest
@@ -161,14 +104,9 @@ spec:
               memory: 512Mi
       volumes:
         - name: binaries
-          emptyDir:
-            sizeLimit: 200Mi
-        - name: binary-cache
           persistentVolumeClaim:
-            claimName: binary-cache-backtesting-service
-        - name: minio-ca
-          configMap:
-            name: minio-ca-cert
+            claimName: foxhunt-binaries
+            readOnly: true
         - name: tmp
           emptyDir:
             sizeLimit: 50Mi

infra/k8s/services/broker-gateway.yaml

@@ -37,63 +37,6 @@ spec:
         - name: scw-registry
       nodeSelector:
         k8s.scaleway.com/pool-name: foxhunt
-      initContainers:
-        - name: fetch-binary
-          securityContext:
-            runAsUser: 0
-            runAsNonRoot: false
-          image: rg.fr-par.scw.cloud/foxhunt-ci/foxhunt-runtime:latest
-          command: ["/bin/sh", "-c"]
-          args:
-            - |
-              set -e
-              SERVICE=broker_gateway_service
-              if rclone copyto :s3:foxhunt-binaries/latest/services/$SERVICE /binaries/$SERVICE 2>/dev/null && [ -f /binaries/$SERVICE ]; then
-                chmod +x /binaries/$SERVICE
-                cp /binaries/$SERVICE /cache/$SERVICE
-                echo "Fetched $SERVICE from S3 ($(stat -c%s /binaries/$SERVICE) bytes)"
-              elif [ -f /cache/$SERVICE ]; then
-                cp /cache/$SERVICE /binaries/$SERVICE
-                chmod +x /binaries/$SERVICE
-                echo "WARNING: S3 unavailable, using cached $SERVICE"
-              else
-                echo "FATAL: No binary available for $SERVICE (S3 down + empty cache)"
-                exit 1
-              fi
-          env:
-            - name: RCLONE_S3_PROVIDER
-              value: Minio
-            - name: RCLONE_S3_ENDPOINT
-              value: "https://minio.foxhunt.svc.cluster.local:9000"
-            - name: RCLONE_CA_CERT
-              value: /etc/ssl/minio-ca/ca.crt
-            - name: RCLONE_S3_REGION
-              value: us-east-1
-            - name: RCLONE_S3_ACCESS_KEY_ID
-              valueFrom:
-                secretKeyRef:
-                  name: minio-credentials
-                  key: access-key
-            - name: RCLONE_S3_SECRET_ACCESS_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: minio-credentials
-                  key: secret-key
-          volumeMounts:
-            - name: binaries
-              mountPath: /binaries
-            - name: binary-cache
-              mountPath: /cache
-            - name: minio-ca
-              mountPath: /etc/ssl/minio-ca
-              readOnly: true
-          resources:
-            requests:
-              cpu: 100m
-              memory: 64Mi
-            limits:
-              cpu: 500m
-              memory: 128Mi
       containers:
         - name: broker-gateway
           image: rg.fr-par.scw.cloud/foxhunt-ci/foxhunt-runtime:latest
@@ -172,14 +115,9 @@ spec:
               memory: 512Mi
       volumes:
         - name: binaries
-          emptyDir:
-            sizeLimit: 200Mi
-        - name: binary-cache
           persistentVolumeClaim:
-            claimName: binary-cache-broker-gateway
-        - name: minio-ca
-          configMap:
-            name: minio-ca-cert
+            claimName: foxhunt-binaries
+            readOnly: true
         - name: tmp
           emptyDir:
             sizeLimit: 50Mi

infra/k8s/services/data-acquisition-service.yaml

@@ -37,63 +37,6 @@ spec:
         - name: scw-registry
       nodeSelector:
         k8s.scaleway.com/pool-name: foxhunt
-      initContainers:
-        - name: fetch-binary
-          securityContext:
-            runAsUser: 0
-            runAsNonRoot: false
-          image: rg.fr-par.scw.cloud/foxhunt-ci/foxhunt-runtime:latest
-          command: ["/bin/sh", "-c"]
-          args:
-            - |
-              set -e
-              SERVICE=data_acquisition_service
-              if rclone copyto :s3:foxhunt-binaries/latest/services/$SERVICE /binaries/$SERVICE 2>/dev/null && [ -f /binaries/$SERVICE ]; then
-                chmod +x /binaries/$SERVICE
-                cp /binaries/$SERVICE /cache/$SERVICE
-                echo "Fetched $SERVICE from S3 ($(stat -c%s /binaries/$SERVICE) bytes)"
-              elif [ -f /cache/$SERVICE ]; then
-                cp /cache/$SERVICE /binaries/$SERVICE
-                chmod +x /binaries/$SERVICE
-                echo "WARNING: S3 unavailable, using cached $SERVICE"
-              else
-                echo "FATAL: No binary available for $SERVICE (S3 down + empty cache)"
-                exit 1
-              fi
-          env:
-            - name: RCLONE_S3_PROVIDER
-              value: Minio
-            - name: RCLONE_S3_ENDPOINT
-              value: "https://minio.foxhunt.svc.cluster.local:9000"
-            - name: RCLONE_CA_CERT
-              value: /etc/ssl/minio-ca/ca.crt
-            - name: RCLONE_S3_REGION
-              value: us-east-1
-            - name: RCLONE_S3_ACCESS_KEY_ID
-              valueFrom:
-                secretKeyRef:
-                  name: minio-credentials
-                  key: access-key
-            - name: RCLONE_S3_SECRET_ACCESS_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: minio-credentials
-                  key: secret-key
-          volumeMounts:
-            - name: binaries
-              mountPath: /binaries
-            - name: binary-cache
-              mountPath: /cache
-            - name: minio-ca
-              mountPath: /etc/ssl/minio-ca
-              readOnly: true
-          resources:
-            requests:
-              cpu: 100m
-              memory: 64Mi
-            limits:
-              cpu: 500m
-              memory: 128Mi
       containers:
         - name: data-acquisition-service
           image: rg.fr-par.scw.cloud/foxhunt-ci/foxhunt-runtime:latest
@@ -152,14 +95,9 @@ spec:
               memory: 1Gi
       volumes:
         - name: binaries
-          emptyDir:
-            sizeLimit: 200Mi
-        - name: binary-cache
           persistentVolumeClaim:
-            claimName: binary-cache-data-acquisition-service
-        - name: minio-ca
-          configMap:
-            name: minio-ca-cert
+            claimName: foxhunt-binaries
+            readOnly: true
         - name: tmp
           emptyDir:
             sizeLimit: 50Mi

infra/k8s/services/ml-training-service.yaml

@@ -80,63 +80,6 @@ spec:
         - name: scw-registry
       nodeSelector:
         k8s.scaleway.com/pool-name: foxhunt
-      initContainers:
-        - name: fetch-binary
-          securityContext:
-            runAsUser: 0
-            runAsNonRoot: false
-          image: rg.fr-par.scw.cloud/foxhunt-ci/foxhunt-runtime:latest
-          command: ["/bin/sh", "-c"]
-          args:
-            - |
-              set -e
-              SERVICE=ml_training_service
-              if rclone copyto :s3:foxhunt-binaries/latest/services/$SERVICE /binaries/$SERVICE 2>/dev/null && [ -f /binaries/$SERVICE ]; then
-                chmod +x /binaries/$SERVICE
-                cp /binaries/$SERVICE /cache/$SERVICE
-                echo "Fetched $SERVICE from S3 ($(stat -c%s /binaries/$SERVICE) bytes)"
-              elif [ -f /cache/$SERVICE ]; then
-                cp /cache/$SERVICE /binaries/$SERVICE
-                chmod +x /binaries/$SERVICE
-                echo "WARNING: S3 unavailable, using cached $SERVICE"
-              else
-                echo "FATAL: No binary available for $SERVICE (S3 down + empty cache)"
-                exit 1
-              fi
-          env:
-            - name: RCLONE_S3_PROVIDER
-              value: Minio
-            - name: RCLONE_S3_ENDPOINT
-              value: "https://minio.foxhunt.svc.cluster.local:9000"
-            - name: RCLONE_CA_CERT
-              value: /etc/ssl/minio-ca/ca.crt
-            - name: RCLONE_S3_REGION
-              value: us-east-1
-            - name: RCLONE_S3_ACCESS_KEY_ID
-              valueFrom:
-                secretKeyRef:
-                  name: minio-credentials
-                  key: access-key
-            - name: RCLONE_S3_SECRET_ACCESS_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: minio-credentials
-                  key: secret-key
-          volumeMounts:
-            - name: binaries
-              mountPath: /binaries
-            - name: binary-cache
-              mountPath: /cache
-            - name: minio-ca
-              mountPath: /etc/ssl/minio-ca
-              readOnly: true
-          resources:
-            requests:
-              cpu: 100m
-              memory: 64Mi
-            limits:
-              cpu: 500m
-              memory: 128Mi
       containers:
         - name: ml-training-service
           image: rg.fr-par.scw.cloud/foxhunt-ci/foxhunt-runtime:latest
@@ -222,11 +165,9 @@ spec:
               memory: 512Mi
       volumes:
         - name: binaries
-          emptyDir:
-            sizeLimit: 200Mi
-        - name: binary-cache
           persistentVolumeClaim:
-            claimName: binary-cache-ml-training-service
+            claimName: foxhunt-binaries
+            readOnly: true
         - name: tls-certs
           secret:
             secretName: ml-training-tls

infra/k8s/services/trading-agent-service.yaml

@@ -37,63 +37,6 @@ spec:
         - name: scw-registry
       nodeSelector:
         k8s.scaleway.com/pool-name: foxhunt
-      initContainers:
-        - name: fetch-binary
-          securityContext:
-            runAsUser: 0
-            runAsNonRoot: false
-          image: rg.fr-par.scw.cloud/foxhunt-ci/foxhunt-runtime:latest
-          command: ["/bin/sh", "-c"]
-          args:
-            - |
-              set -e
-              SERVICE=trading_agent_service
-              if rclone copyto :s3:foxhunt-binaries/latest/services/$SERVICE /binaries/$SERVICE 2>/dev/null && [ -f /binaries/$SERVICE ]; then
-                chmod +x /binaries/$SERVICE
-                cp /binaries/$SERVICE /cache/$SERVICE
-                echo "Fetched $SERVICE from S3 ($(stat -c%s /binaries/$SERVICE) bytes)"
-              elif [ -f /cache/$SERVICE ]; then
-                cp /cache/$SERVICE /binaries/$SERVICE
-                chmod +x /binaries/$SERVICE
-                echo "WARNING: S3 unavailable, using cached $SERVICE"
-              else
-                echo "FATAL: No binary available for $SERVICE (S3 down + empty cache)"
-                exit 1
-              fi
-          env:
-            - name: RCLONE_S3_PROVIDER
-              value: Minio
-            - name: RCLONE_S3_ENDPOINT
-              value: "https://minio.foxhunt.svc.cluster.local:9000"
-            - name: RCLONE_CA_CERT
-              value: /etc/ssl/minio-ca/ca.crt
-            - name: RCLONE_S3_REGION
-              value: us-east-1
-            - name: RCLONE_S3_ACCESS_KEY_ID
-              valueFrom:
-                secretKeyRef:
-                  name: minio-credentials
-                  key: access-key
-            - name: RCLONE_S3_SECRET_ACCESS_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: minio-credentials
-                  key: secret-key
-          volumeMounts:
-            - name: binaries
-              mountPath: /binaries
-            - name: binary-cache
-              mountPath: /cache
-            - name: minio-ca
-              mountPath: /etc/ssl/minio-ca
-              readOnly: true
-          resources:
-            requests:
-              cpu: 100m
-              memory: 64Mi
-            limits:
-              cpu: 500m
-              memory: 128Mi
       containers:
         - name: trading-agent-service
           image: rg.fr-par.scw.cloud/foxhunt-ci/foxhunt-runtime:latest
@@ -159,14 +102,9 @@ spec:
               memory: 512Mi
       volumes:
         - name: binaries
-          emptyDir:
-            sizeLimit: 200Mi
-        - name: binary-cache
           persistentVolumeClaim:
-            claimName: binary-cache-trading-agent-service
-        - name: minio-ca
-          configMap:
-            name: minio-ca-cert
+            claimName: foxhunt-binaries
+            readOnly: true
         - name: tmp
           emptyDir:
             sizeLimit: 50Mi

infra/k8s/services/trading-service.yaml

@@ -37,63 +37,6 @@ spec:
         - name: scw-registry
       nodeSelector:
         k8s.scaleway.com/pool-name: foxhunt
-      initContainers:
-        - name: fetch-binary
-          securityContext:
-            runAsUser: 0
-            runAsNonRoot: false
-          image: rg.fr-par.scw.cloud/foxhunt-ci/foxhunt-runtime:latest
-          command: ["/bin/sh", "-c"]
-          args:
-            - |
-              set -e
-              SERVICE=trading_service
-              if rclone copyto :s3:foxhunt-binaries/latest/services/$SERVICE /binaries/$SERVICE 2>/dev/null && [ -f /binaries/$SERVICE ]; then
-                chmod +x /binaries/$SERVICE
-                cp /binaries/$SERVICE /cache/$SERVICE
-                echo "Fetched $SERVICE from S3 ($(stat -c%s /binaries/$SERVICE) bytes)"
-              elif [ -f /cache/$SERVICE ]; then
-                cp /cache/$SERVICE /binaries/$SERVICE
-                chmod +x /binaries/$SERVICE
-                echo "WARNING: S3 unavailable, using cached $SERVICE"
-              else
-                echo "FATAL: No binary available for $SERVICE (S3 down + empty cache)"
-                exit 1
-              fi
-          env:
-            - name: RCLONE_S3_PROVIDER
-              value: Minio
-            - name: RCLONE_S3_ENDPOINT
-              value: "https://minio.foxhunt.svc.cluster.local:9000"
-            - name: RCLONE_CA_CERT
-              value: /etc/ssl/minio-ca/ca.crt
-            - name: RCLONE_S3_REGION
-              value: us-east-1
-            - name: RCLONE_S3_ACCESS_KEY_ID
-              valueFrom:
-                secretKeyRef:
-                  name: minio-credentials
-                  key: access-key
-            - name: RCLONE_S3_SECRET_ACCESS_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: minio-credentials
-                  key: secret-key
-          volumeMounts:
-            - name: binaries
-              mountPath: /binaries
-            - name: binary-cache
-              mountPath: /cache
-            - name: minio-ca
-              mountPath: /etc/ssl/minio-ca
-              readOnly: true
-          resources:
-            requests:
-              cpu: 100m
-              memory: 64Mi
-            limits:
-              cpu: 500m
-              memory: 128Mi
       containers:
         - name: trading-service
           image: rg.fr-par.scw.cloud/foxhunt-ci/foxhunt-runtime:latest
@@ -176,14 +119,9 @@ spec:
               memory: 512Mi
       volumes:
         - name: binaries
-          emptyDir:
-            sizeLimit: 200Mi
-        - name: binary-cache
           persistentVolumeClaim:
-            claimName: binary-cache-trading-service
-        - name: minio-ca
-          configMap:
-            name: minio-ca-cert
+            claimName: foxhunt-binaries
+            readOnly: true
         - name: tmp
           emptyDir:
             sizeLimit: 50Mi

infra/k8s/services/web-gateway.yaml

@@ -37,66 +37,6 @@ spec:
         - name: scw-registry
       nodeSelector:
         k8s.scaleway.com/pool-name: foxhunt
-      initContainers:
-        - name: fetch-binary
-          securityContext:
-            runAsUser: 0
-            runAsNonRoot: false
-          image: rg.fr-par.scw.cloud/foxhunt-ci/foxhunt-runtime:latest
-          command: ["/bin/sh", "-c"]
-          args:
-            - |
-              set -e
-              SERVICE=web-gateway
-              if rclone copyto :s3:foxhunt-binaries/latest/services/$SERVICE /binaries/$SERVICE 2>/dev/null && [ -f /binaries/$SERVICE ]; then
-                chmod +x /binaries/$SERVICE
-                cp /binaries/$SERVICE /cache/$SERVICE
-                rclone sync :s3:foxhunt-binaries/latest/web-dashboard/dist/ /binaries/static/
-                cp -r /binaries/static /cache/static 2>/dev/null || true
-                echo "Fetched $SERVICE + static assets from S3"
-              elif [ -f /cache/$SERVICE ]; then
-                cp /cache/$SERVICE /binaries/$SERVICE
-                chmod +x /binaries/$SERVICE
-                cp -r /cache/static /binaries/static 2>/dev/null || true
-                echo "WARNING: S3 unavailable, using cached $SERVICE"
-              else
-                echo "FATAL: No binary available for $SERVICE"
-                exit 1
-              fi
-          env:
-            - name: RCLONE_S3_PROVIDER
-              value: Minio
-            - name: RCLONE_S3_ENDPOINT
-              value: "https://minio.foxhunt.svc.cluster.local:9000"
-            - name: RCLONE_CA_CERT
-              value: /etc/ssl/minio-ca/ca.crt
-            - name: RCLONE_S3_REGION
-              value: us-east-1
-            - name: RCLONE_S3_ACCESS_KEY_ID
-              valueFrom:
-                secretKeyRef:
-                  name: minio-credentials
-                  key: access-key
-            - name: RCLONE_S3_SECRET_ACCESS_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: minio-credentials
-                  key: secret-key
-          volumeMounts:
-            - name: binaries
-              mountPath: /binaries
-            - name: binary-cache
-              mountPath: /cache
-            - name: minio-ca
-              mountPath: /etc/ssl/minio-ca
-              readOnly: true
-          resources:
-            requests:
-              cpu: 100m
-              memory: 64Mi
-            limits:
-              cpu: 500m
-              memory: 128Mi
       containers:
         - name: web-gateway
           image: rg.fr-par.scw.cloud/foxhunt-ci/foxhunt-runtime:latest
@@ -161,14 +101,9 @@ spec:
               memory: 256Mi
       volumes:
         - name: binaries
-          emptyDir:
-            sizeLimit: 200Mi
-        - name: binary-cache
           persistentVolumeClaim:
-            claimName: binary-cache-web-gateway
-        - name: minio-ca
-          configMap:
-            name: minio-ca-cert
+            claimName: foxhunt-binaries
+            readOnly: true
         - name: tmp
           emptyDir:
             sizeLimit: 50Mi