gitadmin/fxhnt
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(infra): cockpit build+deploy off GitLab -> Gitea clone + Scaleway registry (Phase 2B)

Browse Source 
- build clones fxhnt over in-cluster Gitea SSH (gitea-sshd:2222/gitadmin/fxhnt.git)
- kaniko pushes to rg.fr-par.scw.cloud/bizworx/fxhnt-cockpit (+ cache); dropped GitLab
  --insecure/--skip-tls; registry-auth secret gitlab-registry -> scw-registry
- all deploy manifests (dagster, dashboard, 4 jobs/crons) image -> Scaleway,
  imagePullSecrets -> scw-registry

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
jgrusewski
2026-06-21 17:08:52 +02:00
parent 8110e95a9e
commit 30a97bb9c4
7 changed files with 22 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
infra/argo/cockpit-build-deploy.yaml
View File

@@ -1,10 +1,9 @@
# Argo WorkflowTemplate — build + deploy the fxhnt cockpit, fully in-cluster.
#
# Mirrors foxhunt's proven `build-ci-image` (Kaniko) + `compile-and-deploy` (kubectl) patterns, reusing the
# same cluster primitives: the `argo-workflow` ServiceAccount, the `argo-git-ssh-key` deploy key (clone over
# the in-cluster gitlab-shell), and the `gitlab-registry` dockerconfig (push to the internal registry). The
# build runs in-cluster so it reaches the registry + token endpoint natively — no laptop, no private-CA trust,
# nothing public.
# Reuses cluster primitives: the `argo-workflow` ServiceAccount, the `argo-git-ssh-key` deploy key (clone
# the fxhnt repo over in-cluster Gitea SSH, gitea-sshd:2222), and the `scw-registry` dockerconfig (push to
# the external Scaleway Container Registry rg.fr-par.scw.cloud/bizworx). Build runs in-cluster.
# (Phase 2B: migrated off the in-cluster GitLab shell + registry.)
#
# Submit: argo submit -n foxhunt --from=wftmpl/fxhnt-cockpit -p commit-sha=<sha> --watch
# (or use scripts/argo-deploy-cockpit.sh)
@@ -50,7 +49,7 @@ spec:
chmod 600 /root/.ssh/id_ed25519
printf 'Host *\n StrictHostKeyChecking no\n UserKnownHostsFile /dev/null\n' > /root/.ssh/config
git clone --no-checkout --filter=blob:none \
"ssh://git@gitlab-gitlab-shell.foxhunt.svc.cluster.local:2222/root/fxhnt.git" /workspace/src
"ssh://git@gitea-sshd.foxhunt.svc.cluster.local:2222/gitadmin/fxhnt.git" /workspace/src
cd /workspace/src && git checkout "{{workflow.parameters.commit-sha}}"
echo "checked out $(git rev-parse --short HEAD)"
volumeMounts:
@@ -64,11 +63,9 @@ spec:
/kaniko/executor \
--context=/workspace/src \
--dockerfile=/workspace/src/infra/docker/fxhnt.Dockerfile \
--destination=gitlab-registry.foxhunt.svc.cluster.local:5000/root/foxhunt/fxhnt-cockpit:latest \
--insecure-registry=gitlab-registry.foxhunt.svc.cluster.local:5000 \
--skip-tls-verify-registry=gitlab-registry.foxhunt.svc.cluster.local:5000 \
--destination=rg.fr-par.scw.cloud/bizworx/fxhnt-cockpit:latest \
--cache=true \
--cache-repo=gitlab-registry.foxhunt.svc.cluster.local:5000/root/foxhunt/cache \
--cache-repo=rg.fr-par.scw.cloud/bizworx/cache \
--snapshot-mode=redo
env:
- { name: DOCKER_CONFIG, value: /kaniko/.docker }
@@ -81,7 +78,7 @@ spec:
- { name: git-ssh-key, secret: { secretName: argo-git-ssh-key, defaultMode: 256 } }
- name: registry-auth
secret:
secretName: gitlab-registry
secretName: scw-registry
items: [{ key: .dockerconfigjson, path: config.json }]
# --- deploy: apply manifests from the repo + roll the dashboard to the fresh image ---
@@ -102,7 +99,7 @@ spec:
chmod 600 /root/.ssh/id_ed25519
printf 'Host *\n StrictHostKeyChecking no\n UserKnownHostsFile /dev/null\n' > /root/.ssh/config
git clone --no-checkout --filter=blob:none \
"ssh://git@gitlab-gitlab-shell.foxhunt.svc.cluster.local:2222/root/fxhnt.git" /workspace/src
"ssh://git@gitea-sshd.foxhunt.svc.cluster.local:2222/gitadmin/fxhnt.git" /workspace/src
cd /workspace/src && git checkout "{{workflow.parameters.commit-sha}}"
volumeMounts:
- { name: git-ssh-key, mountPath: /etc/git-ssh, readOnly: true }

4
infra/k8s/jobs/fxhnt-backtest-ingest-job.yaml
View File

@@ -26,10 +26,10 @@ spec:
nodeSelector:
k8s.scaleway.com/pool-name: platform
imagePullSecrets:
- name: gitlab-registry
- name: scw-registry
containers:
- name: ingest
image: gitlab-registry.foxhunt.svc.cluster.local:5000/root/foxhunt/fxhnt-cockpit:latest
image: rg.fr-par.scw.cloud/bizworx/fxhnt-cockpit:latest
# Full pull (no --limit). For a small-batch validation run, use:
# args: ["ingest-historical", "--limit", "100"]
command: ["fxhnt"]

4
infra/k8s/jobs/fxhnt-backtest-verdict-job.yaml
View File

@@ -23,10 +23,10 @@ spec:
nodeSelector:
k8s.scaleway.com/pool-name: platform
imagePullSecrets:
- name: gitlab-registry
- name: scw-registry
containers:
- name: backtest
image: gitlab-registry.foxhunt.svc.cluster.local:5000/root/foxhunt/fxhnt-cockpit:latest
image: rg.fr-par.scw.cloud/bizworx/fxhnt-cockpit:latest
command: ["fxhnt"]
args: ["backtest-equity", "--pit", "--n", "150", "--trailing-window-months", "12",
"--cost-bps", "15", "--delisting-return", "-0.30", "--persist-cockpit",

4
infra/k8s/jobs/fxhnt-factory-cronjob.yaml
View File

@@ -20,10 +20,10 @@ spec:
nodeSelector:
k8s.scaleway.com/pool-name: platform
imagePullSecrets:
- name: gitlab-registry
- name: scw-registry
containers:
- name: factory
image: gitlab-registry.foxhunt.svc.cluster.local:5000/root/foxhunt/fxhnt-cockpit:latest # set by CI / Kaniko push
image: rg.fr-par.scw.cloud/bizworx/fxhnt-cockpit:latest # set by CI / Kaniko push
command: ["sh", "-c"]
args:
- |

4
infra/k8s/jobs/fxhnt-forward-cronjob.yaml
View File

@@ -31,10 +31,10 @@ spec:
nodeSelector:
k8s.scaleway.com/pool-name: platform
imagePullSecrets:
- name: gitlab-registry
- name: scw-registry
containers:
- name: ingest
image: gitlab-registry.foxhunt.svc.cluster.local:5000/root/foxhunt/fxhnt-cockpit:latest # set by CI / Kaniko push
image: rg.fr-par.scw.cloud/bizworx/fxhnt-cockpit:latest # set by CI / Kaniko push
command: ["sh", "-c"]
args:
- |

6
infra/k8s/orchestration/dagster.yaml
View File

@@ -85,7 +85,7 @@ spec:
spec:
serviceAccountName: tailscale-dagster
nodeSelector: { k8s.scaleway.com/pool-name: platform }
imagePullSecrets: [{ name: gitlab-registry }]
imagePullSecrets: [{ name: scw-registry }]
initContainers:
- name: dagster-home-init # DAGSTER_HOME must be writable; seed it from the configmap
image: busybox:1.36
@@ -95,7 +95,7 @@ spec:
- { name: dagster-cfg, mountPath: /cfg, readOnly: true }
containers:
- name: webserver
image: gitlab-registry.foxhunt.svc.cluster.local:5000/root/foxhunt/fxhnt-cockpit:latest
image: rg.fr-par.scw.cloud/bizworx/fxhnt-cockpit:latest
command: ["dagster-webserver", "-h", "0.0.0.0", "-p", "3000",
"-w", "/dagster-home/workspace.yaml"]
env: &dagster_env
@@ -117,7 +117,7 @@ spec:
- { name: surfer-data, mountPath: /data }
resources: { requests: { cpu: 100m, memory: 512Mi }, limits: { cpu: "1", memory: 1Gi } }
- name: daemon
image: gitlab-registry.foxhunt.svc.cluster.local:5000/root/foxhunt/fxhnt-cockpit:latest
image: rg.fr-par.scw.cloud/bizworx/fxhnt-cockpit:latest
command: ["dagster-daemon", "run", "-w", "/dagster-home/workspace.yaml"]
env: *dagster_env
volumeMounts:

4
infra/k8s/services/fxhnt-dashboard.yaml
View File

@@ -21,10 +21,10 @@ spec:
nodeSelector:
k8s.scaleway.com/pool-name: platform
imagePullSecrets:
- name: gitlab-registry
- name: scw-registry
containers:
- name: cockpit
image: gitlab-registry.foxhunt.svc.cluster.local:5000/root/foxhunt/fxhnt-cockpit:latest
image: rg.fr-par.scw.cloud/bizworx/fxhnt-cockpit:latest
command: ["fxhnt", "serve", "--host", "0.0.0.0", "--port", "8080"] # 0.0.0.0 so the kubelet probe (pod IP) + sidecar (localhost) both reach it
env:
- name: FXHNT_OPERATIONAL_DSN