infra: own-memory Job for Deribit funding ingest + cross-venue carry walk-forward (daemon OOM'd)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

infra/k8s/jobs/fxhnt-deribit-carry-job.yaml

@@ -0,0 +1,71 @@
+# One-shot: ingest Deribit funding (BTC/ETH) + run the cross-venue-carry OOS walk-forward, in an own-memory Job
+# (the daemon OOM'd on cumulative session load). NO PVC, git-sync, reads/writes TimescaleDB networked.
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: fxhnt-deribit-carry
+  namespace: foxhunt
+  labels: { app.kubernetes.io/name: fxhnt-deribit-carry, app.kubernetes.io/part-of: foxhunt }
+spec:
+  backoffLimit: 1
+  ttlSecondsAfterFinished: 604800
+  template:
+    metadata:
+      labels: { app.kubernetes.io/name: fxhnt-deribit-carry, app.kubernetes.io/part-of: foxhunt }
+    spec:
+      restartPolicy: Never
+      imagePullSecrets:
+        - name: scw-registry
+      initContainers:
+        - name: git-sync
+          image: alpine/git:latest
+          command: [/bin/sh, -c]
+          args:
+            - |
+              mkdir -p /root/.ssh && cp /etc/git-ssh/ssh-privatekey /root/.ssh/id_ed25519 && chmod 600 /root/.ssh/id_ed25519
+              printf 'Host *\n  StrictHostKeyChecking no\n  UserKnownHostsFile /dev/null\n' > /root/.ssh/config
+              rm -rf /code/src
+              git clone --depth 1 --branch master --filter=blob:none --sparse \
+                "ssh://git@gitea-sshd.foxhunt.svc.cluster.local:22/gitadmin/fxhnt.git" /tmp/repo
+              cd /tmp/repo && git sparse-checkout set src && [ -d /tmp/repo/src ]
+              cp -a /tmp/repo/src /code/src && echo "git-sync OK: $(git rev-parse --short HEAD)"
+          resources: { requests: { cpu: 50m, memory: 64Mi }, limits: { cpu: 500m, memory: 256Mi } }
+          volumeMounts:
+            - { name: code, mountPath: /code }
+            - { name: git-ssh-key, mountPath: /etc/git-ssh, readOnly: true }
+      containers:
+        - name: carry
+          image: rg.fr-par.scw.cloud/bizworx/fxhnt-cockpit:latest
+          command: ["sh", "-c", "fxhnt ingest-deribit-funding --instruments BTC-PERPETUAL,ETH-PERPETUAL && echo '=== WALK-FORWARD ===' && fxhnt cross-venue-carry-eval --walk-forward --all"]
+          env:
+            - { name: PYTHONPATH, value: /code/src }
+            - { name: FXHNT_OPERATIONAL_DSN, value: "postgresql+psycopg://foxhunt@postgres.foxhunt.svc.cluster.local:5432/fxhnt" }
+            - name: PGPASSWORD
+              valueFrom: { secretKeyRef: { name: db-credentials, key: password } }
+            - { name: PYTHONUNBUFFERED, value: "1" }
+          resources:
+            requests: { memory: "1Gi", cpu: "500m" }
+            limits: { memory: "4Gi", cpu: "2" }
+          volumeMounts:
+            - { name: code, mountPath: /code, readOnly: true }
+      volumes:
+        - { name: code, emptyDir: {} }
+        - { name: git-ssh-key, secret: { secretName: argo-git-ssh-key, defaultMode: 256 } }
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: fxhnt-deribit-carry
+  namespace: foxhunt
+  labels: { app.kubernetes.io/part-of: foxhunt }
+spec:
+  podSelector: { matchLabels: { app.kubernetes.io/name: fxhnt-deribit-carry } }
+  policyTypes: [Egress]
+  egress:
+    - ports: [{ port: 53, protocol: UDP }, { port: 53, protocol: TCP }]
+    - to: [{ podSelector: { matchLabels: { app.kubernetes.io/name: postgres } } }]
+      ports: [{ port: 5432, protocol: TCP }]
+    - to: [{ podSelector: { matchLabels: { app.kubernetes.io/name: gitea } } }]
+      ports: [{ port: 2222, protocol: TCP }, { port: 22, protocol: TCP }]
+    - to: [{ ipBlock: { cidr: 0.0.0.0/0, except: [10.32.0.0/16, 172.16.0.0/16] } }]   # Deribit API (443)
+      ports: [{ port: 443, protocol: TCP }]