- TOURNAMENT_SERVICE_URL was 8086 but K8s service and app both use 8088
- TOURNAMENT_SELF_URL on htwg-1 should be base ingress URL (port 80),
not a direct service port — ingress routes /api/tournament to tournament service
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Official-bots now targets local tournament service (TOURNAMENT_SERVICE_URL)
instead of calling remote cluster directly
- TOURNAMENT_SELF_URL tells each cluster's tournament and official-bots
services their own public URL for cross-cluster replication
- htwg-1-prod: remove TOURNAMENT_SERVER_URL, add both new vars with correct
values (tournament active service + node IP for self-announcement)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Service is named nowchess-account-active, not nowchess-account. DNS resolution
failed on startup causing official bots to never sync and appear unavailable.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The merged rollout set JWT_PUBLIC_KEY_PATH, but the running image's
config never references it, so mp.jwt.verify.publickey.location stayed
null and every token failed with "Verification key is unresolvable".
Replace it with the MicroProfile properties the runtime reads directly
(MP_JWT_VERIFY_PUBLICKEY_LOCATION, MP_JWT_VERIFY_ISSUER), pointing at the
already-mounted ncs-jwt-keys public key. No image rebuild needed.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Reviewed-on: #416
The official-bots rollout never mounted the ncs-jwt-keys secret nor set
JWT_PUBLIC_KEY_PATH, so the service fell back to the image-baked
public.pem, which does not match the deployed signing key. Every token
failed RS256 verification -> 401.
Mount ncs-jwt-keys at /secrets/jwt and point JWT_PUBLIC_KEY_PATH there,
mirroring account/core/tournament. Verify-only, no private key.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Reviewed-on: #413
Add Argo Rollout (blueGreen), active/preview Services, and HPA for the
new analysis service (port 8087). Wire image pins into all three overlay
kustomizations and register the analysis Warehouse and freight entries in
all three Kargo Stages (staging -> eu-central-1-prod / htwg-1-prod).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
During rollout, active RS (HPA-scaled) + preview RS (also HPA-scaled) = 2x
pod count, exhausting node memory request budgets. Setting previewReplicaCount: 1
caps the preview RS at 1 pod regardless of HPA until promotion completes.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Janis Eccarius
Janis
shosho996