the name: Bikoret — code, contracts, images
Headers X-Bikoret-Key / -Rebuke / -Verdict / -Bedikah; the `bikoret` object and the "— bikoret …" fringe on a gate reply; environment variables BIKORET_*; the image user and paths (/home/bikoret, /tmp/bikoret, /var/lib/bikoret/manna, /etc/bikoret/secrets, /opt/bikoret/spec); the tmp-bikoret pod volume; local databases bikoret_dev/_test. Kubernetes resource names, the shorashim_app role and the domain are unchanged (Tamid §1.1, "the names that still carry the old word"). Doorpost c963c4fe…. Elixir 604/0, L3 10/0, korban 295, Prolog bedikah 44/44. Gitea repo renamed heaviness510/bikoret (old URL redirects). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
Scott KarpandClaude Fable 5.1 committed
1 parent
017a9b89d4
commit
c0d0555aed
46 files changed
+189
-189
No files matched your search
@@ -2,7 +2,7 @@
|
||||
# ^ The --platform=linux/amd64 pins below are DELIBERATE (Exoscale SKS
|
||||
# nodes are amd64). BuildKit lints a constant --platform as a smell;
|
||||
# here it is the fix. Silenced so a real warning is not lost in noise.
|
||||
# Shorashim Korban Processor — Python offering protocol
|
||||
# Bikoret Korban Processor — Python offering protocol
|
||||
# Construction spec §1.1: Python 3.12.2
|
||||
# Processes korbanot (model outputs) through the offering protocol
|
||||
#
|
||||
@@ -45,17 +45,17 @@ RUN python /tmp/lock_to_requirements.py poetry.lock > /tmp/requirements.txt && \
|
||||
# === RUNTIME STAGE ===
|
||||
FROM --platform=linux/amd64 python:3.12.2-slim
|
||||
|
||||
RUN useradd --create-home --shell /bin/bash shorashim
|
||||
USER shorashim
|
||||
RUN useradd --create-home --shell /bin/bash bikoret
|
||||
USER bikoret
|
||||
|
||||
WORKDIR /home/shorashim/korban_processor
|
||||
WORKDIR /home/bikoret/korban_processor
|
||||
|
||||
COPY --from=build --chown=shorashim:shorashim /app/ ./
|
||||
COPY --from=build --chown=bikoret:bikoret /app/ ./
|
||||
COPY --from=build /usr/local/lib/python3.12/site-packages/ /usr/local/lib/python3.12/site-packages/
|
||||
|
||||
# PYTHONPATH puts korban_processor first; azazel_processor is a
|
||||
# sibling package under the same src/ tree (see build stage above).
|
||||
ENV PYTHONPATH=/home/shorashim/korban_processor/src
|
||||
ENV PYTHONPATH=/home/bikoret/korban_processor/src
|
||||
|
||||
# L1 Torah filesystem — baked into the image
|
||||
# L1 is read-only in fact, not only in name. Until 2026-10-04 the scroll
|
||||
@@ -69,7 +69,7 @@ RUN chmod -R a-w,a+rX /mnt/torah
|
||||
# The second scroll (bishe'arecha §IV): the mesorah snapshot, read-only like L1.
|
||||
COPY --chown=root:root mesorah/ /mnt/mesorah/
|
||||
RUN chmod -R a-w,a+rX /mnt/mesorah
|
||||
USER shorashim
|
||||
USER bikoret
|
||||
|
||||
ENV L1_MOUNT_POINT=/mnt/torah
|
||||
ENV MESORAH_MOUNT_POINT=/mnt/mesorah
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
# ^ The --platform=linux/amd64 pins below are DELIBERATE (Exoscale SKS
|
||||
# nodes are amd64). BuildKit lints a constant --platform as a smell;
|
||||
# here it is the fix. Silenced so a real warning is not lost in noise.
|
||||
# Shorashim Shoresh Engine — Haskell root activation engine
|
||||
# Bikoret Shoresh Engine — Haskell root activation engine
|
||||
# Construction spec §1.1: GHC 9.6.4, Cabal 3.10
|
||||
# Communicates with vav_pipeline via Erlang Port (stdin/stdout)
|
||||
#
|
||||
@@ -58,10 +58,10 @@ ENV LANG=en_US.UTF-8
|
||||
ENV LANGUAGE=en_US:en
|
||||
ENV LC_ALL=en_US.UTF-8
|
||||
|
||||
RUN useradd --create-home --shell /bin/bash shorashim
|
||||
USER shorashim
|
||||
RUN useradd --create-home --shell /bin/bash bikoret
|
||||
USER bikoret
|
||||
|
||||
WORKDIR /home/shorashim
|
||||
WORKDIR /home/bikoret
|
||||
|
||||
COPY --from=build /usr/local/bin/shoresh-engine ./shoresh-engine
|
||||
|
||||
@@ -74,7 +74,7 @@ COPY --from=build /usr/local/bin/shoresh-engine ./shoresh-engine
|
||||
USER root
|
||||
COPY --chown=root:root l1/ /mnt/torah/
|
||||
RUN chmod -R a-w,a+rX /mnt/torah
|
||||
USER shorashim
|
||||
USER bikoret
|
||||
|
||||
# L1 mount point
|
||||
ENV L1_MOUNT_POINT=/mnt/torah
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
# ^ The --platform=linux/amd64 pins below are DELIBERATE (Exoscale SKS
|
||||
# nodes are amd64). BuildKit lints a constant --platform as a smell;
|
||||
# here it is the fix. Silenced so a real warning is not lost in noise.
|
||||
# Shorashim Talmudic Engine — SWI-Prolog dialectical reasoning
|
||||
# Bikoret Talmudic Engine — SWI-Prolog dialectical reasoning
|
||||
# Construction spec §1.1: SWI-Prolog 9.2.2
|
||||
# Communicates with vav_pipeline via Unix domain socket
|
||||
#
|
||||
@@ -21,12 +21,12 @@ RUN swipl -g "consult('src/main'),halt(0)" -t "halt(1)"
|
||||
# === RUNTIME STAGE ===
|
||||
FROM --platform=linux/amd64 swipl:9.2.2
|
||||
|
||||
RUN useradd --create-home --shell /bin/bash shorashim
|
||||
USER shorashim
|
||||
RUN useradd --create-home --shell /bin/bash bikoret
|
||||
USER bikoret
|
||||
|
||||
WORKDIR /home/shorashim/talmudic_engine
|
||||
WORKDIR /home/bikoret/talmudic_engine
|
||||
|
||||
COPY --from=build --chown=shorashim:shorashim /app/ ./
|
||||
COPY --from=build --chown=bikoret:bikoret /app/ ./
|
||||
|
||||
# L1 Torah filesystem — baked into the image
|
||||
# L1 is read-only in fact, not only in name. Until 2026-10-04 the scroll
|
||||
@@ -37,13 +37,13 @@ COPY --from=build --chown=shorashim:shorashim /app/ ./
|
||||
USER root
|
||||
COPY --chown=root:root l1/ /mnt/torah/
|
||||
RUN chmod -R a-w,a+rX /mnt/torah
|
||||
USER shorashim
|
||||
USER bikoret
|
||||
|
||||
# L1 mount point
|
||||
ENV L1_MOUNT_POINT=/mnt/torah
|
||||
|
||||
# Socket path for communication with vav_pipeline
|
||||
ENV TALMUDIC_SOCKET_PATH=/tmp/shorashim/talmudic.sock
|
||||
ENV TALMUDIC_SOCKET_PATH=/tmp/bikoret/talmudic.sock
|
||||
|
||||
# Start the Prolog socket server.
|
||||
#
|
||||
@@ -58,6 +58,6 @@ ENV TALMUDIC_SOCKET_PATH=/tmp/shorashim/talmudic.sock
|
||||
# is actually honoured; serve/0 falls back to the same path hardcoded
|
||||
# as default_socket_path/1. vav_pipeline dials the socket at
|
||||
# :talmudic_socket_path (config/config.exs), and deployment.yaml mounts
|
||||
# the shared talmudic-socket volume at /tmp/shorashim in both
|
||||
# the shared talmudic-socket volume at /tmp/bikoret in both
|
||||
# containers, so the two ends must agree on this path.
|
||||
CMD ["swipl", "-g", "consult('src/main'), (getenv('TALMUDIC_SOCKET_PATH', P) -> serve(P) ; serve)", "-t", "halt(1)"]
|
||||
@@ -2,7 +2,7 @@
|
||||
# ^ The --platform=linux/amd64 pins below are DELIBERATE (Exoscale SKS
|
||||
# nodes are amd64). BuildKit lints a constant --platform as a smell;
|
||||
# here it is the fix. Silenced so a real warning is not lost in noise.
|
||||
# Shorashim Vav Pipeline — Elixir/OTP release with Sanhedrin
|
||||
# Bikoret Vav Pipeline — Elixir/OTP release with Sanhedrin
|
||||
# Construction spec §1.1: Elixir 1.16.1, OTP 26.2.1
|
||||
# The pipeline and Sanhedrin run in the same BEAM VM.
|
||||
#
|
||||
@@ -59,7 +59,7 @@ FROM --platform=linux/amd64 ubuntu:jammy-20240125
|
||||
# binary onto the shoresh-bin volume with an init container). GHC-built
|
||||
# executables link libgmp; without it the spawn dies with
|
||||
# error while loading shared libraries: libgmp.so.10
|
||||
# and Shorashim runs with no root activation, no te'amim parsing and no
|
||||
# and Bikoret runs with no root activation, no te'amim parsing and no
|
||||
# gematria while still reporting itself healthy.
|
||||
RUN apt-get update && \
|
||||
apt-get install -y --no-install-recommends \
|
||||
@@ -73,13 +73,13 @@ ENV LANGUAGE=en_US:en
|
||||
ENV LC_ALL=en_US.UTF-8
|
||||
|
||||
# Non-root user — the system serves, it does not own
|
||||
RUN useradd --create-home --shell /bin/bash shorashim
|
||||
USER shorashim
|
||||
RUN useradd --create-home --shell /bin/bash bikoret
|
||||
USER bikoret
|
||||
|
||||
WORKDIR /home/shorashim
|
||||
WORKDIR /home/bikoret
|
||||
|
||||
# Copy the release
|
||||
COPY --from=build --chown=shorashim:shorashim \
|
||||
COPY --from=build --chown=bikoret:bikoret \
|
||||
/app/vav_pipeline/_build/prod/rel/vav_pipeline ./app
|
||||
|
||||
# L1 Torah filesystem — baked into the image (read-only, ~29MB)
|
||||
@@ -95,7 +95,7 @@ RUN chmod -R a-w,a+rX /mnt/torah
|
||||
# The second scroll (bishe'arecha §IV): the mesorah snapshot, read-only like L1.
|
||||
COPY --chown=root:root mesorah/ /mnt/mesorah/
|
||||
RUN chmod -R a-w,a+rX /mnt/mesorah
|
||||
USER shorashim
|
||||
USER bikoret
|
||||
|
||||
# === INSCRIBE THE DOORPOST ===
|
||||
# Devarim 11:20 — ukhtavtam al mezuzot beitecha uvish'arecha. A running
|
||||
@@ -113,20 +113,20 @@ USER shorashim
|
||||
# The hash over these files must equal Doorpost.expected_hash(); if it
|
||||
# does not, this image was built from a tree whose specs and witness
|
||||
# disagreed, and the pod says so at startup.
|
||||
COPY --chown=shorashim:shorashim BUILD_AZAZEL.md BUILD_KORBAN.md \
|
||||
/opt/shorashim/spec/
|
||||
COPY --chown=shorashim:shorashim specs/ /opt/shorashim/spec/specs/
|
||||
COPY --chown=shorashim:shorashim talmudic_engine/src/halt/ \
|
||||
/opt/shorashim/spec/talmudic_engine/src/halt/
|
||||
COPY --chown=shorashim:shorashim talmudic_engine/src/middot/ \
|
||||
/opt/shorashim/spec/talmudic_engine/src/middot/
|
||||
COPY --chown=bikoret:bikoret BUILD_AZAZEL.md BUILD_KORBAN.md \
|
||||
/opt/bikoret/spec/
|
||||
COPY --chown=bikoret:bikoret specs/ /opt/bikoret/spec/specs/
|
||||
COPY --chown=bikoret:bikoret talmudic_engine/src/halt/ \
|
||||
/opt/bikoret/spec/talmudic_engine/src/halt/
|
||||
COPY --chown=bikoret:bikoret talmudic_engine/src/middot/ \
|
||||
/opt/bikoret/spec/talmudic_engine/src/middot/
|
||||
|
||||
# L1 mount point
|
||||
ENV L1_MOUNT_POINT=/mnt/torah
|
||||
ENV MESORAH_MOUNT_POINT=/mnt/mesorah
|
||||
|
||||
# Manna provision file location
|
||||
ENV MANNA_PROVISION_FILE=/var/lib/shorashim/manna/today.json
|
||||
ENV MANNA_PROVISION_FILE=/var/lib/bikoret/manna/today.json
|
||||
|
||||
# PostgreSQL connection for L3
|
||||
# Set DATABASE_URL in production deployment
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# Shorashim ConfigMap — non-secret configuration
|
||||
# Bikoret ConfigMap — non-secret configuration
|
||||
# Construction spec §4.4: Tuning constants
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
@@ -10,20 +10,20 @@ data:
|
||||
L1_MOUNT_POINT: "/mnt/torah"
|
||||
|
||||
# Manna provision file location
|
||||
MANNA_PROVISION_FILE: "/var/lib/shorashim/manna/today.json"
|
||||
MANNA_PROVISION_FILE: "/var/lib/bikoret/manna/today.json"
|
||||
|
||||
# Talmudic Engine socket
|
||||
TALMUDIC_SOCKET_PATH: "/tmp/shorashim/talmudic.sock"
|
||||
TALMUDIC_SOCKET_PATH: "/tmp/bikoret/talmudic.sock"
|
||||
|
||||
# Korban Processor socket — the bedikah (Construction §3.9). Opened by
|
||||
# the korban-processor container, read by vav-pipeline, both over the
|
||||
# shared tmp-shorashim volume. Pod-internal; never on the network.
|
||||
KORBAN_SOCKET_PATH: "/tmp/shorashim/korban.sock"
|
||||
# shared tmp-bikoret volume. Pod-internal; never on the network.
|
||||
KORBAN_SOCKET_PATH: "/tmp/bikoret/korban.sock"
|
||||
|
||||
# Courtyard / chatzer keys — a FILE (Construction §4.6), projected from
|
||||
# the shorashim-api-keys Secret (secrets.yaml). The path is config; the
|
||||
# keys never are.
|
||||
API_KEYS_FILE: "/etc/shorashim/secrets/api_keys"
|
||||
API_KEYS_FILE: "/etc/bikoret/secrets/api_keys"
|
||||
|
||||
# The pod network. The ingress controller lives in it; only from here
|
||||
# is X-Real-IP believed as the caller's address (the pe'ah's per-IP
|
||||
|
||||
+21
-21
@@ -1,4 +1,4 @@
|
||||
# Shorashim Deployment — the mishkan
|
||||
# Bikoret Deployment — the mishkan
|
||||
#
|
||||
# Shemot 40:33 — Vay'khal Mosheh et ham'lakhah.
|
||||
#
|
||||
@@ -41,13 +41,13 @@ spec:
|
||||
# --- VOLUMES ---
|
||||
#
|
||||
# ONE shared /tmp volume, not two. There used to be a separate
|
||||
# `talmudic-socket` volume mounted at /tmp/shorashim in
|
||||
# vav-pipeline and talmudic-engine, WHILE `tmp-shorashim` was
|
||||
# `talmudic-socket` volume mounted at /tmp/bikoret in
|
||||
# vav-pipeline and talmudic-engine, WHILE `tmp-bikoret` was
|
||||
# mounted at /tmp in vav-pipeline and korban-processor. Nested
|
||||
# mounts meant /tmp/shorashim resolved to a DIFFERENT volume than
|
||||
# /tmp/shorashim reached through /tmp — so:
|
||||
# mounts meant /tmp/bikoret resolved to a DIFFERENT volume than
|
||||
# /tmp/bikoret reached through /tmp — so:
|
||||
# - korban/azazel (Python) wrote AzazelRecord JSON to
|
||||
# tmp-shorashim:/shorashim/azazel/pending_l3
|
||||
# tmp-bikoret:/bikoret/azazel/pending_l3
|
||||
# - AzazelIngest (Elixir) watched
|
||||
# talmudic-socket:/azazel/pending_l3
|
||||
# Two directories with the same pathname on two different disks.
|
||||
@@ -67,9 +67,9 @@ spec:
|
||||
persistentVolumeClaim:
|
||||
claimName: manna-pvc
|
||||
# Shared /tmp for every container that speaks over it:
|
||||
# the Talmudic Unix socket (/tmp/shorashim/talmudic.sock) and
|
||||
# the azazel file bridge (/tmp/shorashim/azazel/pending_l3).
|
||||
- name: tmp-shorashim
|
||||
# the Talmudic Unix socket (/tmp/bikoret/talmudic.sock) and
|
||||
# the azazel file bridge (/tmp/bikoret/azazel/pending_l3).
|
||||
- name: tmp-bikoret
|
||||
emptyDir: {}
|
||||
# Staging area for the Haskell shoresh-engine binary. Written
|
||||
# once by the shoresh-engine-install init container, read by
|
||||
@@ -85,7 +85,7 @@ spec:
|
||||
defaultMode: 0440
|
||||
|
||||
# --- POD SECURITY CONTEXT ---
|
||||
# Every image runs as the non-root user `shorashim` (uid/gid
|
||||
# Every image runs as the non-root user `bikoret` (uid/gid
|
||||
# 1000). fsGroup makes the kubelet chgrp the emptyDir volumes to
|
||||
# 1000 and set the setgid bit, so uid 1000 can actually WRITE
|
||||
# them. Without it the write side of each shared path depends on
|
||||
@@ -94,7 +94,7 @@ spec:
|
||||
# - shoresh-engine-install: cp ... Permission denied (loud —
|
||||
# init fails, pod never starts; this one at least shouts)
|
||||
# - azazel: the Python side cannot create
|
||||
# /tmp/shorashim/azazel/pending_l3 and the disposal channel
|
||||
# /tmp/bikoret/azazel/pending_l3 and the disposal channel
|
||||
# has nowhere to put a record
|
||||
# - talmudic-engine: cannot bind the Unix socket
|
||||
securityContext:
|
||||
@@ -142,7 +142,7 @@ spec:
|
||||
- -c
|
||||
- |
|
||||
set -e
|
||||
cp /home/shorashim/shoresh-engine /opt/shoresh/shoresh-engine
|
||||
cp /home/bikoret/shoresh-engine /opt/shoresh/shoresh-engine
|
||||
chmod 0755 /opt/shoresh/shoresh-engine
|
||||
/opt/shoresh/shoresh-engine gematria שלום >/dev/null
|
||||
echo "shoresh-engine staged and exercised at /opt/shoresh/shoresh-engine"
|
||||
@@ -223,13 +223,13 @@ spec:
|
||||
name: shorashim-secrets
|
||||
volumeMounts:
|
||||
- name: manna
|
||||
mountPath: /var/lib/shorashim/manna
|
||||
mountPath: /var/lib/bikoret/manna
|
||||
# One /tmp. The Talmudic socket and the azazel pending_l3
|
||||
# directory both live under it.
|
||||
- name: tmp-shorashim
|
||||
- name: tmp-bikoret
|
||||
mountPath: /tmp
|
||||
- name: api-keys
|
||||
mountPath: /etc/shorashim/secrets
|
||||
mountPath: /etc/bikoret/secrets
|
||||
readOnly: true
|
||||
- name: shoresh-bin
|
||||
mountPath: /opt/shoresh
|
||||
@@ -279,10 +279,10 @@ spec:
|
||||
image: exo.container-registry.com/the-recognition-protocol/talmudic-engine:latest
|
||||
volumeMounts:
|
||||
# Shares vav-pipeline's /tmp so the Unix socket at
|
||||
# /tmp/shorashim/talmudic.sock is the same file on both
|
||||
# sides. Mounted at /tmp (not /tmp/shorashim) so this is
|
||||
# /tmp/bikoret/talmudic.sock is the same file on both
|
||||
# sides. Mounted at /tmp (not /tmp/bikoret) so this is
|
||||
# the same volume korban-processor writes azazel records to.
|
||||
- name: tmp-shorashim
|
||||
- name: tmp-bikoret
|
||||
mountPath: /tmp
|
||||
resources:
|
||||
requests:
|
||||
@@ -295,10 +295,10 @@ spec:
|
||||
# === KORBAN PROCESSOR (sidecar) ===
|
||||
# Korban_processor imports azazel_processor (the disposal
|
||||
# channel) in the same Python process. The Python side writes
|
||||
# AzazelRecord JSON files to /tmp/shorashim/azazel/pending_l3/;
|
||||
# AzazelRecord JSON files to /tmp/bikoret/azazel/pending_l3/;
|
||||
# vav-pipeline's AzazelIngest GenServer watches that directory
|
||||
# and ingests into L3. Both containers must mount the shared
|
||||
# tmp-shorashim volume for the file bridge to work.
|
||||
# tmp-bikoret volume for the file bridge to work.
|
||||
# Since 2026-10-05 it also listens on KORBAN_SOCKET_PATH (shared
|
||||
# /tmp) for the bedikah — vav-pipeline is the only caller.
|
||||
- name: korban-processor
|
||||
@@ -307,7 +307,7 @@ spec:
|
||||
- configMapRef:
|
||||
name: shorashim-config
|
||||
volumeMounts:
|
||||
- name: tmp-shorashim
|
||||
- name: tmp-bikoret
|
||||
mountPath: /tmp
|
||||
resources:
|
||||
requests:
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
# Gitea behind the shared ingress — TCP passthrough
|
||||
#
|
||||
# One NLB for the cluster (185.19.28.170, the ingress-nginx Service)
|
||||
# instead of one per Service. Shorashim is an HTTP Ingress
|
||||
# instead of one per Service. Bikoret is an HTTP Ingress
|
||||
# (service.yaml). Gitea has no hostname that resolves
|
||||
# (gitea.temple-council.ch is configured in Gitea and exists nowhere),
|
||||
# and host-based routing needs a name — so Gitea rides the ingress
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# Shorashim Secrets — template only
|
||||
# Bikoret Secrets — template only
|
||||
# NEVER commit actual secret values to git.
|
||||
# Apply with: kubectl apply -f - after filling in values.
|
||||
#
|
||||
@@ -52,7 +52,7 @@ stringData:
|
||||
# import base64, json, subprocess, sys, urllib.parse
|
||||
# avn = json.load(sys.stdin)["password"]
|
||||
# app = subprocess.run(
|
||||
# ["kubectl", "get", "secret", "shorashim-secrets", "-n", "shorashim",
|
||||
# ["kubectl", "get", "secret", "shorashim-secrets", "-n", "bikoret",
|
||||
# "-o", "jsonpath={.data.DATABASE_URL}"],
|
||||
# capture_output=True, text=True, check=True).stdout
|
||||
# u = urllib.parse.urlsplit(base64.b64decode(app).decode())
|
||||
@@ -94,7 +94,7 @@ stringData:
|
||||
# shorashim-api-keys — who may enter the courtyard
|
||||
# ============================================================
|
||||
#
|
||||
# Mounted as the file /etc/shorashim/secrets/api_keys in vav-pipeline
|
||||
# Mounted as the file /etc/bikoret/secrets/api_keys in vav-pipeline
|
||||
# (Construction §4.6: a secret is a file). One key per line:
|
||||
#
|
||||
# courtyard <key> offerings and bedikot (/courtyard/*)
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# Shorashim Services
|
||||
# Bikoret Services
|
||||
# Operations spec §1.1: Four access tiers
|
||||
# - Pe'ah (public, no auth)
|
||||
# - Machaneh Leviyah (authenticated)
|
||||
@@ -28,7 +28,7 @@ spec:
|
||||
# The gate to the world — through the shared ingress
|
||||
# ============================================================
|
||||
#
|
||||
# Until 2026-10-06 Shorashim had its own LoadBalancer Service
|
||||
# Until 2026-10-06 Bikoret had its own LoadBalancer Service
|
||||
# (`shorashim-external`, NLB 185.19.29.180, NodePort 30923). It is gone:
|
||||
# one NLB per Service was a third of the account's bill, and the pod saw
|
||||
# every caller as the node (kube-proxy SNAT) so the pe'ah's per-IP watch
|
||||
|
||||
Reference in new issue
Block a user