apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: besu-rpc
  namespace: besu-network
  labels:
    app: besu
    component: rpc
spec:
  serviceName: besu-rpc
  replicas: 3
  selector:
    matchLabels:
      app: besu
      component: rpc
  template:
    metadata:
      labels:
        app: besu
        component: rpc
    spec:
      nodeSelector:
        pool: rpc
        role: rpc
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 100
              podAffinityTerm:
                labelSelector:
                  matchExpressions:
                    - key: component
                      operator: In
                      values:
                        - rpc
                topologyKey: topology.kubernetes.io/zone
      initContainers:
        - name: config-init
          image: busybox:1.36
          command:
            - sh
            - -c
            - |
              cp /config-source/* /config-dest/
              chmod -R 644 /config-dest/*
          volumeMounts:
            - name: config-source
              mountPath: /config-source
            - name: config-dest
              mountPath: /config-dest
          resources:
            requests:
              cpu: "10m"
              memory: "32Mi"
            limits:
              cpu: "100m"
              memory: "64Mi"
      containers:
        - name: besu
          image: hyperledger/besu:23.10.0
          imagePullPolicy: IfNotPresent
          command:
            - /opt/besu/bin/besu
            - --config-file=/config/besu-config.toml
          ports:
            - name: metrics
              containerPort: 9545
              protocol: TCP
            - name: rpc
              containerPort: 8545
              protocol: TCP
            - name: ws
              containerPort: 8546
              protocol: TCP
          env:
            - name: BESU_OPTS
              value: ""
            - name: JAVA_OPTS
              value: "-Xmx8g -Xms8g"
          resources:
            requests:
              cpu: "4"
              memory: "8Gi"
            limits:
              cpu: "8"
              memory: "16Gi"
          volumeMounts:
            - name: data
              mountPath: /data
            - name: config
              mountPath: /config
          livenessProbe:
            httpGet:
              path: /metrics
              port: metrics
            initialDelaySeconds: 120
            periodSeconds: 30
            timeoutSeconds: 10
            failureThreshold: 3
          readinessProbe:
            httpGet:
              path: /metrics
              port: metrics
            initialDelaySeconds: 60
            periodSeconds: 10
            timeoutSeconds: 5
            failureThreshold: 3
          startupProbe:
            httpGet:
              path: /metrics
              port: metrics
            initialDelaySeconds: 30
            periodSeconds: 10
            timeoutSeconds: 5
            failureThreshold: 30
      volumes:
        - name: config-source
          configMap:
            name: besu-rpc-config
  volumeClaimTemplates:
    - metadata:
        name: data
      spec:
        accessModes:
          - ReadWriteOnce
        storageClassName: managed-premium
        resources:
          requests:
            storage: 500Gi
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: besu-rpc-config
  namespace: besu-network
data:
  besu-config.toml: |
    data-path="/data/besu"
    genesis-file="/config/genesis.json"
    network-id=138
    p2p-enabled=false
    consensus-protocol="ibft2"
    miner-enabled=false
    sync-mode="SNAP"
    rpc-http-enabled=true
    rpc-http-host="0.0.0.0"
    rpc-http-port=8545
    rpc-http-api=["ETH","NET","WEB3","TXPOOL","DEBUG","TRACE"]
    # CORS and host allowlist - Update after DNS configuration
    # TODO: Restrict to specific domains/hosts in production
    rpc-http-cors-origins=["*"]
    rpc-http-host-allowlist=["*"]
    rpc-ws-enabled=true
    rpc-ws-host="0.0.0.0"
    rpc-ws-port=8546
    rpc-ws-api=["ETH","NET","WEB3","TXPOOL"]
    # WebSocket origins - Update after DNS configuration
    # TODO: Restrict to specific domains in production
    rpc-ws-origins=["*"]
    metrics-enabled=true
    metrics-port=9545
    metrics-host="0.0.0.0"
    logging="INFO"
    permissions-accounts-config-file-enabled=true
    permissions-accounts-config-file="/config/permissions-accounts.toml"
    tx-pool-max-size=16384
    tx-pool-retention-hours=12
    rpc-max-logs-range=10000
    rpc-max-trace-range=10000
    cache-size-bytes=536870912
  genesis.json: |
    {
      "config": {
        "chainId": 138,
        "berlinBlock": 0,
        "londonBlock": 0,
        "istanbulBlock": 0,
        "clique": null,
        "ibft2": {
          "blockperiodseconds": 2,
          "epochlength": 30000,
          "requesttimeoutseconds": 10
        },
        "ethash": {}
      },
      "nonce": "0x0",
      "timestamp": "0x0",
      "gasLimit": "0x1c9c380",
      "difficulty": "0x1",
      "mixHash": "0x63746963616c2062797a616e74696e65206661756c7420746f6c6572616e6365",
      "coinbase": "0x0000000000000000000000000000000000000000",
      "alloc": {
        "0x0000000000000000000000000000000000000001": {
          "balance": "0x1"
        },
        "0x0000000000000000000000000000000000000002": {
          "balance": "0x1"
        },
        "0x0000000000000000000000000000000000000003": {
          "balance": "0x1"
        },
        "0x0000000000000000000000000000000000000004": {
          "balance": "0x1"
        }
      },
      "extraData": "0x",
      "number": "0x0",
      "gasUsed": "0x0",
      "parentHash": "0x0000000000000000000000000000000000000000000000000000000000000000"
    }
  permissions-accounts.toml: |
    accounts-allowlist=[]
---
apiVersion: v1
kind: Service
metadata:
  name: besu-rpc
  namespace: besu-network
  labels:
    app: besu
    component: rpc
  annotations:
    service.beta.kubernetes.io/azure-load-balancer-internal: "false"
spec:
  type: ClusterIP
  ports:
    - name: rpc
      port: 8545
      targetPort: rpc
      protocol: TCP
    - name: ws
      port: 8546
      targetPort: ws
      protocol: TCP
    - name: metrics
      port: 9545
      targetPort: metrics
      protocol: TCP
  selector:
    app: besu
    component: rpc
---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: besu-rpc-pdb
  namespace: besu-network
spec:
  minAvailable: 2
  selector:
    matchLabels:
      app: besu
      component: rpc