feat: ServiceOffer controller + PaymentRoute CRD (replaces monetize.py)

CLAUDE.md

@@ -68,17 +68,19 @@ Components: eRPC (`erpc` ns), Frontend (`obol-frontend` ns), Cloudflared (`traef
 
 Payment-gated access to cluster services via x402 (HTTP 402 micropayments, USDC on Base/Base Sepolia, Traefik ForwardAuth).
 
-**Sell-side flow**: `obol sell http` → creates ServiceOffer CR → agent reconciles 6 stages: ModelReady → UpstreamHealthy → PaymentGateReady (x402 Middleware + pricing route) → RoutePublished (HTTPRoute) → Registered (ERC-8004 on-chain) → Ready. Traefik routes `/services/<name>/*` through ForwardAuth to upstream.
+**Sell-side flow**: `obol sell http` → creates ServiceOffer CR → `serviceoffer-controller` (controller-runtime, own Deployment in `obol-system` ns) derives child resources: Middleware (traefik.io ForwardAuth), PaymentRoute CR (obol.org), HTTPRoute (gateway API). Status conditions: UpstreamHealthy → PaymentGateReady → RoutePublished → Ready with `observedGeneration`. Finalizer ensures cleanup on deletion.
 
 **Buy-side flow**: `buy.py probe` sees 402 pricing → `buy.py buy` pre-signs ERC-3009 auths into ConfigMaps → LiteLLM serves static `paid/<remote-model>` aliases through the in-pod `x402-buyer` sidecar → each paid request spends one auth and forwards to the remote seller.
 
 **CLI**: `obol sell pricing --wallet --chain`, `obol sell inference <name> --model --price|--per-mtok`, `obol sell http <name> --wallet --chain --price|--per-request|--per-mtok --upstream --port --namespace --health-path`, `obol sell list|status|stop|delete`, `obol sell register --name --private-key-file`.
 
 **ServiceOffer CRD** (`obol.org`): Spec fields — `type` (inference|fine-tuning), `model{name,runtime}`, `upstream{service,ns,port,healthPath}`, `payment{scheme,network,payTo,price{perRequest,perMTok,perHour}}`, `path`, `registration{enabled,name,description,image}`. In phase 1, `perMTok` is accepted but enforced as `perRequest = perMTok / 1000`.
 
-**x402-verifier** (`x402` ns): ForwardAuth middleware. No match → pass through. Match + no payment → 402. Match + payment → verify with facilitator. Config in `x402-pricing` ConfigMap: `wallet`, `chain`, `facilitatorURL`, `verifyOnly`, `routes[]{pattern, price, description, priceModel, perMTok, approxTokensPerRequest, offerNamespace, offerName}`. Exposes `/metrics` and is scraped via `ServiceMonitor`.
+**PaymentRoute CRD** (`obol.org`): One CR per monetized route, owned by ServiceOffer. Replaces the shared `x402-pricing` ConfigMap. Spec: `pattern`, `price`, `payTo`, `network`, `priceModel`, `perMTok`, `approxTokensPerRequest`, `upstreamAuth`. Status: `admitted` (set by verifier when route is loaded).
 
-**Agent reconciler** (`internal/embed/skills/monetize/scripts/monetize.py`): Watches ServiceOffer CRs, creates Middleware (`traefik.io`), HTTPRoute, pricing route in ConfigMap, registration resources (ConfigMap + httpd + HTTPRoute at `/.well-known/`). All with ownerReferences for auto-GC.
+**x402-verifier** (`x402` ns): ForwardAuth middleware. Watches PaymentRoute CRs via dynamic informer (replaces ConfigMap file polling). No match → pass through. Match + no payment → 402. Match + payment → verify with facilitator. Global config (wallet, chain, facilitatorURL) from ConfigMap; per-route config from PaymentRoute CRs. Exposes `/metrics` and is scraped via `ServiceMonitor`. Separate Deployment from controller (different failure domain, scales on QPS).
+
+**serviceoffer-controller** (`obol-system` ns): controller-runtime operator that reconciles ServiceOffer CRDs. Generation-driven: derives Middleware, PaymentRoute, HTTPRoute from spec, observes convergence. Finalizer for cleanup. Replaces `monetize.py` (deleted).
 
 **ERC-8004**: On-chain registration on Base Sepolia Identity Registry (`0xEA0fE4FCF9E3017a24d9Db6e0e39B552c8648B9D`). NFT mint via remote-signer wallet, publishes `/.well-known/agent-registration.json`.
 

Dockerfile.serviceoffer-controller

@@ -0,0 +1,10 @@
+FROM golang:1.25-alpine AS builder
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+RUN CGO_ENABLED=0 go build -o /serviceoffer-controller ./cmd/serviceoffer-controller
+
+FROM gcr.io/distroless/static-debian12:nonroot
+COPY --from=builder /serviceoffer-controller /serviceoffer-controller
+ENTRYPOINT ["/serviceoffer-controller"]

cmd/serviceoffer-controller/main.go

@@ -0,0 +1,75 @@
+// serviceoffer-controller is a Kubernetes controller that reconciles
+// ServiceOffer CRDs into x402 payment-gated routes. It replaces the
+// Python-based monetize.py reconciliation loop.
+package main
+
+import (
+	"flag"
+	"os"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	"k8s.io/client-go/dynamic"
+	"k8s.io/client-go/kubernetes/scheme"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/healthz"
+	"sigs.k8s.io/controller-runtime/pkg/log/zap"
+
+	"github.com/ObolNetwork/obol-stack/internal/controller"
+)
+
+func main() {
+	var metricsAddr string
+	var probeAddr string
+
+	flag.StringVar(&metricsAddr, "metrics-bind-address", ":8383", "metrics endpoint bind address")
+	flag.StringVar(&probeAddr, "health-probe-bind-address", ":8384", "health probe bind address")
+	flag.Parse()
+
+	ctrl.SetLogger(zap.New(zap.UseDevMode(true)))
+	logger := ctrl.Log.WithName("serviceoffer-controller")
+
+	s := runtime.NewScheme()
+	utilruntime.Must(scheme.AddToScheme(s))
+
+	mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
+		Scheme:                 s,
+		HealthProbeBindAddress: probeAddr,
+	})
+	if err != nil {
+		logger.Error(err, "unable to create manager")
+		os.Exit(1)
+	}
+
+	// Create a dynamic client for unstructured ServiceOffer access.
+	cfg := ctrl.GetConfigOrDie()
+	dynClient, err := dynamic.NewForConfig(cfg)
+	if err != nil {
+		logger.Error(err, "unable to create dynamic client")
+		os.Exit(1)
+	}
+	_ = dynClient // reserved for future use (SSA patches)
+
+	reconciler := &controller.Reconciler{
+		Client: mgr.GetClient(),
+	}
+	if err := reconciler.SetupWithManager(mgr); err != nil {
+		logger.Error(err, "unable to setup controller")
+		os.Exit(1)
+	}
+
+	if err := mgr.AddHealthzCheck("healthz", healthz.Ping); err != nil {
+		logger.Error(err, "unable to set up health check")
+		os.Exit(1)
+	}
+	if err := mgr.AddReadyzCheck("readyz", healthz.Ping); err != nil {
+		logger.Error(err, "unable to set up ready check")
+		os.Exit(1)
+	}
+
+	logger.Info("starting controller")
+	if err := mgr.Start(ctrl.SetupSignalHandler()); err != nil {
+		logger.Error(err, "controller exited with error")
+		os.Exit(1)
+	}
+}

cmd/x402-verifier/main.go

@@ -13,14 +13,18 @@ import (
 	"time"
 
 	x402verifier "github.com/ObolNetwork/obol-stack/internal/x402"
+	"github.com/ObolNetwork/obol-stack/internal/x402/source"
+	"k8s.io/client-go/dynamic"
+	"k8s.io/client-go/rest"
 )
 
 func main() {
-	configPath := flag.String("config", "/config/pricing.yaml", "Path to pricing config YAML")
+	configPath := flag.String("config", "/config/pricing.yaml", "Path to pricing config YAML (global settings)")
 	listen := flag.String("listen", ":8080", "Listen address")
-	watch := flag.Bool("watch", true, "Watch config file for changes")
+	routeNamespace := flag.String("route-namespace", "x402", "Namespace to watch for PaymentRoute CRs")
 	flag.Parse()
 
+	// Load base config for global settings (wallet, chain, facilitator).
 	cfg, err := x402verifier.LoadConfig(*configPath)
 	if err != nil {
 		log.Fatalf("load config: %v", err)
@@ -41,7 +45,6 @@ func main() {
 	mux.HandleFunc("/verify", v.HandleVerify)
 	mux.HandleFunc("/healthz", v.HandleHealthz)
 	mux.HandleFunc("/readyz", v.HandleReadyz)
-	mux.HandleFunc("GET /.well-known/agent-registration.json", v.HandleWellKnown)
 	mux.Handle("GET /metrics", v.MetricsHandler())
 
 	server := &http.Server{
@@ -50,15 +53,29 @@ func main() {
 		ReadHeaderTimeout: 10 * time.Second,
 	}
 
-	// Start config watcher in background.
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
-	if *watch {
-		go x402verifier.WatchConfig(ctx, *configPath, v, 5*time.Second)
+	// Start PaymentRoute informer.
+	restCfg, err := rest.InClusterConfig()
+	if err != nil {
+		log.Fatalf("in-cluster config: %v", err)
 	}
 
-	// Handle graceful shutdown.
+	dynClient, err := dynamic.NewForConfig(restCfg)
+	if err != nil {
+		log.Fatalf("dynamic client: %v", err)
+	}
+
+	src := source.NewPaymentRouteSource(dynClient, v, *routeNamespace)
+	go func() {
+		if err := src.Run(ctx); err != nil {
+			log.Fatalf("paymentroute source: %v", err)
+		}
+	}()
+	log.Printf("route source: PaymentRoute CRs (namespace: %s)", *routeNamespace)
+
+	// Graceful shutdown.
 	sigCh := make(chan os.Signal, 1)
 	signal.Notify(sigCh, syscall.SIGINT, syscall.SIGTERM)
 	go func() {
@@ -67,9 +84,7 @@ func main() {
 		cancel()
 		shutdownCtx, shutdownCancel := context.WithTimeout(context.Background(), 5*time.Second)
 		defer shutdownCancel()
-		if err := server.Shutdown(shutdownCtx); err != nil {
-			log.Printf("shutdown error: %v", err)
-		}
+		_ = server.Shutdown(shutdownCtx)
 	}()
 
 	listener, err := net.Listen("tcp", *listen)
@@ -78,11 +93,9 @@ func main() {
 	}
 
 	log.Printf("x402 verifier listening on %s", *listen)
-	log.Printf("  config:      %s", *configPath)
 	log.Printf("  wallet:      %s", cfg.Wallet)
 	log.Printf("  chain:       %s", cfg.Chain)
 	log.Printf("  facilitator: %s", cfg.FacilitatorURL)
-	log.Printf("  routes:      %d", len(cfg.Routes))
 	log.Printf("  verifyOnly:  %v", cfg.VerifyOnly)
 
 	if err := server.Serve(listener); err != nil && err != http.ErrServerClosed {

go.mod

@@ -15,35 +15,34 @@ require (
 	github.com/hf/nsm v0.0.0-20220930140112-cd181bd646b9
 	github.com/mark3labs/x402-go v0.13.0
 	github.com/mattn/go-isatty v0.0.20
-	github.com/prometheus/client_golang v1.15.0
+	github.com/prometheus/client_golang v1.23.2
+	github.com/prometheus/client_model v0.6.2
+	github.com/prometheus/common v0.66.1
 	github.com/shopspring/decimal v1.3.1
 	github.com/urfave/cli/v2 v2.27.5
 	github.com/urfave/cli/v3 v3.6.2
 	golang.org/x/crypto v0.45.0
 	golang.org/x/sys v0.39.0
 	golang.org/x/term v0.37.0
 	gopkg.in/yaml.v3 v3.0.1
+	k8s.io/apimachinery v0.35.0
+	k8s.io/client-go v0.35.0
+	sigs.k8s.io/controller-runtime v0.23.3
 )
 
 require (
 	filippo.io/edwards25519 v1.1.0 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/StackExchange/wmi v1.2.1 // indirect
-	github.com/atotto/clipboard v0.1.4 // indirect
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/benbjohnson/clock v1.3.5 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bits-and-blooms/bitset v1.24.2 // indirect
 	github.com/blendle/zapdriver v1.3.1 // indirect
-	github.com/catppuccin/go v0.3.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/charmbracelet/bubbles v0.21.1-0.20250623103423-23b8fd6302d7 // indirect
-	github.com/charmbracelet/bubbletea v1.3.6 // indirect
 	github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc // indirect
-	github.com/charmbracelet/huh v1.0.0 // indirect
 	github.com/charmbracelet/x/ansi v0.9.3 // indirect
 	github.com/charmbracelet/x/cellbuf v0.0.13 // indirect
-	github.com/charmbracelet/x/exp/strings v0.0.0-20240722160745-212f7b056ed0 // indirect
 	github.com/charmbracelet/x/term v0.2.1 // indirect
 	github.com/consensys/gnark-crypto v0.19.2 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
@@ -53,48 +52,51 @@ require (
 	github.com/cucumber/messages/go/v21 v21.0.1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/deckarep/golang-set/v2 v2.8.0 // indirect
-	github.com/dustin/go-humanize v1.0.1 // indirect
-	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
+	github.com/emicklei/go-restful/v3 v3.12.2 // indirect
 	github.com/ethereum/c-kzg-4844/v2 v2.1.5 // indirect
 	github.com/ethereum/go-verkle v0.2.2 // indirect
+	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
 	github.com/fatih/color v1.18.0 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
-	github.com/fxamacker/cbor/v2 v2.2.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
 	github.com/gagliardetto/binary v0.8.0 // indirect
 	github.com/gagliardetto/solana-go v1.14.0 // indirect
 	github.com/gagliardetto/treeout v0.1.4 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-logr/zapr v1.3.0 // indirect
 	github.com/go-ole/go-ole v1.3.0 // indirect
+	github.com/go-openapi/jsonpointer v0.21.0 // indirect
+	github.com/go-openapi/jsonreference v0.20.2 // indirect
+	github.com/go-openapi/swag v0.23.0 // indirect
 	github.com/gofrs/uuid v4.3.1+incompatible // indirect
-	github.com/golang/protobuf v1.5.4 // indirect
+	github.com/google/btree v1.1.3 // indirect
+	github.com/google/gnostic-models v0.7.0 // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/google/go-configfs-tsm v0.2.2 // indirect
 	github.com/google/logger v1.1.1 // indirect
-	github.com/gorilla/websocket v1.4.2 // indirect
+	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
 	github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
 	github.com/hashicorp/go-memdb v1.3.4 // indirect
 	github.com/hashicorp/golang-lru v0.5.4 // indirect
 	github.com/holiman/uint256 v1.3.2 // indirect
+	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/klauspost/compress v1.18.1 // indirect
 	github.com/logrusorgru/aurora v2.0.3+incompatible // indirect
 	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
+	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-localereader v0.0.1 // indirect
 	github.com/mattn/go-runewidth v0.0.16 // indirect
-	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
 	github.com/mitchellh/go-testing-interface v1.14.1 // indirect
-	github.com/mitchellh/hashstructure/v2 v2.0.2 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/mostynb/zstdpool-freelist v0.0.0-20201229113212-927304c0c3b1 // indirect
 	github.com/mr-tron/base58 v1.2.0 // indirect
-	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
-	github.com/muesli/cancelreader v0.2.2 // indirect
 	github.com/muesli/termenv v0.16.0 // indirect
-	github.com/prometheus/client_model v0.3.0 // indirect
-	github.com/prometheus/common v0.42.0 // indirect
-	github.com/prometheus/procfs v0.9.0 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/prometheus/procfs v0.16.1 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
-	github.com/rogpeppe/go-internal v1.14.1 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/shirou/gopsutil v3.21.4-0.20210419000835-c7a38de76ee5+incompatible // indirect
 	github.com/spf13/pflag v1.0.10 // indirect
@@ -109,8 +111,24 @@ require (
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/ratelimit v0.3.1 // indirect
 	go.uber.org/zap v1.27.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.3 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/net v0.47.0 // indirect
+	golang.org/x/oauth2 v0.32.0 // indirect
 	golang.org/x/sync v0.18.0 // indirect
 	golang.org/x/text v0.31.0 // indirect
 	golang.org/x/time v0.14.0 // indirect
+	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
+	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
+	gopkg.in/inf.v0 v0.9.1 // indirect
+	k8s.io/api v0.35.0 // indirect
+	k8s.io/apiextensions-apiserver v0.35.0 // indirect
+	k8s.io/klog/v2 v2.130.1 // indirect
+	k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 // indirect
+	k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 // indirect
+	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
+	sigs.k8s.io/randfill v1.0.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.2-0.20260122202528-d9cc6641c482 // indirect
+	sigs.k8s.io/yaml v1.6.0 // indirect
 )