feat: per-deployment internal RPC ClusterIP Service + status.rpcService

[bdchatham]

Summary

Adds a cluster-internal ClusterIP Service to every SeiNodeDeployment so in-cluster consumers can dial a single stable DNS name — {deployment}-rpc.{namespace}.svc — rather than picking an ordinal on the per-node headless Service and handling failover themselves. kube-proxy L4 load-balances across ready child pods.

Reconciled unconditionally — this path is independent of .spec.networking and lives alongside (not replacing) the existing external reconcileNetworking / HTTPRoute / External-DNS pipeline.

References

• Design: platform#96 §Critical Controller Gap
• Milestone brief: wave-autobake/milestones/M1.md

Interface contract (frozen)

status:
  rpcService:
    name: <deployment-name>-rpc
    namespace: <namespace>
    ports:
      rpc: 26657
      evmHttp: 8545
      evmWs: 8546
      rest: 1317
      grpc: 9090

• Service: ClusterIP, PublishNotReadyAddresses: false.
• Selector: sei.io/nodedeployment=<deployment> (already stamped on child pod templates via generateSeiNode → spec.PodLabels[groupLabel]).
• OwnerReferences point at the parent SeiNodeDeployment (cascade delete on DeletionPolicy: Delete; orphaned via orphanNetworkingResources on Retain).

Files changed

File	What
api/v1alpha1/seinodedeployment_types.go	New RpcServiceStatus / RpcServicePorts types; .status.rpcService pointer field.
api/v1alpha1/zz_generated.deepcopy.go	Regenerated.
config/crd/sei.io_seinodedeployments.yaml, manifests/sei.io_seinodedeployments.yaml	Regenerated CRD schema.
internal/controller/nodedeployment/internal_service.go (new)	generateInternalRpcService (pure) + reconcileInternalRpcService (SSA, stamps status in-memory).
internal/controller/nodedeployment/internal_service_test.go (new)	Generator tests + fake-client reconcile / orphan tests.
internal/controller/nodedeployment/controller.go	Invoke reconcileInternalRpcService unconditionally in the reconcile loop.
internal/controller/nodedeployment/networking.go	orphanNetworkingResources now also strips ownerRef on the internal Service.

Judgment calls / deviations

• Port name evm-http (not seiconfig's evm-rpc): the milestone brief explicitly pins the five port names in the Service spec. Keeping the brief's names, which happen to be more readable to kube-native tools; the numeric port is unchanged.
• Selector excludes revision label. The shared external Service pins to the active revision during a rollout (groupSelector); the internal Service uses groupOnlySelector so kube-proxy continues to route to whichever pods are Ready across incumbents/entrants. Covered by TestGenerateInternalRpcService_SelectorIgnoresRevision.
• No new condition type (per non-goal): the Service is unconditionally reconciled, so there's nothing lifecycle-worthy to surface.
• Single-patch model preserved: reconcileInternalRpcService mutates group.Status.RpcService in-memory. updateStatus calls the existing Status().Patch() at the end of every reconcile path (including the DNS-pending early return), so no second patch was added.
• Label propagation was already correct. generateSeiNode already writes spec.PodLabels[groupLabel] = group.Name, which flows through noderesource.ResourceLabels onto the StatefulSet's pod template. No changes needed to the labeling path — the selector contract is already satisfied.

Manual testing

# 1. Build + load image, apply CRDs + controller.
make docker-build IMG=sei-k8s-controller:m1-test
# (load into your target cluster / kind)
kubectl apply -f manifests/sei.io_seinodedeployments.yaml

# 2. Apply a private (no .spec.networking) SeiNodeDeployment.
cat <<'YAML' | kubectl apply -f -
apiVersion: sei.io/v1alpha1
kind: SeiNodeDeployment
metadata:
  name: demo-rpc
  namespace: sei
spec:
  replicas: 2
  updateStrategy:
    type: InPlace
  template:
    spec:
      chainId: pacific-1
      image: ghcr.io/sei-protocol/seid:v1.0.0
      fullNode:
        snapshot:
          s3:
            targetHeight: 100000
YAML

# 3. Verify Service and status are present.
kubectl -n sei get svc demo-rpc-rpc -o yaml
kubectl -n sei get snd demo-rpc -o jsonpath='{.status.rpcService}'

# Expected:
#   Service demo-rpc-rpc with 5 named ports (rpc/evm-http/evm-ws/rest/grpc).
#   Selector: sei.io/nodedeployment=demo-rpc
#   OwnerReference -> demo-rpc (controller=true)
#   .status.rpcService.{name, namespace, ports.{rpc,evmHttp,evmWs,rest,grpc}} populated.

# 4. Once pods are Ready, DNS + traffic should work:
kubectl -n sei run curl --image=curlimages/curl --rm -it --restart=Never -- \
  curl -sS http://demo-rpc-rpc.sei.svc:26657/status

# 5. Cascade delete:
kubectl -n sei delete snd demo-rpc
kubectl -n sei get svc demo-rpc-rpc   # should be gone

Test plan

• make lint clean.
• make test green (new tests: 9 generator + 5 reconcile/orphan cases).
• make manifests generate idempotent after commit.
• make build / make ci succeed.
• Manual smoke against a real cluster (reviewer).