From c87463c850e20e465f06c4f3afa839d01f8165b9 Mon Sep 17 00:00:00 2001
From: Admin Bot <admin@riotpiao.com>
Date: Tue, 8 Sep 2026 09:58:36 -0700
Subject: [PATCH] fix(s3): correct MinIO service port and allow egress
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

MinIO ClusterIP service listens on port 80 (targetPort 9000).
Config had port 9000 which caused 30s timeout then 502 — gateway
connected to service port 9000 which doesn't exist on the ClusterIP.

Changes:
- configmap.yaml: S3 upstream :9000 → :80
- gateway-config-secret.enc.yaml: same
- network-policy.yaml: add port 80 egress to storage namespace

Verified: S3 adapter now reaches MinIO (403 AccessDenied = auth issue,
not connectivity).
---
 k8s/configmap.yaml                 | 2 +-
 k8s/gateway-config-secret.enc.yaml | 2 +-
 k8s/network-policy.yaml            | 4 ++++
 3 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/k8s/configmap.yaml b/k8s/configmap.yaml
index 0714348..14b9617 100644
--- a/k8s/configmap.yaml
+++ b/k8s/configmap.yaml
@@ -113,7 +113,7 @@ data:
 
     - serviceName: s3
       upstream:
-        url: http://minio.storage.svc.cluster.local:9000
+        url: http://minio.storage.svc.cluster.local:80
         timeoutSeconds: 30
       auth:
         required: false
diff --git a/k8s/gateway-config-secret.enc.yaml b/k8s/gateway-config-secret.enc.yaml
index 96f657f..fa55e3a 100644
--- a/k8s/gateway-config-secret.enc.yaml
+++ b/k8s/gateway-config-secret.enc.yaml
@@ -91,7 +91,7 @@ stringData:
           upstreamPath: /memory/skills
     - serviceName: s3
       upstream:
-        url: http://minio.storage.svc.cluster.local:9000
+        url: http://minio.storage.svc.cluster.local:80
         timeoutSeconds: 30
       auth:
         required: false
diff --git a/k8s/network-policy.yaml b/k8s/network-policy.yaml
index e0323aa..44364db 100644
--- a/k8s/network-policy.yaml
+++ b/k8s/network-policy.yaml
@@ -123,10 +123,14 @@ spec:
     - protocol: TCP
       port: 8080
   # Allow to MinIO (S3-compatible storage)
+  # Service `minio` listens on port 80 (targetPort 9000).
+  # Headless `minio-cluster-hl` is 9000. Allow both.
   - to:
     - namespaceSelector:
         matchLabels:
           kubernetes.io/metadata.name: storage
     ports:
+    - protocol: TCP
+      port: 80
     - protocol: TCP
       port: 9000