NetworkPolicy was blocking api-gateway → gotify.notifications.svc.cluster.local:80.
Adds egress rule to `notifications` namespace on port 80.
Required for `X-Service: notification` + `X-Resource: send-message` to deliver push notifications through the gateway.
---------
Co-authored-by: Admin Bot <[email protected]>
Reviewed-on: #48
MinIO ClusterIP service listens on port 80 (targetPort 9000).
Config had port 9000 which caused 30s timeout then 502 — gateway
connected to service port 9000 which doesn't exist on the ClusterIP.
Changes:
- configmap.yaml: S3 upstream :9000 → :80
- gateway-config-secret.enc.yaml: same
- network-policy.yaml: add port 80 egress to storage namespace
Verified: S3 adapter now reaches MinIO (403 AccessDenied = auth issue,
not connectivity).
Enable Poimen orchestrator and worker pods to reach the LLM API gateway
in the api namespace.
The api-gateway NetworkPolicy was only allowing traffic from:
- ingress-nginx (external ingress)
- monitoring (Prometheus scraping)
Added new ingress rule to allow:
- poimen namespace (orchestrator-job and worker pods)
- Port 8080 (api-gateway service port)
This fixes the DNS resolution error where orchestrator pods couldn't
reach http://api-gateway.api:8080/health from within the cluster.
Managed via ArgoCD in homelab/k8s/argocd/apps/55-api-gateway.yaml
which syncs from this repo's k8s/ directory.
Baseline for the Kong replacement on api.riotpiao.com. Brings the working
tree under version control for the first time: gateway source, the task
board that drives the agent runs, test fixtures, and K8s manifests.
Anchor the gateway ignore rule to the repo root. Unanchored, "gateway"
also matched the cmd/gateway/ source directory, so the program entrypoint
was excluded from every commit.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Admin Bot
rockandAdmin Bot
