## Problem
The new `api-gateway` ServiceMonitor discovers all 3 replicas, but every scrape
fails with `context deadline exceeded`:
```
down api-gateway api-gateway-6986b7c889-pmt4b err=Get "http://10.244.0.180:8080/metrics": context deadline
down api-gateway api-gateway-6986b7c889-c28dt err=Get "http://10.244.1.1:8080/metrics": context deadline
down api-gateway api-gateway-6986b7c889-552gl err=Get "http://10.244.2.61:8080/metrics": context deadline
```
## Cause
`network-policy.yaml` allowed Prometheus ingress with:
```yaml
namespaceSelector:
matchLabels:
name: monitoring
```
Only `ingress-nginx` carries a plain `name:` label in this cluster. Every other
namespace has just `kubernetes.io/metadata.name`, so this rule matched **nothing**
and silently denied the scrape. (The rule directly above it — `name: ingress-nginx`
— works only because that namespace is the documented exception.)
## Fix
Select on `kubernetes.io/metadata.name: monitoring`.
## Impact
Unblocks gateway metrics: `llm_ttft_seconds`, `llm_itl_seconds`,
`llm_tokens_total`, `queue_full_requests_total`,
`warmup_requests_delayed_total`, `vllm_prefix_cache_hit_tokens_total`.
These are the only per-request LLM latency series that cover the two Ollama
models (`ornith:35b`, `qwen2.5:3b-instruct`), which expose no metrics endpoint
of their own.
---------
Co-authored-by: Admin Bot <[email protected]>
Reviewed-on: #62
FleetClient calls tool-definition-controller:8788 /sessions/{id}/assign
as the primary sandbox create path. Falls back to direct k8s SandboxManager
if fleet controller is unreachable.
handleSandboxCreate:
1. fleet.Assign() → podSvcDns from pre-warmed fleet pod (fast, no wait)
2. fallback: sandbox.CreateOrResume() → dedicated pod (slow, 30s wait)
handleSandboxDelete: fleet.Release() + sandbox.Delete() both run (non-fatal).
updateSandboxSummary: extracted helper, updates session memory_entity with
pod_name / svc_dns / last_active_at.
NetworkPolicy: added port 8788 to poimen egress (fleet controller REST API).
Response adds fleet:true field when served by fleet.
forgejo-gitea-http.cicd.svc.cluster.local (headless svc, port 3000)
not forgejo-gitea (doesn't exist). Also wire REGISTRY_BASE env var
in deployment.yaml so it can be overridden without code change.
NetworkPolicy was blocking api-gateway → gotify.notifications.svc.cluster.local:80.
Adds egress rule to `notifications` namespace on port 80.
Required for `X-Service: notification` + `X-Resource: send-message` to deliver push notifications through the gateway.
---------
Co-authored-by: Admin Bot <[email protected]>
Reviewed-on: #48
MinIO ClusterIP service listens on port 80 (targetPort 9000).
Config had port 9000 which caused 30s timeout then 502 — gateway
connected to service port 9000 which doesn't exist on the ClusterIP.
Changes:
- configmap.yaml: S3 upstream :9000 → :80
- gateway-config-secret.enc.yaml: same
- network-policy.yaml: add port 80 egress to storage namespace
Verified: S3 adapter now reaches MinIO (403 AccessDenied = auth issue,
not connectivity).
Enable Poimen orchestrator and worker pods to reach the LLM API gateway
in the api namespace.
The api-gateway NetworkPolicy was only allowing traffic from:
- ingress-nginx (external ingress)
- monitoring (Prometheus scraping)
Added new ingress rule to allow:
- poimen namespace (orchestrator-job and worker pods)
- Port 8080 (api-gateway service port)
This fixes the DNS resolution error where orchestrator pods couldn't
reach http://api-gateway.api:8080/health from within the cluster.
Managed via ArgoCD in homelab/k8s/argocd/apps/55-api-gateway.yaml
which syncs from this repo's k8s/ directory.
Baseline for the Kong replacement on api.riotpiao.com. Brings the working
tree under version control for the first time: gateway source, the task
board that drives the agent runs, test fixtures, and K8s manifests.
Anchor the gateway ignore rule to the repo root. Unanchored, "gateway"
also matched the cmd/gateway/ source directory, so the program entrypoint
was excluded from every commit.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
rockandAdmin Bot
