Selector used a plain `name: monitoring` label, but only ingress-nginx
carries that label in this cluster — every other namespace has just
kubernetes.io/metadata.name. The rule matched nothing, so the new
api-gateway ServiceMonitor discovered all 3 replicas but every scrape
died with context deadline exceeded.
Switch to kubernetes.io/metadata.name: monitoring.
FleetClient calls tool-definition-controller:8788 /sessions/{id}/assign
as the primary sandbox create path. Falls back to direct k8s SandboxManager
if fleet controller is unreachable.
handleSandboxCreate:
1. fleet.Assign() → podSvcDns from pre-warmed fleet pod (fast, no wait)
2. fallback: sandbox.CreateOrResume() → dedicated pod (slow, 30s wait)
handleSandboxDelete: fleet.Release() + sandbox.Delete() both run (non-fatal).
updateSandboxSummary: extracted helper, updates session memory_entity with
pod_name / svc_dns / last_active_at.
NetworkPolicy: added port 8788 to poimen egress (fleet controller REST API).
Response adds fleet:true field when served by fleet.
forgejo-gitea-http.cicd.svc.cluster.local (headless svc, port 3000)
not forgejo-gitea (doesn't exist). Also wire REGISTRY_BASE env var
in deployment.yaml so it can be overridden without code change.
NetworkPolicy was blocking api-gateway → gotify.notifications.svc.cluster.local:80.
Adds egress rule to `notifications` namespace on port 80.
Required for `X-Service: notification` + `X-Resource: send-message` to deliver push notifications through the gateway.
---------
Co-authored-by: Admin Bot <[email protected]>
Reviewed-on: #48
MinIO ClusterIP service listens on port 80 (targetPort 9000).
Config had port 9000 which caused 30s timeout then 502 — gateway
connected to service port 9000 which doesn't exist on the ClusterIP.
Changes:
- configmap.yaml: S3 upstream :9000 → :80
- gateway-config-secret.enc.yaml: same
- network-policy.yaml: add port 80 egress to storage namespace
Verified: S3 adapter now reaches MinIO (403 AccessDenied = auth issue,
not connectivity).
Enable Poimen orchestrator and worker pods to reach the LLM API gateway
in the api namespace.
The api-gateway NetworkPolicy was only allowing traffic from:
- ingress-nginx (external ingress)
- monitoring (Prometheus scraping)
Added new ingress rule to allow:
- poimen namespace (orchestrator-job and worker pods)
- Port 8080 (api-gateway service port)
This fixes the DNS resolution error where orchestrator pods couldn't
reach http://api-gateway.api:8080/health from within the cluster.
Managed via ArgoCD in homelab/k8s/argocd/apps/55-api-gateway.yaml
which syncs from this repo's k8s/ directory.
Baseline for the Kong replacement on api.riotpiao.com. Brings the working
tree under version control for the first time: gateway source, the task
board that drives the agent runs, test fixtures, and K8s manifests.
Anchor the gateway ignore rule to the repo root. Unanchored, "gateway"
also matched the cmd/gateway/ source directory, so the program entrypoint
was excluded from every commit.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Admin Bot
rockandAdmin Bot
