CI / CI (pull_request) Successful in 13m36s
Replace Tekton sidecar (no secrets, no Temporal) with in-cluster
canary pod that has real secrets and real upstreams.
Pipeline:
1. build + push SHA-tagged image
2. deploy api-gateway-canary-${SHA} pod in api namespace
- mounts api-gateway-config secret
- gotify-webhook-secret (optional)
- api-gw-client-secret (optional)
3. test against pod IP directly (real Temporal, real Gotify)
4. delete canary pod (always)
5. pass → kubectl set image rolling update (zero downtime)
6. fail → production deployment untouched
integration-test.sh: clean — no old/new image workarounds.
All tests assert exact expected codes against real environment.