46 lines
2.4 KiB
Markdown
46 lines
2.4 KiB
Markdown
|
# 6.6 — Kong teardown (REFACTOR)
|
||
|
|
|
||
|
|
Phase: 6 — Deploy and cutover
|
||
|
|
Stage: REFACTOR
|
||
|
|
Depends on: [6.5](6.5-cutover.md)
|
||
|
|
|
||
|
|
IRREVERSIBLE. Every step before this one could be undone in seconds by repointing
|
||
|
|
Ingress `api/api` back to `kong-proxy:80`. Once the Kong Application is removed and
|
||
|
|
Argo prunes the Helm release and its CRDs, that escape hatch is gone — recovery means
|
||
|
|
reinstalling Kong from scratch and rebuilding six plugin CRs.
|
||
|
|
|
||
|
|
Do not start until the soak after 6.5 has been clean for a deliberate, agreed period.
|
||
|
|
|
||
|
|
Preconditions:
|
||
|
|
|
||
|
|
- [ ] 6.5 is complete: `api.riotpiao.com` has been served entirely by the gateway through the soak, with no reverts
|
||
|
|
- [ ] Gateway metrics over the soak show no elevated 5xx rate and no unexplained rejections
|
||
|
|
- [ ] pi and every other known caller have been confirmed working against the gateway
|
||
|
|
- [ ] The inventory has been re-verified immediately beforehand — Kong's config has been actively iterated
|
||
|
|
|
||
|
|
Order matters. Delete the routing objects first, the Application last:
|
||
|
|
|
||
|
|
- [ ] The 7 `ingressClassName: kong` Ingresses are deleted from git — 6 in `llm-serving`, 1 in `agent-pod` for `/console`, `/run`, `/sessions`
|
||
|
|
- [ ] The 6 `KongPlugin` CRs are deleted from git: the three `llm-rewrite-*` chat rewrites, `llm-rewrite-rerank`, `llm-models-list`, and the cluster-wide `prometheus` plugin
|
||
|
|
- [ ] Removing the cluster-wide `prometheus` plugin does not blind any dashboard, because 5.1 parity metrics are already being scraped from the gateway
|
||
|
|
- [ ] The `kong` Application is then removed from `k8s/argocd/apps/55-api-gateway.yaml`
|
||
|
|
- [ ] Argo prunes the Helm release, the Kong CRDs and the namespace leftovers on its own. No `helm uninstall`, no `kubectl delete` (G7)
|
||
|
|
- [ ] Public traffic is verified unaffected after each deletion, not only at the end
|
||
|
|
- [ ] No orphaned Kong CRDs, ReplicaSets or Services remain in namespace `api`
|
||
|
|
|
||
|
|
## Verify
|
||
|
|
|
||
|
|
```bash
|
||
|
|
kubectl get ingress -A -o jsonpath='{range .items[*]}{.spec.ingressClassName}{"\n"}{end}' | sort | uniq -c
|
||
|
|
# expected: no kong entries remain; nginx and istio counts unchanged
|
||
|
|
|
||
|
|
kubectl get kongplugins -A 2>&1; kubectl -n argocd get app kong 2>&1
|
||
|
|
# expected: CRD not found, and Application "kong" not found
|
||
|
|
|
||
|
|
kubectl -n api get all | grep -i kong
|
||
|
|
# expected: no output — nothing Kong-related left
|
||
|
|
|
||
|
|
curl -s -o /dev/null -w '%{http_code}\n' https://api.riotpiao.com/v1/models
|
||
|
|
# expected: 200, served by the gateway
|
||
|
|
```
|