From 2aabd4288bd5ba3ca209d4691c355fce0e3752f1 Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Thu, 20 Aug 2026 00:06:23 -0700
Subject: [PATCH] fix: label gateway pods llm-client=true so upstreams accept
 them

llm-serving-default-deny admits only llm-client=true pods on 8080; without the
label every dispatch timed out with 502.
---
 k8s/deployment.yaml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/k8s/deployment.yaml b/k8s/deployment.yaml
index 761c8de..e32b512 100644
--- a/k8s/deployment.yaml
+++ b/k8s/deployment.yaml
@@ -21,6 +21,10 @@ spec:
       labels:
         app: api-gateway
         component: gateway
+        # Required by the llm-serving-default-deny NetworkPolicy, which admits
+        # only pods labelled llm-client=true (from any namespace) on port 8080.
+        # Without it every upstream dial times out and dispatch returns 502.
+        llm-client: "true"
       annotations:
         prometheus.io/scrape: "true"
         prometheus.io/port: "8080"