# 6.6 — Kong teardown (REFACTOR)

Phase: 6 — Deploy and cutover
Stage: REFACTOR
Depends on: [6.5](6.5-cutover.md)

IRREVERSIBLE. Every step before this one could be undone in seconds by repointing
Ingress `api/api` back to `kong-proxy:80`. Once the Kong Application is removed and
Argo prunes the Helm release and its CRDs, that escape hatch is gone — recovery means
reinstalling Kong from scratch and rebuilding six plugin CRs.

Do not start until the soak after 6.5 has been clean for a deliberate, agreed period.

Preconditions:

- [ ] 6.5 is complete: `api.riotpiao.com` has been served entirely by the gateway through the soak, with no reverts
- [ ] Gateway metrics over the soak show no elevated 5xx rate and no unexplained rejections
- [ ] pi and every other known caller have been confirmed working against the gateway
- [ ] The inventory has been re-verified immediately beforehand — Kong's config has been actively iterated

Order matters. Delete the routing objects first, the Application last:

- [ ] The 7 `ingressClassName: kong` Ingresses are deleted from git — 6 in `llm-serving`, 1 in `agent-pod` for `/console`, `/run`, `/sessions`
- [ ] The 6 `KongPlugin` CRs are deleted from git: the three `llm-rewrite-*` chat rewrites, `llm-rewrite-rerank`, `llm-models-list`, and the cluster-wide `prometheus` plugin
- [ ] Removing the cluster-wide `prometheus` plugin does not blind any dashboard, because 5.1 parity metrics are already being scraped from the gateway
- [ ] The `kong` Application is then removed from `k8s/argocd/apps/55-api-gateway.yaml`
- [ ] Argo prunes the Helm release, the Kong CRDs and the namespace leftovers on its own. No `helm uninstall`, no `kubectl delete` (G7)
- [ ] Public traffic is verified unaffected after each deletion, not only at the end
- [ ] No orphaned Kong CRDs, ReplicaSets or Services remain in namespace `api`

## Verify

```bash
kubectl get ingress -A -o jsonpath='{range .items[*]}{.spec.ingressClassName}{"\n"}{end}' | sort | uniq -c
# expected: no kong entries remain; nginx and istio counts unchanged

kubectl get kongplugins -A 2>&1; kubectl -n argocd get app kong 2>&1
# expected: CRD not found, and Application "kong" not found

kubectl -n api get all | grep -i kong
# expected: no output — nothing Kong-related left

curl -s -o /dev/null -w '%{http_code}\n' https://api.riotpiao.com/v1/models
# expected: 200, served by the gateway
```