Story Crater BotandClaude Opus 5
058f11cf2b
Baseline for the Kong replacement on api.riotpiao.com. Brings the working tree under version control for the first time: gateway source, the task board that drives the agent runs, test fixtures, and K8s manifests. Anchor the gateway ignore rule to the repo root. Unanchored, "gateway" also matched the cmd/gateway/ source directory, so the program entrypoint was excluded from every commit. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
2.1 KiB
2.1 KiB
6.2 — Deployment, Service, NetworkPolicy (GREEN)
Phase: 6 — Deploy and cutover Stage: GREEN Depends on: 6.1
Manifests only. Nothing here exposes the gateway publicly — that is the cutover, and it is a separate step.
- A Deployment runs the gateway with at least 2 replicas, matching Kong's current replica count
- The pod spec carries the hardening from 6.1: non-root, read-only rootfs, all capabilities dropped,
seccompProfile: RuntimeDefault - Liveness probes hit
/healthzand readiness probes hit/readyz; readiness fails while config is invalid or JWKS has never been fetched - Route configuration is mounted from a ConfigMap sourced from git — not a CRD, and not baked into the image
- A config change rolls the pods; a stale ConfigMap cannot be silently served by a long-lived pod
- Termination allows in-flight requests to drain, with a grace period long enough for the streaming timeouts in use
- A Service exposes the gateway in-cluster with a named port, resolvable at
http://<svc>.api.svc.cluster.local - No ServiceAccount with any RBAC is bound; the pod does not need or receive an API-server token (G2)
- A NetworkPolicy allows ingress only from
ingress-nginx - The same NetworkPolicy allows egress only to the proxied upstreams plus Authentik, plus DNS. Everything else is denied
- Resource requests and limits are set explicitly
- Every manifest is committed to git and applied by Argo. No
kubectl apply, nohelm upgrade(G7)
Verify
kubectl -n api get deploy homelab-frontend -o jsonpath='{.spec.replicas} {.spec.template.spec.securityContext}{"\n"}'
# expected: 2, with runAsNonRoot true and seccompProfile RuntimeDefault
kubectl -n api exec deploy/homelab-frontend -- true 2>&1
# expected: fails — distroless image has no shell to exec into
kubectl -n llm-serving run np-probe --rm -it --image=curlimages/curl --restart=Never -- \
curl -s -m 5 http://homelab-frontend.api.svc.cluster.local/healthz
# expected: times out or is refused — ingress is restricted to ingress-nginx only