fix: retire one reasoning-predictor replica, run PP=2 across both V100s (Qwen3.5 MoE swap abandoned, moving to Ollama)

k8s/apps/llm-serving/reasoning.yaml

@@ -29,6 +29,7 @@ spec:
       - --dtype=float16
       - --kv-cache-dtype=auto
       - --tensor-parallel-size=1
+      - --pipeline-parallel-size=2
       - --max-model-len=16384
       - --gpu-memory-utilization=0.90
       - --max-num-seqs=4
@@ -85,11 +86,11 @@ spec:
         limits:
           cpu: '16'
           memory: 36Gi
-          nvidia.com/gpu: '1'
+          nvidia.com/gpu: '2'
         requests:
           cpu: '8'
           memory: 12Gi
-          nvidia.com/gpu: '1'
+          nvidia.com/gpu: '2'
       startupProbe:
         failureThreshold: 80
         httpGet:
@@ -103,8 +104,8 @@ spec:
         name: shm
     deploymentStrategy:
       type: Recreate
-    maxReplicas: 2
-    minReplicas: 2
+    maxReplicas: 1
+    minReplicas: 1
     nodeSelector:
       kubernetes.io/hostname: worker-1
     runtimeClassName: nvidia

k8s/infra/forgejo-runner/templates/configmap.yaml

@@ -0,0 +1,38 @@
+# act_runner (the forgejo-runner binary) ships no config.yaml by default, so
+# `forgejo-runner daemon` runs on its hardcoded defaults -- notably
+# container.valid_volumes: [] ("if the sequence is empty, no volumes can be
+# mounted"). Confirmed via `forgejo-runner generate-config` on this exact
+# image (code.forgejo.org/forgejo/runner:6) and by running the daemon against
+# a minimal override locally: a job container that requests any bind mount
+# (e.g. the dind mTLS certs at /docker-certs/client, needed for
+# `docker login`/build/push steps) is rejected outright with no default
+# config in place.
+#
+# Scoped narrowly to exactly the certs path, read-only. Not a wildcard
+# (valid_volumes: ['**']) -- that would let any workflow in any repo this
+# runner serves bind-mount arbitrary paths off the runner pod's filesystem
+# into a job container, which is a real widening of the CI trust boundary,
+# not just a convenience.
+#
+# network: host is also only settable here, not per-workflow. A workflow's
+# `container.options: --network host` is silently ignored -- confirmed live:
+# every job's actual `docker create` call logged
+# `network="FORGEJO-ACTIONS-TASK-N_..."`, an auto-generated per-job bridge,
+# regardless of that options string. On that isolated bridge, DOCKER_HOST=
+# tcp://localhost:2376 resolves to the job container itself (no daemon there),
+# not to the dind sidecar, so any docker command that actually needs the
+# daemon (build, push -- anything past docker login, which only talks to the
+# registry over the network and never touches DOCKER_HOST) fails with "Cannot
+# connect to the Docker daemon". host mode puts every job container in dind's
+# own network namespace instead, where the daemon really is listening.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ .Release.Name }}-config
+  namespace: {{ .Release.Namespace }}
+data:
+  config.yaml: |
+    container:
+      valid_volumes:
+        - /docker-certs/client
+      network: host

k8s/infra/forgejo-runner/templates/deployment.yaml

@@ -56,7 +56,7 @@ spec:
       containers:
         - name: runner
           image: {{ .Values.runner.image.repository }}:{{ .Values.runner.image.tag }}
-          command: ["sh", "-c", "forgejo-runner daemon"]
+          command: ["sh", "-c", "forgejo-runner daemon --config /etc/forgejo-runner/config.yaml"]
           workingDir: /data
           env:
             - name: DOCKER_HOST
@@ -73,6 +73,9 @@ spec:
             - name: homelab-ca
               mountPath: /etc/ssl/certs/homelab-ca.pem
               subPath: ca.crt
+            - name: runner-config
+              mountPath: /etc/forgejo-runner
+              readOnly: true
           resources:
             {{- toYaml .Values.runner.resources | nindent 12 }}
 
@@ -115,3 +118,6 @@ spec:
           # The volumeMounts use subPath: ca.crt to project the single cert file.
           configMap:
             name: homelab-ca
+        - name: runner-config
+          configMap:
+            name: {{ .Release.Name }}-config

k8s/infra/forgejo-runner/templates/networkpolicy.yaml

@@ -29,13 +29,23 @@ spec:
             except:
               - 192.168.1.0/24
               - 10.244.0.0/16
-    # Single LAN exception: the ingress-nginx LoadBalancer, which is how
-    # forgejo.riotpiao.com resolves. Image pushes go to that name so the tag
-    # matches what containerd pulls on the nodes; without this the whole /24 is
-    # denied above and `docker push` hangs until it times out.
+    # ingress-nginx, which is how forgejo.riotpiao.com resolves (CoreDNS
+    # rewrites that name to ingress-nginx-controller.ingress-nginx.svc).
+    # Image pushes go to that name so the tag matches what containerd pulls
+    # on the nodes; without this the whole /24 and pod CIDR are denied above
+    # and `docker push`/`docker login` hang until they time out.
+    #
+    # Was an ipBlock pinned to the ingress-nginx LoadBalancer's LAN IP. That
+    # stopped matching once DNS started resolving the name to the Service's
+    # ClusterIP instead of the LB IP: Cilium enforces egress against the
+    # post-DNAT pod IP, which falls inside the 10.244.0.0/16 exclusion above,
+    # so every request silently hung rather than erroring. A namespaceSelector
+    # follows the Service wherever it resolves and needs no IP to stay in
+    # sync with -- same pattern as the kube-system DNS rule above.
     - to:
-        - ipBlock:
-            cidr: {{ .Values.egress.ingressLoadBalancerIP }}/32
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: ingress-nginx
       ports:
         - protocol: TCP
           port: 443

k8s/infra/forgejo-runner/values.yaml

@@ -47,10 +47,3 @@ tolerations:
 # attach there.
 nodeSelector:
   topology.kubernetes.io/zone: az-a
-
-# Egress exceptions. The NetworkPolicy denies the whole LAN /24 by default;
-# this is the one address punched back through, because forgejo.riotpiao.com
-# (the image registry) resolves to the ingress-nginx LoadBalancer.
-# Must match the Cilium LB pool allocation — pool is 192.168.1.160/28.
-egress:
-  ingressLoadBalancerIP: 192.168.1.160