- coulomb-social: requests 100m/256Mi -> 15m/176Mi (limits unchanged)
- reuse-surface: main 100m/256Mi -> 5m/64Mi, landing 10m/32Mi -> 5m/16Mi
- vergabe-demo-company: memory request 256Mi -> 512Mi, CPU 60m kept
- inter-hub (retired, CORE-WP-0007): delete chart, values, Make targets,
smoke script and production deploy workflow; release to be uninstalled
Full renders vs live: resources only, except the vergabe release-unit label
from 64530e1 not yet on its Service and PVCs.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 276069@bnt-lap001
Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c
The chart label is vergabe, the claim is the live Deployment in vergabe-demo-company, and the image pin is the digest that Deployment runs. The shared database is a reference, not a workload claim.
RELREG-WP-0002-T01
Assistant: grok
Assistant-Session: 01a15f9f-3d77-7d21-911b-d93c86f9d14f
/health returned nginx 404 through the ingress while the service answered 200
in-cluster. The ingress rule was correct on paper — /health Exact ->
reuse-surface:8000 alongside / Prefix -> reuse-surface-landing:8080 — but
Traefik derives router priority from the length of the generated rule string,
and Path(`/health`) and PathPrefix(`/`) are both 15 characters. The tie broke
toward the landing page. PathPrefix(`/v1`) is longer, which is why /v1 worked
and the fault looked like a /health-only bug.
traefik.ingress.kubernetes.io/router.priority applies per Ingress, not per
path, so the catch-all moves into its own Ingress with priority 1. Every API
route now outranks it regardless of rule length.
This is not cosmetic: make reuse-smoke curls /health and false-negatives on an
otherwise healthy release.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Adopt live Core Hub resources, align prod ConfigMap naming, default production
image registry to gitea, and install Helm release core-hub rev 1 (smoke passed).
Add apps-pg-backup and check-backup-lane-auth targets; document OIDC login
requirement now that OpenBao is unsealed.
