tegwick
a36563543b
/health returned nginx 404 through the ingress while the service answered 200 in-cluster. The ingress rule was correct on paper — /health Exact -> reuse-surface:8000 alongside / Prefix -> reuse-surface-landing:8080 — but Traefik derives router priority from the length of the generated rule string, and Path(`/health`) and PathPrefix(`/`) are both 15 characters. The tie broke toward the landing page. PathPrefix(`/v1`) is longer, which is why /v1 worked and the fault looked like a /health-only bug. traefik.ingress.kubernetes.io/router.priority applies per Ingress, not per path, so the catch-all moves into its own Ingress with priority 1. Every API route now outranks it regardless of rule length. This is not cosmetic: make reuse-smoke curls /health and false-negatives on an otherwise healthy release. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
101 lines
2 KiB
YAML
101 lines
2 KiB
YAML
image:
|
|
repository: forgejo.coulomb.social/coulomb/reuse-surface
|
|
tag: ""
|
|
pullPolicy: IfNotPresent
|
|
|
|
replicaCount: 1
|
|
|
|
service:
|
|
type: ClusterIP
|
|
port: 8000
|
|
targetPort: 8000
|
|
|
|
persistence:
|
|
enabled: true
|
|
size: 1Gi
|
|
mountPath: /data
|
|
storageClassName: ""
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
|
|
envSecretName: reuse-surface-env
|
|
|
|
landing:
|
|
enabled: false
|
|
image:
|
|
repository: nginxinc/nginx-unprivileged
|
|
tag: "1.27-alpine"
|
|
pullPolicy: IfNotPresent
|
|
service:
|
|
port: 8080
|
|
targetPort: 8080
|
|
ingress:
|
|
# Explicit Traefik router priority for the landing catch-all. Traefik
|
|
# otherwise derives priority from rule-string length, where PathPrefix(`/`)
|
|
# ties with Path(`/health`) and can win. Keep this below every API route.
|
|
priority: 1
|
|
noindex: true
|
|
title: "Railiance service endpoint"
|
|
eyebrow: "Railiance S5"
|
|
body: "This endpoint is available for automated clients and operators."
|
|
buttonLabel: "Continue"
|
|
primaryUrl: ""
|
|
redirect:
|
|
enabled: false
|
|
target: ""
|
|
delaySeconds: 5
|
|
links: []
|
|
html: ""
|
|
resources:
|
|
requests:
|
|
cpu: 10m
|
|
memory: 32Mi
|
|
limits:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
|
|
ingress:
|
|
enabled: true
|
|
className: traefik
|
|
host: reuse.coulomb.social
|
|
tls: true
|
|
redirectHttp:
|
|
enabled: false
|
|
permanent: true
|
|
apiPaths:
|
|
- path: /health
|
|
pathType: Exact
|
|
- path: /v1
|
|
pathType: Prefix
|
|
annotations:
|
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
|
|
probes:
|
|
enabled: true
|
|
path: /health
|
|
port: 8000
|
|
liveness:
|
|
initialDelaySeconds: 15
|
|
periodSeconds: 30
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
readiness:
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
|
|
podSecurityContext: {}
|
|
securityContext: {}
|
|
|
|
nodeSelector: {}
|
|
tolerations: []
|
|
affinity: {}
|