Skip to content

πŸ› let the public health report complete in the k3d smoke - #680

Merged
jrosseel merged 1 commit into
developfrom
feat/fix-public-health-smoke
Aug 19, 2026
Merged

πŸ› let the public health report complete in the k3d smoke#680
jrosseel merged 1 commit into
developfrom
feat/fix-public-health-smoke

Conversation

@jrosseel

Copy link
Copy Markdown
Collaborator

Why

Develop's k3d smoke has failed on every run since #673 merged (at 09:48, 18 minutes before its own validation run finished failing β€” first failing run). Every develop push and every PR since fails with the same signature:

{"status":"degraded", ... "models":"unavailable", ... "channels":"unavailable"}

Because develop is red, the smoke's PR skip-proof never fires either, so every open PR pays the full k3d run β€” this one failure is currently the single largest CI tax in the repository.

Root causes

  1. channels β€” ✨ Report user-visible service healthΒ #673 gave the server egress to channel-proxy for the new readiness probe, but channel-proxy's own NetworkPolicy ingress admits only the ingress-controller namespace. The probe is rejected (k3s answers with a TCP reset, surfacing as ECONNREFUSED against the service ClusterIP even though the pod is Ready). Fix: the matching ingress rule for the opencrane-server pods.
  2. models β€” the smoke deploys with no model provider (CI has no key), and LiteLLM answers GET /model/info with 500 on an empty estate, so the models probe can never turn available. Fix: the smoke seeds --initial-model-provider openai with a placeholder key β€” registration only writes LiteLLM's model row and the probe lists the estate; neither path calls the provider.

Versioning

The channel-proxy chart changed, so it stamps to 0.9.2 with a noop 0.8.0-to-0.9.2 migration; the umbrella pin, Chart.lock, and packaged archive move with it.

Validation

  • All 20 Helm contract suites PASS (including the platform network-policy contract)
  • check:release-versioning --base origin/develop PASS; affected-deployables tests 15/15
  • The real proof is this PR's own k3d smoke run β€” it exercises exactly the failing gate.

Unblocks #677 and every other open PR.

The health completeness gate added by #673 has never passed in CI, so
develop has been red since it merged (its own validation run failed
after the merge). Two defects:

The channel-proxy ingress policy admitted only the ingress-controller
namespace, so the server's new channel readiness probe was rejected
(k3s answers with a reset, which surfaced as ECONNREFUSED against the
service IP). The server-side egress rule now has its ingress
counterpart.

The smoke deployed no model, and LiteLLM answers /model/info with 500
on an empty estate, so the models probe could never turn available.
The smoke now seeds the initial provider with a placeholder key:
registration writes LiteLLM's model row without calling the provider.

The channel-proxy chart stamps to 0.9.2 with its noop migration, and
the umbrella pin, lock, and archive move with it.
@jrosseel
jrosseel merged commit 01f8b47 into develop Aug 19, 2026
9 of 10 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant