From 16ee5453a41943e0c117daaf26b00cb8c40a4dfa Mon Sep 17 00:00:00 2001 From: Jente Rosseel Date: Wed, 19 Aug 2026 15:44:20 +0300 Subject: [PATCH] =?UTF-8?q?=F0=9F=90=9B=20let=20the=20public=20health=20re?= =?UTF-8?q?port=20complete=20in=20the=20k3d=20smoke?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The health completeness gate added by #673 has never passed in CI, so develop has been red since it merged (its own validation run failed after the merge). Two defects: The channel-proxy ingress policy admitted only the ingress-controller namespace, so the server's new channel readiness probe was rejected (k3s answers with a reset, which surfaced as ECONNREFUSED against the service IP). The server-side egress rule now has its ingress counterpart. The smoke deployed no model, and LiteLLM answers /model/info with 500 on an empty estate, so the models probe could never turn available. The smoke now seeds the initial provider with a placeholder key: registration writes LiteLLM's model row without calling the provider. The channel-proxy chart stamps to 0.9.2 with its noop migration, and the umbrella pin, lock, and archive move with it. --- apps/_infra/deploy-k8s/Chart.lock | 6 +++--- apps/_infra/deploy-k8s/Chart.yaml | 2 +- .../charts/opencrane-channel-proxy-0.8.0.tgz | Bin 2032 -> 0 bytes .../charts/opencrane-channel-proxy-0.9.2.tgz | Bin 0 -> 2178 bytes .../deploy-k8s/platform/tests/develop-smoke.sh | 5 +++++ apps/channel-proxy/helm/Chart.yaml | 4 ++-- .../helm/migrations/0.8.0-to-0.9.2.json | 5 +++++ apps/channel-proxy/helm/templates/_resources.tpl | 10 ++++++++++ apps/channel-proxy/package.json | 2 +- apps/channel-proxy/project.json | 2 +- releases/0.9.2.json | 8 ++++---- 11 files changed, 32 insertions(+), 12 deletions(-) delete mode 100644 apps/_infra/deploy-k8s/charts/opencrane-channel-proxy-0.8.0.tgz create mode 100644 apps/_infra/deploy-k8s/charts/opencrane-channel-proxy-0.9.2.tgz create mode 100644 apps/channel-proxy/helm/migrations/0.8.0-to-0.9.2.json diff --git a/apps/_infra/deploy-k8s/Chart.lock b/apps/_infra/deploy-k8s/Chart.lock index b85330f2a..ef78800e0 100644 --- a/apps/_infra/deploy-k8s/Chart.lock +++ b/apps/_infra/deploy-k8s/Chart.lock @@ -10,7 +10,7 @@ dependencies: version: 0.9.2 - name: opencrane-channel-proxy repository: file://../../channel-proxy/helm - version: 0.8.0 + version: 0.9.2 - name: opencrane-memory-gateway repository: file://../../memory-gateway/helm version: 0.9.2 @@ -44,5 +44,5 @@ dependencies: - name: opencrane-obot repository: file://../obot/helm version: 0.8.0 -digest: sha256:d347d03ec3086ce5bd1c7b903420b0d97e3c827defa04a16d546253bffa7fb89 -generated: "2026-08-19T12:01:32.536381+03:00" +digest: sha256:1670f21eb5487abeb34dcdf54087c3d14694d50bc432e6bee44d69a9cd46e951 +generated: "2026-08-19T15:41:04.77927+03:00" diff --git a/apps/_infra/deploy-k8s/Chart.yaml b/apps/_infra/deploy-k8s/Chart.yaml index f64585256..2c2c29794 100644 --- a/apps/_infra/deploy-k8s/Chart.yaml +++ b/apps/_infra/deploy-k8s/Chart.yaml @@ -30,7 +30,7 @@ dependencies: version: 0.9.2 repository: "file://../../opencrane-ui/helm" - name: opencrane-channel-proxy - version: 0.8.0 + version: 0.9.2 repository: "file://../../channel-proxy/helm" - name: opencrane-memory-gateway version: 0.9.2 diff --git a/apps/_infra/deploy-k8s/charts/opencrane-channel-proxy-0.8.0.tgz b/apps/_infra/deploy-k8s/charts/opencrane-channel-proxy-0.8.0.tgz deleted file mode 100644 index 3e72a76655691bdd7c2bbff985d39701052bc055..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 2032 zcmVDc zVQyr3R8em|NM&qo0PI@rZ{j!_?`QrBE4w4@NJ9uLovk9>2Np6jNE8szdC}>FO!5Gp zI=0t#Xmj2E?(XjwGTdT6l6Zz4a`rmAa_J3wsRhvps zJd!>rTZ@xUgNOHj{k-Wk^ZUQyy#MWW|NkZJ?yiagm=gxb+W3OK_JyHw1$$$E3svv$ zD`p0nBl|O^5vcr7V0cC$K5yUupSaS<{o7_DVG9XL*?VLDG=y+OHTp$J z!t@+j#uevWhV~m}?JW@S5EJ%xL+)oxDZhbWAjyI-wTqb}TNt(jONrV6UurFsTdNuD zJ&E4#;2Qn4jsCh!gJhUqNqP{yba09220a0r1OYUbNX7yev9l8P{0c8J`O<%?8BC1x|#-tnZCpfFF@J`koaJeHP<1R zIu$$@KkAih!U7kK)8Q@O=MmGD5Ht?3#%=|nGyvS)p@%7=`};y{K#1ZQP-PZDC~?C5 z71AMQ{-1~u768+zX}r#tUfN2-y!EmH`Xt?Jknec01E}CPi zpi-??bJAlWRBfYz4hYKQ5MHGCN`P;GBnV1;tP;khUYw0cK@?E%HJ2&L5Nm(g+hKi> zcQ&tA!vB57|0oF%$^zJ$%Z?39qd8h95xdwDJCYhgnSztgIT!1n?jV^QH$*Qt)>=?L z!_+1rUcfM-bPT=(y`^60*ilJ!>#RoXKO(MSJI??C3wDh2ge{W^>_?L5xXqb{TfIe; z5o@VFXCuzFYf?wpbSdzSLWh#i35D$xgwmXG6fsRg=%lCTy4#%9m@tqfQk5xhqYoEZ zha5iXH*U`r(Okyp{@#6fti}s;e{U5rjLwIg53X5_BNJ)pQG72n7`@4Pn7< z2njBAVb#nACbSjcHYPI>=CES2cw`pOD+So99BeokO$uNuv+@%`_BKF%^}*2Vw@0nM zH|_Q(-l*T|O|M41gLvhs!Xp^%Ppy96>rIEF!PjroR{)rqqkxY(;6Vbb!p7%^GbOQ<}s^GHqb?SZg`jhGJ-zE?EWGQ-xZ@m>T{d=sB z_QKZ0oA$bw-6Ibbi8b^{NFF^=O5nb9`<=m;K>ovL<`7JSL+mkA zS_H(`$ny2Ag?>iXCd;vql?$oX+nrRY-pJ#vIE_NMH2J}S(6Fs_v`HWe0w;OK5bLFj zYAY;jGGevOj9M~76{cj-YA-&S4#GgGq2x2jvoQhcBj{pG6e+Tq8UM4`m&C2T$VM2^ z1k(;s9FM{0EKn|L^PNsgR&WwUGx0eL&mUq~cXDc6UlO=`ex><09MZ#Q zaWd_Ix1^p@lD{2x5Fz<@@HGT^ChNlbk_X@-r`dFJy`|(0nkva=3xl@$-fo;SuSH3g z91vjst^g&Y;8u|IOx`H_(B|Gqn^2o*x}ITFSgcTs_4x~~Ow+8to!(V+hkLc>3H975 zbaLr!Nm?r;*WBmSMU(b0`|gCyHqDua+nrl9EdzbS{f6Lfom6V;o=gz6D*D&FNjU;j_Nw#|tCl%1Za z(;pihip;Kp0Lk>mznZ)fAfMAzOaH!Y^RT~bpw$iNv%S4URa=R;refFA zcdjbSKmO=9xF6XLz5j+}k!GN(=Gb-HscK$L-r?=Dc zVQyr3R8em|NM&qo0PI@pbJ{u<&u9LMGrqU8w==~UnxrW+`+=L#mKg#JA$`ow4kPRX zsF5XINv84k=6~OjjR6~z2if*+cB3yL=<)mMJao>H5E8ks2*;{FC!8azN+qu2+UcAq ztsTAGz_s!_west5gNhS&sn|~R(!nKLx9ACYb?vGe)dH3KLc4n5yFQDwLFF>x z6V`mOaNsw}eHH~dl};nZ?CI-(`x4wCG9((^9tlxP;^UfRx|%^wxH%`B%uu-&koxG- zCD(yaCf#^0e$*>hlm|_?NQbw4UqswgLNp{GhBPYxX#n{C9d4%xH#ddY0KmuunYN1n zBu2QsLOR6G{}VXn0dfO})*9^`BBgs3O;B+()_g?G7oij!xoJWkj6_C+mV16DBXNbi z2~)x}R;tx%Zudk=U0aFZ3?&nBh);6+TB2`(6iP;Yq7%lYR-BDUK{PV-jZi7ckQjg7 z-C(_wcQ&tE!v8qq|DYWJWC3i+WkUzHu^g?vh@Gs7J&+neCg9|A&cu5A8%VZ~Z`90J z+L|#jA;ip-W=*}&u_2P`+F0$j|A>Ua^*jrNJlIgqJzOT+upcRE;#0v5 zUYj+dig-)+1Rn}vnl^RBRhLHJ3Ur{vlrmgT0Z4PkVZ;p$@hm+(m)-WPCX}Np*;SeF zR`O_qv&-OnM`CnCv&GHNL5{3-x}60!;Za9Z82^UqwLLK5^ji>0RuE z`YI>~=asXS7Ci`U)Ed5TkH#PR7o+jT<-2#C&+U6amWtI7HA7=_r;BJhrPugCD#P|g zzx%O09FIEZ?f&Ixe7>8>j+mtdTc8@z5JhCpABcZ38n#>K+I zqi-HZ-GY<`8_rdw!+q^J??hSI}bcm6fxMPA-(fNDS`Xc>7DgIJ>1@j!B3P2;@fWF?#O?{ z#2$iaaERO7mKFi^4LH8JcHmcVR#}b%PA;T6FE>)9dLxgw5G)Gu+~x;6Lc_Y&F*boH zY&gj?2E@#pP+JgHQxUJNX4H}yx-cb+R$KAOc2JI550sc-o{bGq@6i-vqD+zP%=ll$ zz9epKMK;Q*p@f|wBk=|Lf(N<@joc84ii%*>d9=~V=mPhmXeT~~;n8gj>t0Tb%S(dh zmR%X~g@kPPS)5GUVJ)epl;m%_4MZyO6@7z2p2@PXJ{JKt!8<(ka=oSGEt)RLW($MX z@?JYmnbks)B?lC_zqx^uQFtwBdM2-gz00{*yG^K#3|r2yA}m&@#rpgSSEgy!f12J^ zbOu|s=N|RkK6G;FZAn@yl`z5=tO=vjLH6AqnQfXg4c4ApR4qsIO{go%XYSQW!g;0a zUfPvb5Kma;(jGnkJ@*STk>@CusBL}JNiQRvSKzeMPqtcGUQuTDF;yZg9%aexTYh6% zE7@Sy@-#E0y6cL)w46-Ytnd7`l7T|8RxLH){fzh*7|ju6G-1?-ITB{(V9RJ_EXV}) z>dj~skrR0(&q?Wp=PS@+ z1j1vG#J@rVR09b@Y77SM4t;Hz;5{_8he_5Ci|N@NwpqLx{?XdR4XgeI`dKY&MQGI{ zIEyV|M*Sp+0g239C~D%|+hF!82qB4KS(Jg9D-q4+nFfsb|CIlIFX7kTwTy*u*1NEJ zQ20kg6$W6$hHMe=n)oKmYCws|Rz3<%q&NmJiPzdJSHTZDvTSEHy+O*!<>C6iI?+`k z<#NejRS4XojLWlaWgNY}x89aR3-4mN(#aJD+2-q5s3Jt4Dq@7H>d1N(2B6aSn`-jr1HNFXl>T#WbGyA8WYrbuqpiI}RO=lH!{nx=Z(KZ= zfBdUoRG(Jc_5L5ySz3YUn&;MCuWCfqb5C5){i+3j7{*<{|EV|X+53O}%~AcpYj{V; zjpz6OpV7Wo034g=BtQ6C))P(>oJ8x+E8A_vcIQdfX^RZ|6&FG}m1p;RV(ni3f0FtC zTetCJ{XhNvU&A|k<30QT&uF*!|H*Cs|JH3h`~P!$ZqMzxJ>mB600030|0|^y696y( E0E4DKJ^%m! literal 0 HcmV?d00001 diff --git a/apps/_infra/deploy-k8s/platform/tests/develop-smoke.sh b/apps/_infra/deploy-k8s/platform/tests/develop-smoke.sh index 09997a584..b8661fead 100755 --- a/apps/_infra/deploy-k8s/platform/tests/develop-smoke.sh +++ b/apps/_infra/deploy-k8s/platform/tests/develop-smoke.sh @@ -481,6 +481,10 @@ export OPENCRANE_OIDC_SESSION_SECRET="$(_random_secret)" # production deploy path still requires a UI digest; this explicit escape keeps the smoke honest. export OPENCRANE_ALLOW_TAG_FLOAT=1 export TIMEOUT_SECONDS +# The public health report only turns "models" available once LiteLLM lists a routable model. +# Seeding the initial provider with a placeholder key is safe here: registration writes the +# LiteLLM model row without calling the provider, and the health probe lists the estate. +export OPENCRANE_INITIAL_MODEL_API_KEY="sk-develop-smoke-placeholder" # Exercise the production wrapper's required contact and first-owner inputs. The disposable `.test` # host cannot complete public ACME, so the final --set flags deliberately restore its local issuer. "$ROOT_DIR/apps/_infra/deploy-k8s/deploy.sh" \ @@ -492,6 +496,7 @@ export TIMEOUT_SECONDS --release "$RELEASE_NAME" \ --release-version "$(jq -r '.version' "$ROOT_DIR/package.json")" \ --from-release-version fresh \ + --initial-model-provider openai \ --image-tag develop-smoke \ --cognee-tag develop-smoke \ --storage-class "$SMOKE_STORAGE_CLASS" \ diff --git a/apps/channel-proxy/helm/Chart.yaml b/apps/channel-proxy/helm/Chart.yaml index c2fb48a70..e1e6cd60c 100644 --- a/apps/channel-proxy/helm/Chart.yaml +++ b/apps/channel-proxy/helm/Chart.yaml @@ -2,5 +2,5 @@ apiVersion: v2 name: opencrane-channel-proxy description: App-owned named-template library for the channel trust boundary. type: library -version: 0.8.0 -appVersion: "0.8.0" +version: 0.9.2 +appVersion: "0.9.2" diff --git a/apps/channel-proxy/helm/migrations/0.8.0-to-0.9.2.json b/apps/channel-proxy/helm/migrations/0.8.0-to-0.9.2.json new file mode 100644 index 000000000..ee12529c4 --- /dev/null +++ b/apps/channel-proxy/helm/migrations/0.8.0-to-0.9.2.json @@ -0,0 +1,5 @@ +{ + "fromChartVersion": "0.8.0", + "toChartVersion": "0.9.2", + "kind": "noop" +} diff --git a/apps/channel-proxy/helm/templates/_resources.tpl b/apps/channel-proxy/helm/templates/_resources.tpl index 4ed68d7df..a7e40d424 100644 --- a/apps/channel-proxy/helm/templates/_resources.tpl +++ b/apps/channel-proxy/helm/templates/_resources.tpl @@ -144,6 +144,16 @@ spec: ports: - protocol: TCP port: {{ .Values.channelProxy.service.port }} + # The public health report probes channel readiness from the server, so the server's + # matching egress rule needs this ingress counterpart before any packet is admitted. + - from: + - podSelector: + matchLabels: + {{- include "opencrane.selectorLabels" . | nindent 14 }} + app.kubernetes.io/component: opencrane-server + ports: + - protocol: TCP + port: {{ .Values.channelProxy.service.port }} egress: # OpenCrane is the only application authority the channel boundary may resolve through. - to: diff --git a/apps/channel-proxy/package.json b/apps/channel-proxy/package.json index 90a30ca9f..490273d91 100644 --- a/apps/channel-proxy/package.json +++ b/apps/channel-proxy/package.json @@ -1,6 +1,6 @@ { "name": "@opencrane/channel-proxy", - "version": "0.8.0", + "version": "0.9.2", "private": true, "license": "AGPL-3.0-or-later", "type": "module", diff --git a/apps/channel-proxy/project.json b/apps/channel-proxy/project.json index b5e2ad1b9..b43cd0bdc 100644 --- a/apps/channel-proxy/project.json +++ b/apps/channel-proxy/project.json @@ -2,7 +2,7 @@ "name": "channel-proxy", "$schema": "../../node_modules/nx/schemas/project-schema.json", "projectType": "application", - "metadata": { "release": { "adaptedVersion": "0.8.0" } }, + "metadata": { "release": { "adaptedVersion": "0.9.2" } }, "sourceRoot": "apps/channel-proxy/src", "tags": ["type:app", "layer:entrypoint", "scope:app"], "targets": { diff --git a/releases/0.9.2.json b/releases/0.9.2.json index 8e07ee915..ca2743238 100644 --- a/releases/0.9.2.json +++ b/releases/0.9.2.json @@ -52,10 +52,10 @@ }, "channel-proxy": { "root": "apps/channel-proxy", - "adaptedVersion": "0.8.0", - "packageVersion": "0.8.0", - "chartVersion": "0.8.0", - "chartAppVersion": "0.8.0" + "adaptedVersion": "0.9.2", + "packageVersion": "0.9.2", + "chartVersion": "0.9.2", + "chartAppVersion": "0.9.2" }, "cognee": { "root": "apps/_infra/cognee",