Changeset 0.28.8 (#194)

k8s/middleware-retry.yaml

@@ -0,0 +1,26 @@
+# k8s/middleware-retry.yaml
+# ============================================
+# Chat Switchboard - Traefik Retry Middleware
+# ============================================
+# Retries failed requests (502, connection reset) once before giving up.
+# Applies to API + WebSocket paths via the Ingress annotation.
+#
+# Why: After a heavy provider model sync (100+ DB upserts), the Go
+# process may briefly delay responses. Traefik sees a stale keepalive
+# connection or a slow initial byte and returns 502. A single retry
+# on a fresh connection resolves it transparently.
+#
+# This is applied per-environment (${DEPLOY_SUFFIX} ensures isolation).
+# ============================================
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: switchboard-retry${DEPLOY_SUFFIX}
+  namespace: ${NAMESPACE}
+  labels:
+    app: switchboard
+    env: ${ENVIRONMENT}
+spec:
+  retry:
+    attempts: 2
+    initialInterval: 100ms

k8s/rbac-traefik.yaml

@@ -0,0 +1,39 @@
+# k8s/rbac-traefik.yaml
+# ============================================
+# Grant Gitea runner SA permission to manage
+# Traefik Middleware CRDs in the app namespace.
+#
+# Apply once per cluster/namespace:
+#   kubectl apply -f k8s/rbac-traefik.yaml
+#
+# Variables (envsubst):
+#   NAMESPACE       - app namespace (e.g. gobha-ai-chat)
+#   RUNNER_SA_NS    - runner SA namespace (default: gitea-runner)
+# ============================================
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: traefik-middleware-manager
+  namespace: ${NAMESPACE}
+  labels:
+    app: switchboard
+rules:
+  - apiGroups: ["traefik.io"]
+    resources: ["middlewares"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: gitea-runner-traefik-middleware
+  namespace: ${NAMESPACE}
+  labels:
+    app: switchboard
+subjects:
+  - kind: ServiceAccount
+    name: gitea-runner-sa
+    namespace: ${RUNNER_SA_NS:-gitea-runner}
+roleRef:
+  kind: Role
+  name: traefik-middleware-manager
+  apiGroup: rbac.authorization.k8s.io