- Shipped
- 3 Septemba 2026, 19:21 UTC
- Author
- Kamo
- Commit
- 93a2def
It was written into securityservice/k8s/ beside the deployment, which reads as the obvious home and is not one: that repo's workflow applies exactly configmap.yaml, deployment.yaml and service.yaml. A fourth manifest next to them is applied by nothing. So the route existed in the tree and not in the cluster, and the socket 404'd at the edge — with no Traefik rule to find, no SecurityService log line, and a manifest in git that looked like proof it should have worked. traefik/routes/ here is applied wholesale (`kubectl apply -f traefik/routes/`), so it is reconciled on every deploy instead of drifting. Verified through the real edge afterwards: 401 without a ticket, 401 with a forged one, 403 from another origin — i.e. the rule matches, StripPrefix works, and the WebSocket upgrade headers survive the hop.