Bring your own ingress

Mon, 01 Jan 0001 00:00:00 +0000

The krypton-gateway Service exposes plain HTTP on port 8080. Production installs put their own L7 ingress in front for TLS termination, auth, and rate limiting. The path prefix you route is always /v1/agents — the gateway handles everything under it (see Ports & endpoints).

Whichever ingress you pick, two settings are non-negotiable:

Disable response buffering — SSE / chunked HTTP need to flush as the agent emits, not at EOF.
Bump the read timeout above your agents’ worst-case response time (default 60s on most ingresses is too low for an LLM-backed agent).

Gateway API

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
 name: krypton-public
 namespace: krypton-system
spec:
 parentRefs:
 - name: my-gateway
 hostnames: ["agents.example.com"]
 rules:
 - matches:
 - path: { type: PathPrefix, value: /v1/agents }
 backendRefs:
 - name: krypton-gateway
 port: 8080

Nginx Ingress

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
 name: krypton-public
 namespace: krypton-system
 annotations:
 nginx.ingress.kubernetes.io/proxy-buffering: "off"
 nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
spec:
 ingressClassName: nginx
 rules:
 - host: agents.example.com
 http:
 paths:
 - path: /v1/agents
 pathType: Prefix
 backend:
 service:
 name: krypton-gateway
 port: { number: 8080 }

Webhooks (optional)

Validating + defaulting webhooks are off by default because they require TLS plumbing (cert-manager or hand-minted certs). The CRD’s OpenAPI validation catches most spec mistakes either way.

Troubleshooting & FAQ

Mon, 01 Jan 0001 00:00:00 +0000

Troubleshooting

Pods can’t pull images (`ImagePullBackOff`)

In kind, confirm the image was loaded:

kind load docker-image --name krypton-dev <image>:<tag>

Image policy must allow local images:

imagePullPolicy: IfNotPresent  # or Never for strict local-only

Cold start times out (504)

The gateway timed out waiting for an Endpoint to become ready. Common causes:

Cause	What to check
Image pull is slow (uncached)	`kubectl describe pod -n <ns> <pod>`
Agent container fails readiness	`kubectl logs -n <ns> <pod> -c agent`
Sidecar `/readyz` failing	`kubectl logs -n <ns> <pod> -c krypton-proxy`
Wrong `spec.port` (agent listens elsewhere)	Look for “connect: connection refused” in sidecar logs

Bump the timeout if your agent is slow to start:

Operations on Krypton Runtime