From 0bbd2dc80b87e0e9da44a29d6a24ad37244b0c45 Mon Sep 17 00:00:00 2001
From: yuyufei <yuyufei@archebase.ai>
Date: Sat, 25 Jul 2026 13:53:45 +0800
Subject: [PATCH] fix: split keystone ingress health check

---
 deploy/helm/keystone-stack/README.md          |  5 ++++
 .../keystone-stack/templates/ingress.yaml     | 30 +++++++++++++++++--
 deploy/helm/keystone-stack/values.yaml        |  5 ++++
 3 files changed, 37 insertions(+), 3 deletions(-)

diff --git a/deploy/helm/keystone-stack/README.md b/deploy/helm/keystone-stack/README.md
index 132ede1..d85c206 100644
--- a/deploy/helm/keystone-stack/README.md
+++ b/deploy/helm/keystone-stack/README.md
@@ -169,6 +169,11 @@ Synapse uses the same-origin `/api/v1` path. The chart's HTTP Ingress sends
 `/api` and `/swagger` to Keystone, `/transfer` and `/recorder` to Keystone's
 WebSocket ports, and all remaining paths to Synapse.
 
+The chart renders Keystone HTTP paths and the Synapse root path as separate
+Ingress resources because the Volcengine ALB health check is configured per
+Ingress/server group. Keystone uses `/api/v1/health`; Synapse keeps the default
+root health check.
+
 The gRPC Ingress is separate so the VKE ALB annotations can select listener
 `50053` and backend protocol `grpc` without affecting browser/API routing.
 gRPC clients connect to:
diff --git a/deploy/helm/keystone-stack/templates/ingress.yaml b/deploy/helm/keystone-stack/templates/ingress.yaml
index 365d5bd..ee07ad2 100644
--- a/deploy/helm/keystone-stack/templates/ingress.yaml
+++ b/deploy/helm/keystone-stack/templates/ingress.yaml
@@ -2,11 +2,11 @@
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: {{ include "keystone-stack.componentName" (list . "ingress") }}
+  name: {{ include "keystone-stack.componentName" (list . "keystone-ingress") }}
   labels:
     {{- include "keystone-stack.labels" . | nindent 4 }}
-    app.kubernetes.io/component: ingress
-  {{- with .Values.ingress.annotations }}
+    app.kubernetes.io/component: keystone-ingress
+  {{- with .Values.ingress.keystoneAnnotations }}
   annotations:
     {{- toYaml . | nindent 4 }}
   {{- end }}
@@ -50,6 +50,30 @@ spec:
                 name: {{ include "keystone-stack.componentName" (list . "keystone") }}
                 port:
                   number: {{ .Values.keystone.service.ports.recorderWebSocket }}
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "keystone-stack.componentName" (list . "ingress") }}
+  labels:
+    {{- include "keystone-stack.labels" . | nindent 4 }}
+    app.kubernetes.io/component: ingress
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- with .Values.ingress.className }}
+  ingressClassName: {{ . | quote }}
+  {{- end }}
+  {{- with .Values.ingress.tls }}
+  tls:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  rules:
+    - host: {{ include "keystone-stack.host" . | quote }}
+      http:
+        paths:
           - path: /
             pathType: Prefix
             backend:
diff --git a/deploy/helm/keystone-stack/values.yaml b/deploy/helm/keystone-stack/values.yaml
index b8ba046..1a1475c 100644
--- a/deploy/helm/keystone-stack/values.yaml
+++ b/deploy/helm/keystone-stack/values.yaml
@@ -179,6 +179,11 @@ ingress:
     ingress.vke.volcengine.com/loadbalancer-port: "443"
     ingress.vke.volcengine.com/loadbalancer-protocol: https
     ingress.vke.volcengine.com/loadbalancer-backend-protocol: http
+  keystoneAnnotations:
+    ingress.vke.volcengine.com/loadbalancer-port: "443"
+    ingress.vke.volcengine.com/loadbalancer-protocol: https
+    ingress.vke.volcengine.com/loadbalancer-backend-protocol: http
+    ingress.vke.volcengine.com/loadbalancer-healthcheck-path: /api/v1/health
   host: ""
   tls: []
   grpc: