fix: split Keystone ALB health check

deploy/helm/keystone-stack/README.md

@@ -169,6 +169,11 @@ Synapse uses the same-origin `/api/v1` path. The chart's HTTP Ingress sends
 `/api` and `/swagger` to Keystone, `/transfer` and `/recorder` to Keystone's
 WebSocket ports, and all remaining paths to Synapse.
 
+The chart renders Keystone HTTP paths and the Synapse root path as separate
+Ingress resources because the Volcengine ALB health check is configured per
+Ingress/server group. Keystone uses `/api/v1/health`; Synapse keeps the default
+root health check.
+
 The gRPC Ingress is separate so the VKE ALB annotations can select listener
 `50053` and backend protocol `grpc` without affecting browser/API routing.
 gRPC clients connect to:

deploy/helm/keystone-stack/templates/ingress.yaml

@@ -2,11 +2,11 @@
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: {{ include "keystone-stack.componentName" (list . "ingress") }}
+  name: {{ include "keystone-stack.componentName" (list . "keystone-ingress") }}
   labels:
     {{- include "keystone-stack.labels" . | nindent 4 }}
-    app.kubernetes.io/component: ingress
-  {{- with .Values.ingress.annotations }}
+    app.kubernetes.io/component: keystone-ingress
+  {{- with .Values.ingress.keystoneAnnotations }}
   annotations:
     {{- toYaml . | nindent 4 }}
   {{- end }}
@@ -50,6 +50,30 @@ spec:
                 name: {{ include "keystone-stack.componentName" (list . "keystone") }}
                 port:
                   number: {{ .Values.keystone.service.ports.recorderWebSocket }}
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "keystone-stack.componentName" (list . "ingress") }}
+  labels:
+    {{- include "keystone-stack.labels" . | nindent 4 }}
+    app.kubernetes.io/component: ingress
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- with .Values.ingress.className }}
+  ingressClassName: {{ . | quote }}
+  {{- end }}
+  {{- with .Values.ingress.tls }}
+  tls:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  rules:
+    - host: {{ include "keystone-stack.host" . | quote }}
+      http:
+        paths:
           - path: /
             pathType: Prefix
             backend:

deploy/helm/keystone-stack/values.yaml

@@ -179,6 +179,11 @@ ingress:
     ingress.vke.volcengine.com/loadbalancer-port: "443"
     ingress.vke.volcengine.com/loadbalancer-protocol: https
     ingress.vke.volcengine.com/loadbalancer-backend-protocol: http
+  keystoneAnnotations:
+    ingress.vke.volcengine.com/loadbalancer-port: "443"
+    ingress.vke.volcengine.com/loadbalancer-protocol: https
+    ingress.vke.volcengine.com/loadbalancer-backend-protocol: http
+    ingress.vke.volcengine.com/loadbalancer-healthcheck-path: /api/v1/health
   host: ""
   tls: []
   grpc: