From 09bcc8fa9b34cf5c0a50f9cbac6ba9d8cf77dd38 Mon Sep 17 00:00:00 2001
From: agent <markus+agent@langenoja.se>
Date: Mon, 31 Aug 2026 14:30:50 +0200
Subject: [PATCH] probe: measure which registry endpoints a cluster pod can
 reach

Temporary, not for merge. 10.40.0.10 is the istio-gateway EXTERNAL LoadBalancer
address and is connection-refused from the pod network; this measures the
candidates instead of inferring one.
---
 .github/workflows/probe-registry.yml | 47 ++++++++++++++++++++++++++++
 1 file changed, 47 insertions(+)
 create mode 100644 .github/workflows/probe-registry.yml

diff --git a/.github/workflows/probe-registry.yml b/.github/workflows/probe-registry.yml
new file mode 100644
index 0000000..9c597bd
--- /dev/null
+++ b/.github/workflows/probe-registry.yml
@@ -0,0 +1,47 @@
+name: probe registry endpoints
+
+# TEMPORARY probe branch — not for merge. Answers one question with evidence
+# instead of inference: which registry endpoints are reachable from a pod inside
+# this cluster, after 10.40.0.10 (the istio-gateway LoadBalancer EXTERNAL
+# address) turned out to be connection-refused from the pod network while
+# answering fine from a LAN workstation.
+
+on:
+  workflow_dispatch:
+
+jobs:
+  probe:
+    if: ${{ github.server_url != 'https://github.com' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Probe candidate registry endpoints
+        run: |
+          set -u
+          fmt='http=%{http_code} tls=%{ssl_verify_result} t=%{time_total}\n'
+
+          echo "--- public name via cluster DNS (the path that works today) ---"
+          printf '%-46s ' 'gitea.langenoja.se:443'
+          curl -s -o /dev/null -w "$fmt" --max-time 8 https://gitea.langenoja.se/v2/ \
+            || echo "UNREACHABLE"
+
+          echo "--- istio-gateway EXTERNAL lb ip (what #949 pinned) ---"
+          printf '%-46s ' '10.40.0.10:443'
+          curl -s -o /dev/null -w "$fmt" --max-time 8 \
+            --resolve gitea.langenoja.se:443:10.40.0.10 https://gitea.langenoja.se/v2/ \
+            || echo "UNREACHABLE"
+
+          echo "--- istio-gateway CLUSTER ip (candidate) ---"
+          printf '%-46s ' '10.43.1.114:443'
+          curl -s -o /dev/null -w "$fmt" --max-time 8 \
+            --resolve gitea.langenoja.se:443:10.43.1.114 https://gitea.langenoja.se/v2/ \
+            || echo "UNREACHABLE"
+
+          echo "--- gitea http service, in-cluster, plain http ---"
+          printf '%-46s ' 'gitea-system-gitea-http:3000'
+          curl -s -o /dev/null -w "$fmt" --max-time 8 \
+            http://gitea-system-gitea-http.gitea-system.svc.cluster.local:3000/v2/ \
+            || echo "UNREACHABLE"
+
+          echo "--- what this pod resolves the public name to ---"
+          getent hosts gitea.langenoja.se || echo "(getent failed)"