From a592bd9ad0ace87413e4ea701b985af2283d9576 Mon Sep 17 00:00:00 2001
From: Codex Agent <codex@hwlab.local>
Date: Sun, 7 Jun 2026 21:58:46 +0800
Subject: [PATCH] fix: keep v02 edge proxy probe local

---
 docs/reference/spec-v02-hwlab-edge-proxy.md |  1 +
 scripts/g14-gitops-render.mjs               | 12 ++++++++++++
 scripts/g14-gitops-render.test.ts           |  5 +++++
 3 files changed, 18 insertions(+)

diff --git a/docs/reference/spec-v02-hwlab-edge-proxy.md b/docs/reference/spec-v02-hwlab-edge-proxy.md
index 584e36bf..bbe2cf1e 100644
--- a/docs/reference/spec-v02-hwlab-edge-proxy.md
+++ b/docs/reference/spec-v02-hwlab-edge-proxy.md
@@ -6,6 +6,7 @@
 
 - 接收 FRP 转入的 API/health 请求，并代理到 `hwlab-cloud-api:6667`。
 - `/health/live` 必须透传 cloud-api live health，因此公网 API readiness 以 cloud-api 为准。
+- Pod readiness/liveness 必须使用 edge 自身 `/health`，不能使用会依赖 upstream 的 `/health/live`，避免 cloud-api 短暂不可用时把 edge-proxy 自身杀成 CrashLoop。
 - `/v1/internal/*` 是集群内部服务路由，必须在 public edge 上 fail-closed，不透传到 cloud-api。
 - 不实现业务 API，不读取 Secret，不替代 cloud-api 权限和 runtime readiness。
 
diff --git a/scripts/g14-gitops-render.mjs b/scripts/g14-gitops-render.mjs
index 0f4518ac..fb33684c 100644
--- a/scripts/g14-gitops-render.mjs
+++ b/scripts/g14-gitops-render.mjs
@@ -502,6 +502,15 @@ function applyEnvReuseBootEnv(container, bootMetadata, { sourceBranch, bootSh =
   upsertEnv(container.env, "HWLAB_IMAGE_DIGEST", bootMetadata.environmentDigest ?? "unknown");
 }
 
+function useLocalHealthProbe(container, pathValue = "/health") {
+  if (!container) return;
+  for (const probeName of ["readinessProbe", "livenessProbe"]) {
+    const probe = container[probeName];
+    if (!probe?.httpGet) continue;
+    probe.httpGet.path = pathValue;
+  }
+}
+
 function annotateEnvReusePodTemplate(podMetadata, bootMetadata) {
   if (!podMetadata || !bootMetadata) return;
   annotate(podMetadata, {
@@ -994,6 +1003,9 @@ function transformWorkloads({ workloads, deploy, catalog, source, sourceBranch =
       if (serviceId === "hwlab-cloud-api" || serviceId === "hwlab-edge-proxy") {
         upsertEnv(container.env, "HWLAB_PUBLIC_ENDPOINT", runtimeEndpoint);
       }
+      if (profile === "v02" && serviceId === "hwlab-edge-proxy") {
+        useLocalHealthProbe(container, "/health");
+      }
       if (serviceId === "hwlab-cloud-api") {
         if (profile === "v02") {
           removeV02RepoOwnedCodeAgentPodConfig(podTemplate.spec);
diff --git a/scripts/g14-gitops-render.test.ts b/scripts/g14-gitops-render.test.ts
index 0fd58193..bc37b208 100644
--- a/scripts/g14-gitops-render.test.ts
+++ b/scripts/g14-gitops-render.test.ts
@@ -316,6 +316,11 @@ test("v02 render follows TypeScript runtime checks and does not self-patch boots
       } else {
         assert.equal(sidecar.env.some((entry) => entry.name === "HWLAB_METRICS_EXTRA_URL"), false, `unexpected extra metrics target for ${serviceId}`);
       }
+      if (serviceId === "hwlab-edge-proxy") {
+        const container = workload.spec.template.spec.containers.find((entry) => entry.name === "hwlab-edge-proxy");
+        assert.equal(container.readinessProbe.httpGet.path, "/health");
+        assert.equal(container.livenessProbe.httpGet.path, "/health");
+      }
     }
     const deepseekService = deepseekProxy.items.find((item) => item.kind === "Service" && item.metadata?.name === "hwlab-deepseek-proxy");
     assert.equal(deepseekService.metadata.labels["hwlab.pikastech.local/monitoring"], "enabled");