From e5140a8dd3cb30943d534a25d8c3d7b30db1e22e Mon Sep 17 00:00:00 2001 From: inesaranab Date: Tue, 11 Aug 2026 21:47:44 +0200 Subject: [PATCH] docs: require https for the detector's address The detector's ingress sets allowInsecure false, so it answers plain HTTP with a redirect rather than serving it. A client that follows a 301 turns the POST into a GET, and the endpoint rejects that with 405 Method Not Allowed -- the URL is right, the client is working, the request arrives, and the verb has been changed underneath it by the transport. The template carries a placeholder, so nothing in the repository was wrong; the requirement simply was not written down anywhere it would be read while substituting one. It is now stated at the point of substitution and recorded in the runbook alongside the other failure this redirect causes. --- infra/gemma/README.md | 18 ++++++++++++++++++ infra/worker-job.yaml | 4 ++++ 2 files changed, 22 insertions(+) diff --git a/infra/gemma/README.md b/infra/gemma/README.md index 6204701..32c53bc 100644 --- a/infra/gemma/README.md +++ b/infra/gemma/README.md @@ -391,6 +391,24 @@ endpoint with short requests until it answers, then send the inference to a warm it returns in seconds. Many brief calls instead of one long one — the same shape as `202 + poll`, applied one layer down. +### The detector's address must be https + +`screening-gemma` has `allowInsecure: false`, so its ingress does not serve plain +HTTP — it answers with a redirect to HTTPS. That produces two different failures +depending on what the caller does with the redirect, and neither names its cause: + +| Caller | Behaviour | Symptom | +|---|---|---| +| Does not follow redirects | Sees a non-200 forever | Endpoint reported unreachable, and the redirect alone does not start an app scaled to zero, so it never becomes reachable | +| Follows a 301 | The redirect rewrites POST as GET | `405 Method Not Allowed` from an endpoint that only accepts POST | + +The second is the more misleading: the URL is right, the client is working, the +request arrives — and the verb has been changed underneath it by the transport. + +Use `https://` in `SCREENING_LLM_GUARDRAIL_BASE_URL` and neither arises. Internal +ingress terminates TLS inside the environment, so this costs nothing and the +traffic still never leaves it. + ### Cost scales with wake-ups, not with screenings The GPU bills for its cold start whether or not the caller survives it, so the unit of cost is diff --git a/infra/worker-job.yaml b/infra/worker-job.yaml index 35a0381..e7c7125 100644 --- a/infra/worker-job.yaml +++ b/infra/worker-job.yaml @@ -88,6 +88,10 @@ properties: - name: SCREENING_PORTKEY_VIRTUAL_KEY value: screening-openrouter ## The detector's address, resolvable only inside this environment. + ## MUST be https. The detector's ingress sets allowInsecure false, so + ## a plain HTTP request is answered with a redirect, and a client + ## following a 301 turns a POST into a GET -- the endpoint then + ## rejects it with 405 rather than doing the work. - name: SCREENING_LLM_GUARDRAIL_BASE_URL value: ${GEMMA_URL} ## Names which identity DefaultAzureCredential should use, since the