Observability

What outsiders can see

The public status page at /status, and its JSON form at /api/status, show eleven components as operational, degraded or down. This is the supported way to check health from outside the cluster.

What is hidden

The raw Quarkus health and metrics endpoints under /q are no longer routed by the ingress. /q/health, /q/metrics, /q/openapi and /q/swagger-ui return 404 on both web hosts. /api/v1/health is routed to the program service and requires a token.

Inside the cluster

• Each Quarkus service exposes /q/health/ready and /q/health/live. The kubelet probes them directly on the pod.
• The frontend pod calls each service's readiness endpoint over the cluster network to build the status summary.
• Keycloak serves health on its management port 9000, and the manifest sets KC_METRICS_ENABLED so readiness includes a database check.
• Pod logs are read with kubectl logs.

Not covered here

A grafana.rtih.peoplewave.in host is defined in the ingress file. What it shows, and whether alerting exists, was not examined. Both are unverified. An alert on Keycloak readiness was recommended in the enforcement report. Whether it exists is unknown.

Sources: frontend/src/lib/status/status.ts, .agents/tasks/status-page/ingress.md, infra/k8s/keycloak.yaml, infra/oci-devops/deploy/ingress.yaml.