Deploy Body Wars Observability WebUI (Open WebUI → astro-orbiter vLLM)

- Service: Open WebUI latest (ghcr.io/open-webui/open-webui:latest)
- Backend: http://astro-orbiter:8000/v1 (Gemma-4-26B-A4B-it-AWQ)
- Ingress: body-wars.local.mk-labs.cloud (letsencrypt-prod TLS)
- Auth: vLLM API key from 1Password (op://mk-labs/vllm/api-key)
- ArgoCD wave 9 (post-Hindsight observability)
- ExternalSecret syncs credentials before deployment
- Replicas: 1, Resource limits: 1GB memory, 1 CPU

cluster/applications/body-wars/ingress.yaml

@@ -0,0 +1,40 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: body-wars
+  namespace: body-wars
+  labels:
+    app.kubernetes.io/name: body-wars
+    app.kubernetes.io/part-of: mk-labs
+  annotations:
+    # TLS certificate from Let's Encrypt (production)
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    # Nginx ingress controller settings
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    # Session affinity for WebSocket support
+    nginx.ingress.kubernetes.io/affinity: "cookie"
+    nginx.ingress.kubernetes.io/affinity-mode: "persistent"
+    # Observability header
+    nginx.ingress.kubernetes.io/enable-access-log: "true"
+    # Rate limiting to prevent abuse
+    nginx.ingress.kubernetes.io/limit-connections: "10"
+    nginx.ingress.kubernetes.io/limit-rps: "50"
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - body-wars.local.mk-labs.cloud
+    secretName: body-wars-tls
+    # Let's Encrypt production certificate
+  rules:
+  - host: body-wars.local.mk-labs.cloud
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: open-webui
+            port:
+              number: 80