I will scream

apps/children/debug.yaml

@@ -0,0 +1,21 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+    name: debug-netshoot
+    namespace: ai
+    labels:
+        repo.ion606.com/ollama-plus: "true"
+spec:
+    project: ai-stack
+    destination:
+        server: https://kubernetes.default.svc
+        namespace: ai
+    source:
+        repoURL: https://git.ion606.com/ion606/ollama-plus
+        targetRevision: main
+        path: manifests/debug
+    syncPolicy:
+        automated:
+            prune: true
+            selfHeal: true
+

apps/children/kustomization.yaml

@@ -10,6 +10,7 @@ resources:
     - postgresql.yaml
     - searxng.yaml
     - browser.yaml
+    - debug.yaml
     - policy.yaml
     - policy-argo.yaml
 

manifests/debug/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+    - netshoot.yaml
+

manifests/debug/netshoot.yaml

@@ -0,0 +1,26 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+    name: netshoot
+    namespace: ai
+spec:
+    replicas: 1
+    selector:
+        matchLabels:
+            app: netshoot
+    template:
+        metadata:
+            labels:
+                app: netshoot
+        spec:
+            containers:
+                - name: netshoot
+                  image: nicolaka/netshoot:latest
+                  imagePullPolicy: IfNotPresent
+                  command: ["/bin/sh", "-c", "sleep infinity"]
+                  securityContext:
+                      capabilities:
+                          add: ["NET_ADMIN", "NET_RAW"]
+                  resources:
+                      requests: { cpu: "50m", memory: "64Mi" }
+                      limits: { cpu: "200m", memory: "256Mi" }

scripts/setup.sh

@@ -5,10 +5,19 @@ set -euo pipefail;
 # cluster + ingress addons (nginx + ingress-dns)
 # https://kubernetes.io/docs/tasks/access-application-cluster/ingress-minikube/
 # https://minikube.sigs.k8s.io/docs/handbook/addons/ingress-dns/
-minikube start --driver=docker || true;
+# NOTE: publish ports 80/443 from the node to the host when using Docker driver
+minikube start --driver=docker --cni=cilium --ports=80:80,443:443;
 minikube addons enable ingress;
 minikube addons enable ingress-dns;
 
+# wait for Cilium (if present) and ingress controller to become Ready
+kubectl -n kube-system rollout status ds/cilium --timeout=180s || echo "WARN: cilium DaemonSet not found or not Ready yet";
+if kubectl -n ingress-nginx get ds/ingress-nginx-controller >/dev/null 2>&1; then
+  kubectl -n ingress-nginx rollout status ds/ingress-nginx-controller --timeout=180s || true;
+else
+  kubectl -n ingress-nginx rollout status deploy/ingress-nginx-controller --timeout=180s || true;
+fi
+
 # namespaces
 kubectl create namespace argocd --dry-run=client -o yaml | kubectl apply -f -;
 kubectl create namespace ai --dry-run=client -o yaml | kubectl apply -f -;
@@ -32,6 +41,14 @@ echo "DEBUG: writing pods to 'tmp/pods.txt'"
 mkdir -p tmp || ""
 kubectl get pod -o wide --all-namespaces > tmp/pods.txt
 
+# quick ingress test hint
+MINIKUBE_IP=$(minikube ip || echo "<minikube-ip>")
+echo "";
+echo "To test ingress locally (without DNS), run:";
+echo "  curl -H 'Host: openwebui.local' http://$MINIKUBE_IP/";
+echo "If name doesn't resolve on your host, add to /etc/hosts:";
+echo "  sudo sh -c 'echo \"$MINIKUBE_IP openwebui.local\" >> /etc/hosts'";
+
 # port-forward argocd ui
 echo "";
 echo "argocd initial admin password (username 'admin'):";