infra: replace all nginx references with hanzo ingress

Migrate every ingress resource from nginx annotations to
traefik.ingress.kubernetes.io for hanzoai/ingress controller.
Update network policies to match hanzo-ingress pod selector.
Update operator config to use className: hanzo.

infra/k8s/bootnode-deployment.yaml

@@ -337,12 +337,9 @@ metadata:
   name: bootnode-ingress
   namespace: bootnode
   annotations:
-    kubernetes.io/ingress.class: "nginx"
+    kubernetes.io/ingress.class: "hanzo"
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
-    nginx.ingress.kubernetes.io/rate-limit: "100"
-    nginx.ingress.kubernetes.io/cors-allow-origin: "*"
-    nginx.ingress.kubernetes.io/cors-allow-methods: "GET, POST, PUT, DELETE, OPTIONS"
-    nginx.ingress.kubernetes.io/cors-allow-headers: "DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,X-API-Key"
+    traefik.ingress.kubernetes.io/router.tls: "true"
 spec:
   tls:
   - hosts:

infra/k8s/bootnode-operator.yaml

@@ -533,11 +533,10 @@ spec:
       enabled: true
   ingress:
     enabled: true
-    className: "nginx"
+    className: "hanzo"
     annotations:
       cert-manager.io/cluster-issuer: "letsencrypt-prod"
-      nginx.ingress.kubernetes.io/rate-limit: "1000"
-      nginx.ingress.kubernetes.io/cors-allow-origin: "*"
+      traefik.ingress.kubernetes.io/router.tls: "true"
     hosts:
       - host: api.bootno.de
         paths:

infra/k8s/cloud-ingress.yaml

@@ -5,12 +5,10 @@ metadata:
   namespace: hanzo
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-prod
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/proxy-body-size: "50m"
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "120"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "120"
+    traefik.ingress.kubernetes.io/router.tls: "true"
+    traefik.ingress.kubernetes.io/buffering.maxrequestbodybytes: "52428800"
 spec:
-  ingressClassName: nginx
+  ingressClassName: hanzo
   rules:
     - host: cloud.hanzo.ai
       http:

infra/k8s/ingress.yaml

@@ -9,14 +9,11 @@ metadata:
   name: bootnode-hanzo-ingress
   namespace: bootnode
   annotations:
-    kubernetes.io/ingress.class: nginx
+    kubernetes.io/ingress.class: hanzo
     cert-manager.io/cluster-issuer: letsencrypt-prod
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/proxy-body-size: "10m"
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "60"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "60"
+    traefik.ingress.kubernetes.io/router.tls: "true"
 spec:
-  ingressClassName: nginx
+  ingressClassName: hanzo
   tls:
     - hosts:
         - web3.hanzo.ai
@@ -50,15 +47,11 @@ metadata:
   name: bootnode-hanzo-ws-ingress
   namespace: bootnode
   annotations:
-    kubernetes.io/ingress.class: nginx
+    kubernetes.io/ingress.class: hanzo
     cert-manager.io/cluster-issuer: letsencrypt-prod
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
-    nginx.ingress.kubernetes.io/upstream-hash-by: "$remote_addr"
-    nginx.ingress.kubernetes.io/websocket-services: "bootnode-api"
+    traefik.ingress.kubernetes.io/router.tls: "true"
 spec:
-  ingressClassName: nginx
+  ingressClassName: hanzo
   tls:
     - hosts:
         - ws.web3.hanzo.ai
@@ -82,14 +75,11 @@ metadata:
   name: bootnode-lux-ingress
   namespace: bootnode
   annotations:
-    kubernetes.io/ingress.class: nginx
+    kubernetes.io/ingress.class: hanzo
     cert-manager.io/cluster-issuer: letsencrypt-prod
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/proxy-body-size: "10m"
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "60"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "60"
+    traefik.ingress.kubernetes.io/router.tls: "true"
 spec:
-  ingressClassName: nginx
+  ingressClassName: hanzo
   tls:
     - hosts:
         - web3.lux.network
@@ -123,15 +113,11 @@ metadata:
   name: bootnode-lux-ws-ingress
   namespace: bootnode
   annotations:
-    kubernetes.io/ingress.class: nginx
+    kubernetes.io/ingress.class: hanzo
     cert-manager.io/cluster-issuer: letsencrypt-prod
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
-    nginx.ingress.kubernetes.io/upstream-hash-by: "$remote_addr"
-    nginx.ingress.kubernetes.io/websocket-services: "bootnode-api"
+    traefik.ingress.kubernetes.io/router.tls: "true"
 spec:
-  ingressClassName: nginx
+  ingressClassName: hanzo
   tls:
     - hosts:
         - ws.web3.lux.network
@@ -155,14 +141,11 @@ metadata:
   name: bootnode-zoo-ingress
   namespace: bootnode
   annotations:
-    kubernetes.io/ingress.class: nginx
+    kubernetes.io/ingress.class: hanzo
     cert-manager.io/cluster-issuer: letsencrypt-prod
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/proxy-body-size: "10m"
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "60"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "60"
+    traefik.ingress.kubernetes.io/router.tls: "true"
 spec:
-  ingressClassName: nginx
+  ingressClassName: hanzo
   tls:
     - hosts:
         - web3.zoo.ngo
@@ -196,15 +179,11 @@ metadata:
   name: bootnode-zoo-ws-ingress
   namespace: bootnode
   annotations:
-    kubernetes.io/ingress.class: nginx
+    kubernetes.io/ingress.class: hanzo
     cert-manager.io/cluster-issuer: letsencrypt-prod
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
-    nginx.ingress.kubernetes.io/upstream-hash-by: "$remote_addr"
-    nginx.ingress.kubernetes.io/websocket-services: "bootnode-api"
+    traefik.ingress.kubernetes.io/router.tls: "true"
 spec:
-  ingressClassName: nginx
+  ingressClassName: hanzo
   tls:
     - hosts:
         - ws.web3.zoo.ngo
@@ -228,14 +207,11 @@ metadata:
   name: bootnode-pars-ingress
   namespace: bootnode
   annotations:
-    kubernetes.io/ingress.class: nginx
+    kubernetes.io/ingress.class: hanzo
     cert-manager.io/cluster-issuer: letsencrypt-prod
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/proxy-body-size: "10m"
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "60"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "60"
+    traefik.ingress.kubernetes.io/router.tls: "true"
 spec:
-  ingressClassName: nginx
+  ingressClassName: hanzo
   tls:
     - hosts:
         - web3.pars.id
@@ -269,15 +245,11 @@ metadata:
   name: bootnode-pars-ws-ingress
   namespace: bootnode
   annotations:
-    kubernetes.io/ingress.class: nginx
+    kubernetes.io/ingress.class: hanzo
     cert-manager.io/cluster-issuer: letsencrypt-prod
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
-    nginx.ingress.kubernetes.io/upstream-hash-by: "$remote_addr"
-    nginx.ingress.kubernetes.io/websocket-services: "bootnode-api"
+    traefik.ingress.kubernetes.io/router.tls: "true"
 spec:
-  ingressClassName: nginx
+  ingressClassName: hanzo
   tls:
     - hosts:
         - ws.web3.pars.id
@@ -301,14 +273,11 @@ metadata:
   name: bootnode-brand-ingress
   namespace: bootnode
   annotations:
-    kubernetes.io/ingress.class: nginx
+    kubernetes.io/ingress.class: hanzo
     cert-manager.io/cluster-issuer: letsencrypt-prod
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/proxy-body-size: "10m"
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "60"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "60"
+    traefik.ingress.kubernetes.io/router.tls: "true"
 spec:
-  ingressClassName: nginx
+  ingressClassName: hanzo
   tls:
     - hosts:
         - bootno.de
@@ -342,15 +311,11 @@ metadata:
   name: bootnode-brand-ws-ingress
   namespace: bootnode
   annotations:
-    kubernetes.io/ingress.class: nginx
+    kubernetes.io/ingress.class: hanzo
     cert-manager.io/cluster-issuer: letsencrypt-prod
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
-    nginx.ingress.kubernetes.io/upstream-hash-by: "$remote_addr"
-    nginx.ingress.kubernetes.io/websocket-services: "bootnode-api"
+    traefik.ingress.kubernetes.io/router.tls: "true"
 spec:
-  ingressClassName: nginx
+  ingressClassName: hanzo
   tls:
     - hosts:
         - ws.bootno.de
@@ -374,11 +339,11 @@ metadata:
   name: bootnode-docs-ingress
   namespace: bootnode
   annotations:
-    kubernetes.io/ingress.class: nginx
+    kubernetes.io/ingress.class: hanzo
     cert-manager.io/cluster-issuer: letsencrypt-prod
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    traefik.ingress.kubernetes.io/router.tls: "true"
 spec:
-  ingressClassName: nginx
+  ingressClassName: hanzo
   tls:
     - hosts:
         - docs.bootno.de
@@ -402,14 +367,11 @@ metadata:
   name: bootnode-lux-cloud-ingress
   namespace: bootnode
   annotations:
-    kubernetes.io/ingress.class: nginx
+    kubernetes.io/ingress.class: hanzo
     cert-manager.io/cluster-issuer: letsencrypt-prod
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/proxy-body-size: "10m"
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "60"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "60"
+    traefik.ingress.kubernetes.io/router.tls: "true"
 spec:
-  ingressClassName: nginx
+  ingressClassName: hanzo
   tls:
     - hosts:
         - cloud.lux.network
@@ -444,12 +406,11 @@ metadata:
   name: bootnode-lux-build-ingress
   namespace: bootnode
   annotations:
-    kubernetes.io/ingress.class: nginx
+    kubernetes.io/ingress.class: hanzo
     cert-manager.io/cluster-issuer: letsencrypt-prod
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/proxy-body-size: "10m"
+    traefik.ingress.kubernetes.io/router.tls: "true"
 spec:
-  ingressClassName: nginx
+  ingressClassName: hanzo
   tls:
     - hosts:
         - lux.build

infra/k8s/network-policies.yaml

@@ -22,7 +22,7 @@ spec:
     - Ingress
 
 ---
-# -- Allow Ingress from Nginx Ingress Controller --------------------------------
+# -- Allow Ingress from Hanzo Ingress Controller --------------------------------
 # Web portals and docs accept traffic from ingress controller
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
@@ -51,7 +51,7 @@ spec:
         - namespaceSelector: {}
           podSelector:
             matchLabels:
-              app.kubernetes.io/name: ingress-nginx
+              app.kubernetes.io/name: hanzo-ingress
 
 ---
 # -- Intra-namespace: pods can talk to each other --------------------------------