zooqueenandHanzo Dev bcfbb991e2 Hosted compute calls EC2 only through egress, which signs as the account hanzo-compute; this process holds nothing that can sign an AWS request. ...

The IAM client_credentials to STS chain and its computeRoleArn and computeIam keys are gone. The EC2 client is built from explicit options with anonymous credentials over the egress carrier, and with no egressAddress hosted compute refuses by name. A customer's own AWS account is carried the same way. Region, subnet, security group and images stay in app.conf, the config files carry egressAddress and egressAudience, and the unread commerceToken is removed. spend moves to the egress aws commit.

Co-authored-by: Hanzo Dev <[email protected]>

2026-09-23 17:56:56 -07:00

..

configmap.yaml

Hosted compute calls EC2 only through egress, which signs as the account hanzo-compute; this process holds nothing that can sign an AWS request.

2026-09-23 17:56:56 -07:00

deployment.yaml

visor answers to its own name, and a probe that can fail

2026-08-05 23:38:21 -07:00

rbac.yaml

visor is the multi-cloud path: no Kubernetes client at all

2026-08-05 19:07:11 -07:00

service.yaml

feat: add K8s manifests and GHCR CI for visor deployment

2026-02-10 13:54:14 -08:00