mirror of
https://github.com/hanzoai/gateway.git
synced 2026-11-02 23:52:23 +00:00
zooqueenandHanzo Dev
a9188d8c6c
Every surface signs people in through Hanzo IAM itself, so neither gate has a host to front. The token package no longer accepts hanzo-admin-guard as an audience; IAM is deleting that client. Co-authored-by: Hanzo Dev <[email protected]>
62 lines
2.2 KiB
YAML
62 lines
2.2 KiB
YAML
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: gateway-ingress
|
|
namespace: hanzo
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
spec:
|
|
ingressClassName: ingress
|
|
# The gateway is the edge router for the AI/LLM API hosts, which terminate at
|
|
# the gateway Service (global IAM-JWT + rate-limit, then host/path dispatch via
|
|
# routes.yaml).
|
|
# api.hanzo.ai → gateway. ONE API host — no .cloud.
|
|
# cloud.hanzo.ai / console.hanzo.ai / console2.hanzo.ai → gateway SPA at "/".
|
|
#
|
|
# admin.hanzo.ai is DELIBERATELY NOT claimed here. The operator cockpit is a
|
|
# ZERO-TRUST surface: it is owned solely by the `console2-admin` Ingress
|
|
# (universe infra/k8s/admin-console/ingress.yaml) which routes admin.hanzo.ai
|
|
# to the console SPA (service `console`:4000) + cloud-api. Claiming
|
|
# admin.hanzo.ai here too would create a second router (gateway:8080) for the
|
|
# same host+path. One owner, no dual-routing. admin.hanzo.ai
|
|
# has its own cert (admin-hanzo-tls) via console2-admin, so it is out of the
|
|
# gateway-tls SAN set as well.
|
|
tls:
|
|
- hosts:
|
|
- api.hanzo.ai
|
|
- cloud.hanzo.ai
|
|
- console.hanzo.ai
|
|
- console2.hanzo.ai
|
|
secretName: gateway-tls
|
|
rules:
|
|
- host: api.hanzo.ai
|
|
http: &gateway
|
|
paths:
|
|
# Agent Skills Discovery is public + served by the cloud binary (which
|
|
# white-labels by the preserved Host). This more-specific prefix wins over
|
|
# `/` in Traefik, so /.well-known/agent-skills bypasses the gateway's IAM
|
|
# gate and reaches cloud directly, while every other path still flows
|
|
# through the gateway. One edit on the shared anchor covers every host
|
|
# below (api/cloud/console/console2.hanzo.ai — admin.hanzo.ai is NOT here,
|
|
# it is the gated console2-admin surface).
|
|
- path: /.well-known/agent-skills
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: cloud
|
|
port:
|
|
number: 8000
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: gateway
|
|
port:
|
|
number: 8080
|
|
- host: cloud.hanzo.ai
|
|
http: *gateway
|
|
- host: console.hanzo.ai
|
|
http: *gateway
|
|
- host: console2.hanzo.ai
|
|
http: *gateway
|