mirror of
https://github.com/hanzoai/gateway.git
synced 2026-10-30 15:04:44 +00:00
zeekay
cbc3c31192
The endpoint pipeline ran a SECOND JWT validation to answer a question the edge had already answered one middleware earlier — a second crypto library, a second JWKS URL, and ALL-of audience semantics against the edge's ANY-of, which 401s every user JWT IAM issues. Requiring a credential and verifying one are different jobs; only the second needs a key, and only one thing should do it. Routes now declare `auth/public` and the edge is the one validator. The ingress binary, its config and its manifests leave this repo. They were a second copy of a service that has its own, and the two had drifted.
53 lines
1.6 KiB
YAML
53 lines
1.6 KiB
YAML
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: gateway
|
|
namespace: hanzo
|
|
spec:
|
|
selector:
|
|
app: gateway
|
|
ports:
|
|
- name: http
|
|
port: 8080
|
|
targetPort: 8080
|
|
- name: zap
|
|
port: 9999
|
|
targetPort: 9999
|
|
type: ClusterIP
|
|
---
|
|
# There is no LoadBalancer for HTTP here on purpose.
|
|
#
|
|
# This file used to declare a second one, `hanzo-ingress`, selecting these same
|
|
# gateway pods on :80 and :443. Two things were wrong with it. It named a
|
|
# Kubernetes object and a DigitalOcean load balancer that hanzoai/ingress also
|
|
# declares in this namespace, so whichever repo was applied last decided which
|
|
# pods the estate's front door pointed at. And it answered :443 by forwarding
|
|
# to a plaintext :8080 — a load balancer that terminates nothing in front of a
|
|
# process that terminates nothing.
|
|
#
|
|
# HTTP reaches this gateway the one way it should: through the ingress, via
|
|
# ingress.yaml in this directory (ingressClassName: ingress), which terminates
|
|
# TLS and routes by host. ZAP keeps its own load balancer below because it is a
|
|
# different protocol on a different port, not a second door to the same one.
|
|
---
|
|
# Dedicated TCP LoadBalancer for ZAP binary protocol.
|
|
# DNS: zap.hanzo.ai → this LB's external IP.
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: zap-ingress
|
|
namespace: hanzo
|
|
annotations:
|
|
service.beta.kubernetes.io/do-loadbalancer-name: zap-ingress
|
|
service.beta.kubernetes.io/do-loadbalancer-size-unit: "1"
|
|
spec:
|
|
selector:
|
|
app: gateway
|
|
ports:
|
|
- name: zap
|
|
port: 9999
|
|
targetPort: 9999
|
|
protocol: TCP
|
|
type: LoadBalancer
|
|
externalTrafficPolicy: Local
|