mirror of
https://github.com/hanzoai/gateway.git
synced 2026-11-02 23:52:23 +00:00
zeekay
387fe26bcc
Extract edge IAM validation — JWKS cache, JWT validation, token extraction (Bearer + HTTP Basic password for go/.netrc + cookie), and the identity-header trust boundary — into package iamauth, the single implementation shared by the gin/KrakenD gateway middleware and the lightweight cmd/ingress host router. The gateway middleware delegates via auth_compat.go; behavior unchanged, security tests intact. cmd/ingress gains optional per-host "auth": true — validates a Hanzo IAM token, strips client identity headers, injects X-User-*, and drops the credential before proxying. Wire goproxy.hanzo.ai (Athens module proxy) as the first IAM-gated host; declare AUTH_* on the hanzo-ingress Deployment. iamauth has unit tests (extraction precedence, strip⊇mint contract, identity injection). go.sum gains the pinned go-jose/v4 v4.0.5 hash (completion, no bump).
66 lines
1.8 KiB
YAML
66 lines
1.8 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: hanzo-ingress
|
|
namespace: hanzo
|
|
labels:
|
|
app: hanzo-ingress
|
|
app.kubernetes.io/name: hanzo-ingress
|
|
app.kubernetes.io/part-of: hanzo-platform
|
|
spec:
|
|
replicas: 2
|
|
selector:
|
|
matchLabels:
|
|
app: hanzo-ingress
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: hanzo-ingress
|
|
spec:
|
|
containers:
|
|
- name: ingress
|
|
image: ghcr.io/hanzoai/gateway:2.14.1
|
|
command: ["/usr/bin/ingress"]
|
|
args: ["-c", "/etc/ingress/ingress.json"]
|
|
env:
|
|
# IAM authority for hosts marked "auth": true in ingress.json
|
|
# (e.g. goproxy.hanzo.ai). Same JWKS / issuer / audience as the
|
|
# gateway so both trust one IAM. The in-code defaults already
|
|
# match these; set explicitly for operator clarity.
|
|
- name: AUTH_JWKS_URL
|
|
value: "https://hanzo.id/.well-known/jwks"
|
|
- name: AUTH_ISSUER
|
|
value: "https://hanzo.id"
|
|
- name: AUTH_AUDIENCE
|
|
value: "https://api.hanzo.ai"
|
|
ports:
|
|
- name: http
|
|
containerPort: 8080
|
|
protocol: TCP
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 64Mi
|
|
limits:
|
|
cpu: "2"
|
|
memory: 256Mi
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /healthz
|
|
port: 8080
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /healthz
|
|
port: 8080
|
|
initialDelaySeconds: 3
|
|
periodSeconds: 5
|
|
volumeMounts:
|
|
- name: config
|
|
mountPath: /etc/ingress
|
|
volumes:
|
|
- name: config
|
|
configMap:
|
|
name: ingress-config
|