mirror of
https://github.com/hanzoai/gateway.git
synced 2026-11-02 23:52:23 +00:00
zeekay
9144a52457
Pin the image tag so rollouts are deterministic. Bumps off the floating :latest tag — CI tags every release with semver and we should reference that, not the moving floor.
101 lines
3.0 KiB
YAML
101 lines
3.0 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: gateway
|
|
namespace: hanzo
|
|
labels:
|
|
app: gateway
|
|
app.kubernetes.io/name: gateway
|
|
app.kubernetes.io/part-of: hanzo-platform
|
|
spec:
|
|
replicas: 2
|
|
selector:
|
|
matchLabels:
|
|
app: gateway
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: gateway
|
|
spec:
|
|
enableServiceLinks: false
|
|
imagePullSecrets:
|
|
- name: registry-credentials
|
|
containers:
|
|
- name: gateway
|
|
image: ghcr.io/hanzoai/gateway:v2.14.0
|
|
imagePullPolicy: Always
|
|
command: ["/usr/bin/gateway"]
|
|
args: ["run", "-c", "/etc/gateway/gateway.json"]
|
|
env:
|
|
- name: GATEWAY_PORT
|
|
value: "8080"
|
|
# -- Unified Auth Middleware --
|
|
- name: AUTH_JWKS_URL
|
|
value: "https://hanzo.id/.well-known/jwks"
|
|
- name: AUTH_ISSUER
|
|
value: "https://hanzo.id"
|
|
- name: AUTH_PUBLIC_PATHS
|
|
value: "/healthz,/__stats,/.well-known/,/favicon"
|
|
- name: AUTH_PUBLIC_HOSTS
|
|
value: "hanzo.id,lux.id,pars.id,id.bootno.de,id.zoo.network,iam.hanzo.ai"
|
|
# Set to "true" to require auth on all non-public endpoints
|
|
- name: AUTH_REQUIRE
|
|
value: "false"
|
|
# -- ZAP native binary listener (TLS 1.3+PQ) --
|
|
- name: ZAP_LISTENER_ENABLED
|
|
value: "true"
|
|
- name: ZAP_LISTENER_PORT
|
|
value: "9999"
|
|
- name: ZAP_TLS_CERT
|
|
value: "/etc/tls/tls.crt"
|
|
- name: ZAP_TLS_KEY
|
|
value: "/etc/tls/tls.key"
|
|
- name: ZAP_INTERNAL_ADDR
|
|
value: "127.0.0.1:9999"
|
|
# -- Billing enforcement via Commerce API --
|
|
- name: AUTH_BILLING_URL
|
|
value: "http://commerce.hanzo.svc.cluster.local:8001"
|
|
- name: COMMERCE_SERVICE_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: gateway-secrets
|
|
key: COMMERCE_SERVICE_TOKEN
|
|
optional: true
|
|
ports:
|
|
- containerPort: 8080
|
|
name: http
|
|
- containerPort: 9999
|
|
name: zap
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
limits:
|
|
cpu: "1"
|
|
memory: 512Mi
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /healthz
|
|
port: 8080
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 15
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /healthz
|
|
port: 8080
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 5
|
|
volumeMounts:
|
|
- name: config
|
|
mountPath: /etc/gateway
|
|
- name: tls
|
|
mountPath: /etc/tls
|
|
readOnly: true
|
|
volumes:
|
|
- name: config
|
|
configMap:
|
|
name: gateway-config
|
|
- name: tls
|
|
secret:
|
|
secretName: api-hanzo-ai-tls
|