mirror of
https://github.com/hanzoai/ingress.git
synced 2026-10-20 15:07:40 +00:00
zeekay
910e0f2936
edgeSecrets ran on every boot, so an edge that orders no certificates still had to reach KMS before it served anything — including routes whose certificates come from a Kubernetes Secret, and plain-HTTP routes. It now returns the identity seal when no resolver orders certificates, and reaches KMS only when there is ACME state to seal. Adoption covers ONE store. It admits the first unsealed document and the same document again — a store is read more than once before the write that seals it lands, and a replica that cannot write reads it every poll — but not a different one. A seal left adopting was taking whatever plaintext it was handed for as long as the process ran. The setting's comment now says what it does: it writes, it covers one store, and it adopts again after a restart, which is why it is removed once it has done its work. One spelling for the KMS credential. The bare IAM_CLIENT_ID fallback undid the reason the names are prefixed — a pod carrying another subsystem's IAM client had it picked up here. k8s/hanzo/deployment.yaml and service.yaml are deleted. They described a hostNetwork DaemonSet named hanzo-ingress binding hostPort 80 and 443, while what runs in that cluster is a Deployment named ingress declared in universe. `kubectl apply -f k8s/hanzo/` appears in this README and in the sibling gateway's Makefile, so the file was one command from taking :80 and :443 on every node beside the workload that already had them. Universe is the one place that says what runs; the cluster-level objects stay here. The OTLP endpoint paths in the docs and the vendored Knative fixture are restored: /v1/metrics is the OpenTelemetry receiver path, not a route of ours.