mirror of
https://github.com/hanzoai/ingress.git
synced 2026-10-26 02:47:15 +00:00
zeekayandHanzo Dev
15d100931d
Hanzo CI/CD / cicd (push) Failing after 9m46s
CI/CD / cicd (push) Failing after 10m4s
Most of it was stale, not cosmetic: the docs taught `TRAEFIK_*` env, `traefik.http.*` labels, `traefik.ingress.kubernetes.io/` annotations, `.traefik.yml` plugins and `traefik_*` metrics. This binary answers to `INGRESS_*`, `ingress.http.*`, `ingress.kubernetes.io/`, `.ingress.yml` and `ingress.*` — a reader following the old text configured nothing. Two were worse than stale. Gateway API examples gave `group: traefik.io` for an IngressService backendRef, which kubernetes.go:1265 refuses against hanzo.ai. The contributing guide built with `github.com/traefik/ingress` ldflags against a module that is `github.com/hanzoai/ingress/v3`. script/code-gen.sh globs `hanzo.ai_*.yaml` and matched nothing — the per-CRD dumps had been deleted and never regenerated, so `cat` failed the script under `set -e`. controller-gen v0.19.0 restores all ten; they concatenate byte-for-byte into the committed definition and fixture. CHANGELOG.md is untouched: 6,789 lines of imported release history, where a rewrite would falsify the record rather than rebrand it. `@traefiklabs/faency`, `traefik/whoami`, k3s's `--disable=traefik`, the `traefik.io` CRD group and the MIT attribution stay — upstream's addresses, not our brand. Co-authored-by: Hanzo Dev <[email protected]>
4.0 KiB
4.0 KiB
ingress — horizontal-scale audit
Branch: feat/edge-scale-cleanup.
Checklist
| Item | Status | Evidence / fix |
|---|---|---|
| No application logic. Routing only. | PASS | mount.go exposes only /_/ingress/healthz + /_/ingress/config (read-only view). The standalone binary (cmd/ingress/) is the upstream proxy — providers, TLS, ACME, no app logic. |
| No JWT validation | PASS | grep -rn "JWT|jwt\." mount.go doc.go returns no auth refs. JWT validation lives in gateway (auth_middleware.go). |
| No identity-header minting | PASS | grep -rn "X-Org-Id|X-User-Id" *.go (top-level) returns empty for the ingress-as-subsystem package. Identity headers are minted by gateway only — confirmed by HIP-0026 + the strip-list contract test in gateway's auth_middleware_security_test.go. |
| No body inspection | PASS | Ingress is L7 reverse-proxy at the TLS-termination boundary. Body is opaque bytes. No content-type-aware middleware in this repo (security-headers, redirect, rate-limit work at headers/URL level only). |
| Connection limits per upstream are sane | PASS | RespondingTimeouts.ReadTimeout=60s, IdleTimeout=180s (pkg/config/static/static_config.go:46-50). Per-route limit configurable via inFlightReq middleware CRD. Cluster pin keeps maxConnsPerHost at fasthttp defaults. The hostNetwork=true deployment caps per-node connections at OS-level (net.core.somaxconn). |
| Health endpoints exposed (no auth) | PASS | /ping on entrypoint:web (deployment.yaml:127). Liveness + readiness probes both hit /ping (deployment.yaml:185-198). /_/ingress/healthz from the cloud-mount is a second probe surface, also unauthenticated by design. |
| Reasonable timeouts | PASS | ReadTimeout=60s, IdleTimeout=180s. Configurable per entrypoint. Per-route forwardingTimeouts defaults to dialTimeout=30s + responseHeaderTimeout=0s (no cap, intentional for streaming). |
| Stateless. Replicas can come and go. No sticky sessions. | PASS | Hanzo ingress runs 4 replicas via Deployment + hostNetwork=true + podAntiAffinity (universe/infra/k8s/ingress/deployment.yaml:53-96). No session affinity. ACME state is on hostPath /var/lib/hanzo-ingress — per-node, not shared, and the k8s K8s resolver discovers certs from cert-manager Secrets, not from disk. ACME storage is the only "state" and it is per-replica regeneration on cold start (Let's Encrypt rate-limits this; we ride DNS-01 with Cloudflare so the rate-limit budget is comfortable). |
| Upstream brand on the config surface | PASS | The parser is our own fork (hanzoai/ingress-parser), so DefaultRootName="ingress" and DefaultNamePrefix="INGRESS_": labels read ingress.http.*, env reads INGRESS_*, annotations read ingress.kubernetes.io/. Metrics are prefixed ingress.*, the internal entry point is ingress, the plugin manifest is .ingress.yml, and the wire-protocol headers are X-Ingress-Fast-Proxy / X-Ingress-Router. What still carries the upstream name is upstream's own address space — the traefik.io CRD group installed beside ours, the traefik/whoami test images, k3s's --disable=traefik flag — none of it ours to rename. |
What changed in this branch
Documentation only. The ingress mount surface was already correctly scoped before this audit: two read-only endpoints, zero application logic, zero JWT, zero identity. No source changes required.
Things deliberately NOT done in this branch
- Universe manifests for ingress (HPA, PDB) — ingress is
hostNetwork: true+ 4-replica Deployment + podAntiAffinity. HPA on hostNetwork pods is incoherent (you cannot scale beyond worker-node count without scheduling collisions). PDB on a 4-pod set where each binds host ports is also incoherent (the loss of one pod equals the loss of one node IP from the Cloudflare-load-balanced RRset, so disruption budgets are a Cloudflare-side concern, not k8s). Leaving the deployment as-is is correct. - Splitting ingress + gateway pods — already separate Deployments in
universe/infra/k8s/ingress/anduniverse/infra/k8s/gateway/. The brief's task #3 is moot.