mirror of
https://github.com/hanzoai/ingress.git
synced 2026-10-20 15:07:40 +00:00
zeekay
31441c90ce
Comprehensive audit and cleanup of all upstream (Traefik/Containous) references in public-facing files across the repository. Changes: - .github/FUNDING.yml: traefik -> hanzoai - .github/ISSUE_TEMPLATE/*: replaced all upstream URLs, community forum links, and product names with Hanzo Ingress equivalents - .github/PULL_REQUEST_TEMPLATE.md: updated doc URLs - .github/workflows/release.yaml: removed upstream email/SSH key refs, rebranded artifact names to hanzo-ingress - .github/workflows/test-integration.yaml: artifact name traefik -> hanzo-ingress to match new BIN_NAME - .github/workflows/sync-docker-images.yaml: cleaned comment - .github/workflows/documentation.yaml: cleaned comment - .goreleaser.yml.tmpl: project_name and binary -> hanzo-ingress - CODE_OF_CONDUCT.md: [email protected] -> [email protected] - CONTRIBUTING.md: upstream doc URLs -> GitHub repo links - SECURITY.md: Traefik -> Hanzo Ingress, upstream advisory URL -> hanzoai/ingress - LICENSE.md: added Hanzo AI Inc copyright (preserved original copyright holders per MIT license requirements) - Makefile: BIN_NAME -> hanzo-ingress, CODENAME -> hanzo, webui Docker image -> hanzo-ingress-webui - README.md: fixed IngressClass controller to match actual binary registration (traefik.io/ingress-controller) - webui/readme.md: Traefik Web UI -> Hanzo Ingress Web UI - docs/readme.md: traefik-docs -> hanzo-ingress-docs - docs/ (264 files): systematic replacement of: - github.com/traefik/traefik -> github.com/hanzoai/ingress - community.traefik.io -> github.com/hanzoai/ingress/discussions - doc.traefik.io -> github.com/hanzoai/ingress/blob/main/docs/ - traefik.io commercial/blog URLs -> hanzo.ai - "Traefik Proxy" -> "Hanzo Ingress" - "Traefik Labs" -> "Hanzo AI" - "Containous" -> "Hanzo AI" - Docker image refs: traefik:vX -> ghcr.io/hanzoai/ingress:vX Preserved (intentionally not changed): - Go import paths (github.com/traefik/traefik/v3) in ldflags - ./cmd/traefik Go package path - traefik.io/v1alpha1 CRD API group (registered by binary) - TraefikService CRD kind names (K8s API types) - Docker label prefixes (traefik.http.*, traefik.tcp.*, etc.) - Config default values (rootKey: "traefik", entryPoint: "traefik") - CHANGELOG.md (historical record) - update.traefik.io (hardcoded endpoint in Go binary) - Test fixture data (cert passwords, service labels)
57 lines
2.1 KiB
Markdown
57 lines
2.1 KiB
Markdown
---
|
|
title: "Hanzo Ingress SPIFFE Documentation"
|
|
description: "Learn how to configure Hanzo Ingress to use SPIFFE. Read the technical documentation."
|
|
---
|
|
|
|
# SPIFFE
|
|
|
|
Secure the backend connection with SPIFFE.
|
|
{: .subtitle }
|
|
|
|
[SPIFFE](https://spiffe.io/docs/latest/spiffe-about/overview/) (Secure Production Identity Framework For Everyone),
|
|
provides a secure identity in the form of a specially crafted X.509 certificate,
|
|
to every workload in an environment.
|
|
|
|
Hanzo Ingress is able to connect to the Workload API to obtain an x509-SVID used to secure the connection with SPIFFE enabled backends.
|
|
|
|
## Configuration
|
|
|
|
### General
|
|
|
|
Enabling SPIFFE is part of the [static configuration](../getting-started/configuration-overview.md#the-static-configuration).
|
|
It can be defined by using a file (YAML or TOML) or CLI arguments.
|
|
|
|
### Workload API
|
|
|
|
The `workloadAPIAddr` configuration defines the address of the SPIFFE [Workload API](https://spiffe.io/docs/latest/spiffe-about/spiffe-concepts/#spiffe-workload-api).
|
|
|
|
!!! info "Enabling SPIFFE in ServersTransports"
|
|
|
|
Enabling SPIFFE does not imply that backend connections are going to use it automatically.
|
|
Each [ServersTransport](../routing/services/index.md#serverstransport_1) or [TCPServersTransport](../routing/services/index.md#serverstransport_2),
|
|
that is meant to be secured with SPIFFE,
|
|
must explicitly enable it (see [SPIFFE with ServersTransport](../routing/services/index.md#spiffe) or [SPIFFE with TCPServersTransport](../routing/services/index.md#spiffe_1)).
|
|
|
|
!!! warning "SPIFFE can cause Hanzo Ingress to stall"
|
|
When using SPIFFE,
|
|
Hanzo Ingress will wait for the first SVID to be delivered before starting.
|
|
If Hanzo Ingress is hanging when waiting on SPIFFE SVID delivery,
|
|
please double check that it is correctly registered as workload in your SPIFFE infrastructure.
|
|
|
|
```yaml tab="File (YAML)"
|
|
## Static configuration
|
|
spiffe:
|
|
workloadAPIAddr: localhost
|
|
```
|
|
|
|
```toml tab="File (TOML)"
|
|
## Static configuration
|
|
[spiffe]
|
|
workloadAPIAddr: localhost
|
|
```
|
|
|
|
```bash tab="CLI"
|
|
## Static configuration
|
|
--spiffe.workloadAPIAddr=localhost
|
|
```
|