zeekayandHanzo Dev
15d100931d
Most of it was stale, not cosmetic: the docs taught `TRAEFIK_*` env, `traefik.http.*` labels, `traefik.ingress.kubernetes.io/` annotations, `.traefik.yml` plugins and `traefik_*` metrics. This binary answers to `INGRESS_*`, `ingress.http.*`, `ingress.kubernetes.io/`, `.ingress.yml` and `ingress.*` — a reader following the old text configured nothing. Two were worse than stale. Gateway API examples gave `group: traefik.io` for an IngressService backendRef, which kubernetes.go:1265 refuses against hanzo.ai. The contributing guide built with `github.com/traefik/ingress` ldflags against a module that is `github.com/hanzoai/ingress/v3`. script/code-gen.sh globs `hanzo.ai_*.yaml` and matched nothing — the per-CRD dumps had been deleted and never regenerated, so `cat` failed the script under `set -e`. controller-gen v0.19.0 restores all ten; they concatenate byte-for-byte into the committed definition and fixture. CHANGELOG.md is untouched: 6,789 lines of imported release history, where a rewrite would falsify the record rather than rebrand it. `@traefiklabs/faency`, `traefik/whoami`, k3s's `--disable=traefik`, the `traefik.io` CRD group and the MIT attribution stay — upstream's addresses, not our brand. Co-authored-by: Hanzo Dev <[email protected]>
2.1 KiB
title, description
| title | description |
|---|---|
| ZAP-HTTP Backend Transport | Use github.com/zap-proto/http for the ingress→backend hop on selected services. |
ZAP-HTTP Backend Transport
The ingress controller can dial selected backend services using
github.com/zap-proto/http instead
of net/http. External TLS termination is unchanged; only the
in-cluster hop changes wire format.
Enable
Set the INGRESS_ZAP_BACKENDS environment variable on the ingress pod
to a comma-separated list of host:port targets that should use
ZAP-HTTP. Any backend whose host:port is not in the list keeps
using the standard HTTP/HTTPS transport — the change is purely additive.
env:
- name: INGRESS_ZAP_BACKENDS
value: "gateway.hanzo.svc.cluster.local:8080,iam.hanzo.svc.cluster.local:8000"
When INGRESS_ZAP_BACKENDS is unset or empty, the controller behaves
identically to a build without this feature.
IngressRoute example
No CRD field changes. The IngressRoute simply points at the host:port that appears in the allowlist; the controller swaps the transport based on the backend address.
apiVersion: hanzo.ai/v1alpha1
kind: IngressRoute
metadata:
name: gateway
namespace: hanzo
spec:
entryPoints:
- websecure
routes:
- match: Host(`api.hanzo.ai`)
kind: Rule
services:
- name: gateway
port: 8080
tls:
secretName: hanzo-ai-tls
If the resolved upstream for the gateway service is
gateway.hanzo.svc.cluster.local:8080 and that address is in
INGRESS_ZAP_BACKENDS, the ingress will dial it via ZAP-HTTP.
Notes
- The wire format is
github.com/zap-proto/httpv0.1: length-prefixed Cap'n Proto frames over TCP. v0.2 will add the X-Wing PQ KEM handshake. - The backend service must speak ZAP-HTTP (use
zaphttp.ListenAndServeorzaphttp.Server). A regularnet/httpserver will not negotiate. - HTTP/2, HTTP/3, and WebSocket are not supported on ZAP-routed backends; v0.2 of zap-http will add streaming and pooling.
- The lookup is by
host:portof the resolved upstream (the value ofreq.URL.Hostat transport time), not by the public-facing domain.