mirror of
https://github.com/hanzoai/tasks.git
synced 2026-10-04 02:04:03 +00:00
zeekay
b10b1d6ca0
- Image pin ghcr.io/hanzoai/tasks:v2.49.0 (semver-only per CI/CD rules). - TASKSD_REQUIRE_IDENTITY=true: trust gateway-supplied identity headers only; gateway strips client-supplied X-* before forwarding. - imagePullPolicy IfNotPresent now that we pin a real tag. - Ingress adds tasks-api.hanzo.ai host on the same Service:80 so legacy external workers keep a stable hostname; native binary speaks ZAP in-cluster on :9999, no external ingress required.
49 lines
1.4 KiB
YAML
49 lines
1.4 KiB
YAML
# Hanzo Tasks ingress — single Service, two hostnames.
|
|
# tasks.hanzo.ai → tasks:80 (UI + REST + /healthz)
|
|
# tasks-api.hanzo.ai → tasks:80 (REST only — same backend, kept for
|
|
# external workers using the legacy
|
|
# gRPC hostname; native binary speaks
|
|
# ZAP on :9999 in-cluster, not over
|
|
# ingress)
|
|
# ZAP wire (port 9999) is reached over the cluster service directly by
|
|
# in-cluster workers; no external ingress needed for binary RPC.
|
|
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: tasks
|
|
namespace: hanzo
|
|
labels:
|
|
app: tasks
|
|
app.kubernetes.io/name: tasks
|
|
app.kubernetes.io/part-of: hanzo-platform
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
spec:
|
|
ingressClassName: ingress
|
|
tls:
|
|
- hosts: [tasks.hanzo.ai, tasks-api.hanzo.ai]
|
|
secretName: tasks-hanzo-ai-tls
|
|
rules:
|
|
- host: tasks.hanzo.ai
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: tasks
|
|
port:
|
|
number: 80
|
|
- host: tasks-api.hanzo.ai
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: tasks
|
|
port:
|
|
number: 80
|