hip-0411

HIP-411: Ingress CRD. Status Active. Hanzo's own standard — read this before implementing against it.

HIP-0411: Ingress CRD

Abstract

The Ingress CRD describes a set of domains + routes that map to in-cluster Services and emits one or more native Kubernetes Ingress resources with cert-manager-issued TLS certs. It also optionally provisions a DaemonSet of hanzoai/ingress Pods (Cloudflare-tunneled ingress) for edge termination outside the cluster.

Specification

Group + version

hanzo.ai/v1, plural ingresses, shortname hing.

Spec fields

| Field | Type | Description | |---|---|---| | domains | []DomainConfig | { domain, routes[], tls } | | routes | []IngressRoute | path, pathType, serviceName, servicePort | | ingressClassName | string | which IngressClass to bind to | | clusterIssuer | string | cert-manager ClusterIssuer name | | ingressDaemonSet | IngressDaemonSetSpec | optional hanzoai/ingress daemon |

Example CR

apiVersion: hanzo.ai/v1
kind: Ingress
metadata:
  name: hanzo-ingress
  namespace: hanzo
spec:
  ingressClassName: nginx
  clusterIssuer: letsencrypt-prod
  domains:
    - domain: chat.hanzo.ai
      tls: true
      routes:
        - path: /
          pathType: Prefix
          serviceName: chat
          servicePort: 80
    - domain: api.hanzo.ai
      tls: true
      routes:
        - path: /
          pathType: Prefix
          serviceName: gateway
          servicePort: 80

Generated K8s resources

• One native networking.k8s.io/v1 Ingress per domain
• Certificate (cert-manager) per TLS-enabled domain
• Optional DaemonSet for hanzoai/ingress

Operator reconciler

~/work/hanzo/operator/src/controllers/ingress.rs.

Related services

• HIP-0068 (Ingress standard)

Status

Implemented in hanzoai/operator v0.3.0+. Used for multi-tenant TLS termination on the cluster's nginx-ingress.