94106bf252
Introduce worker.bstein.dev as the canonical hostname for the owner-only Hermes coordinator, previously agent.hermes.bstein.dev. The rename is additive, matching the shape #38 restored for chat and triage. CoreDNS, both agent Ingresses and the hermes-sites certificate now serve BOTH names, so merging this cannot take away the endpoint the operator uses to reach the coordinator. Retiring agent.hermes.bstein.dev is a separate, separately scheduled change. No redirect middleware is added. What switches to the new host: - HERMES_DASHBOARD_PUBLIC_URL and the oauth2-proxy --redirect-url - the Keycloak agent proxy rootUrl - operator docs, skills, the ZAP baseline target and the triage monitor default What stays dual-homed until retirement: - CoreDNS hosts entry, both agent Ingress rules, certificate SANs - API_SERVER_CORS_ORIGINS (now a comma-separated pair) - the Keycloak redirect URIs, web origins and post-logout origins, so a rollback only needs the oauth2-proxy --redirect-url reverted and does not require re-running the ensure job The agent client passes its legacy origin through the optional fourth argument #38 added to ensure_proxy_client, so no second mechanism is introduced. The immutable ensure Job goes -11 -> -12 because #38 already consumed -11 and that run has completed; without a further bump this change would never be applied. Login on the new host fails until the -12 Job completes. Because the session and CSRF cookies use the __Host- prefix they are bound to one origin, so a fresh login must start on worker.bstein.dev and existing sessions do not carry over -- re-login is required after rollout. #38's public-host continuity test now covers the agent proxy's dual origins rather than asserting the agent surface was untouched by the rename. Knowledge catalogs and diagrams regenerated with `make knowledge`.
167 lines
4.6 KiB
YAML
167 lines
4.6 KiB
YAML
# services/hermes/agent-ingress.yaml
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: hermes-agent-terminal-slash
|
|
namespace: hermes
|
|
spec:
|
|
redirectRegex:
|
|
# Host-preserving so the trailing-slash fixup works on both the canonical
|
|
# worker.bstein.dev and the legacy agent.hermes.bstein.dev host.
|
|
regex: ^https://(worker\.bstein\.dev|agent\.hermes\.bstein\.dev)/terminal$
|
|
replacement: https://${1}/terminal/
|
|
permanent: false
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: hermes-agent-stock-dashboard-headers
|
|
namespace: hermes
|
|
spec:
|
|
headers:
|
|
customRequestHeaders:
|
|
Origin: http://127.0.0.1:9119
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: hermes-agent-dashboard
|
|
namespace: hermes
|
|
annotations:
|
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
|
traefik.ingress.kubernetes.io/router.middlewares: hermes-hermes-agent-stock-dashboard-headers@kubernetescrd
|
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
|
spec:
|
|
ingressClassName: traefik
|
|
tls:
|
|
- hosts:
|
|
- worker.bstein.dev
|
|
- agent.hermes.bstein.dev
|
|
secretName: hermes-sites-tls
|
|
rules:
|
|
- host: worker.bstein.dev
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: oauth2-proxy-hermes-agent
|
|
port:
|
|
name: http
|
|
# Legacy host, served unchanged until it is retired in a separate change.
|
|
- host: agent.hermes.bstein.dev
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: oauth2-proxy-hermes-agent
|
|
port:
|
|
name: http
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: hermes-agent-terminal
|
|
namespace: hermes
|
|
annotations:
|
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
|
traefik.ingress.kubernetes.io/router.middlewares: hermes-hermes-agent-terminal-slash@kubernetescrd
|
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
|
spec:
|
|
ingressClassName: traefik
|
|
tls:
|
|
- hosts:
|
|
- worker.bstein.dev
|
|
- agent.hermes.bstein.dev
|
|
secretName: hermes-sites-tls
|
|
rules:
|
|
- host: worker.bstein.dev
|
|
http:
|
|
paths:
|
|
- path: /terminal
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: oauth2-proxy-hermes-agent
|
|
port:
|
|
name: http
|
|
# Legacy host, served unchanged until it is retired in a separate change.
|
|
- host: agent.hermes.bstein.dev
|
|
http:
|
|
paths:
|
|
- path: /terminal
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: oauth2-proxy-hermes-agent
|
|
port:
|
|
name: http
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: hermes-sites
|
|
namespace: hermes
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt
|
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
|
spec:
|
|
ingressClassName: traefik
|
|
tls:
|
|
- hosts:
|
|
- agent.hermes.bstein.dev
|
|
- chat.bstein.dev
|
|
- triage.bstein.dev
|
|
- worker.bstein.dev
|
|
- chat.hermes.bstein.dev
|
|
- triage.hermes.bstein.dev
|
|
secretName: hermes-sites-tls
|
|
rules:
|
|
- host: chat.bstein.dev
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: oauth2-proxy-hermes-chat
|
|
port:
|
|
name: http
|
|
- host: triage.bstein.dev
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: oauth2-proxy-hermes-triage
|
|
port:
|
|
name: http
|
|
# Legacy hosts serve the same backends so the rename is additive. They are
|
|
# kept until an explicit retirement change, not redirected: oauth2-proxy
|
|
# cookies are host-bound, so a redirect would silently drop the session.
|
|
- host: chat.hermes.bstein.dev
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: oauth2-proxy-hermes-chat
|
|
port:
|
|
name: http
|
|
- host: triage.hermes.bstein.dev
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: oauth2-proxy-hermes-triage
|
|
port:
|
|
name: http
|