feat(deploy): reserve an inference proxy hostname in the AWS module - #116
Merged
Merged
Conversation
The inference proxy could only take its Control API client identity as one combined PEM. cert-manager can produce that, but only via additionalOutputFormats, which is off by default before 1.15 and needs a cluster-wide feature gate on both the controller and the webhook. Vault, SPIRE and `kubectl create secret tls` can't produce it at all. Add HARNESS_PROXY_CLIENT_CERT_FILE/_PEM + _KEY_FILE/_PEM alongside the existing identity vars, mirroring the split pair the control-api already takes. The two shapes are mutually exclusive and half a pair is an error, so a half-migrated deployment fails loudly and names the offending variable. reqwest's two-buffer constructor is native-tls-only and we're rustls-only, so the pair is joined in memory and handed to the same Identity::from_pem; the combined path is unchanged. Blank env values now read as unset, which is how a template says "not configured". The fingerprint hashes whichever identity files are configured, so rotating only the key is still picked up within 30s. Chart gets blue.internalTransport.clientSecretFormat (combined|split), default combined. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
CodeQL read `missing_key` as key material being written to a log. It holds an error message; loop over the two half-pair cases instead so the binding is just `error`. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…' into feat/proxy-split-client-identity
Adds blue.internalTransport.certManager so the chart declares the Issuer and Certificate resources itself. cert-manager then generates and renews both certificates, and the chart derives the two things a hand-written manifest gets wrong: the internal Service name in the server SAN, and the Secret names the pods mount. Leave issuerRef empty for a self-signed CA scoped to the release, or point it at an existing CA-type Issuer/ClusterIssuer. ACME issuers do not work — both sides read ca.crt out of their own Secret and ACME does not write it. serverSecret/clientSecret installs render byte-identically; their guard still fails when neither name nor certManager is set. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Adds an optional inference_proxy_subdomain. When set, the name joins the ACM certificate's SANs, gets an alias record, and is output as inference_proxy_hostname. Empty by default, so existing plans are unchanged. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This was referenced Sep 15, 2026
Member
Author
|
@cube /codex the pr we stacked on merged on main so pull and re-target to main |
AlejandroEsquivel
marked this pull request as ready for review
September 16, 2026 00:55
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #115
Stacked on #111.
Adds an optional
inference_proxy_subdomainto the AWS OpenTofu module. When it's set, the name is added to the ACM certificate's SANs, gets an alias record next to the dashboard and API records, and is output asinference_proxy_hostname. A precondition makes sure it doesn't clash with the other two names.It's empty by default, so existing plans don't change. Setting it up front means turning on gateway mode later won't need a new certificate.
🤖 Generated with Claude Code