feat(deploy): reserve an inference proxy hostname in the AWS module

deploy/tofu/aws/README.md

@@ -110,11 +110,13 @@ have no fixed range.
 `include_domain` takes `route53_zone_id` plus two labels, `dashboard_subdomain`
 and `api_subdomain`, relative to that zone (`app` and `api` on `example.com`
 give `app.example.com` and `api.example.com`; an empty label means the apex).
+An optional `inference_proxy_subdomain` adds a third name for gateway mode;
+reserving it up front costs nothing and saves reissuing the certificate later.
 The zone's name is read back, so nothing repeats the domain. The load balancer
 only exists after the chart's Ingress is installed, so the records are a second
 apply: `tofu apply -var alb_hostname=<ingress hostname>`. `certificate_arn`,
-`dashboard_hostname` and `api_hostname` are output for the chart and
-`IngressClassParams`.
+`dashboard_hostname`, `api_hostname` and `inference_proxy_hostname` are output
+for the chart and `IngressClassParams`.
 
 ## Naming and tags
 

deploy/tofu/aws/domain.tf

@@ -15,19 +15,31 @@ data "aws_route53_zone" "blue" {
       condition     = var.dashboard_subdomain != var.api_subdomain
       error_message = "dashboard_subdomain and api_subdomain must differ; both cannot be the same name."
     }
+    precondition {
+      condition     = var.inference_proxy_subdomain == "" || (var.inference_proxy_subdomain != var.dashboard_subdomain && var.inference_proxy_subdomain != var.api_subdomain)
+      error_message = "inference_proxy_subdomain must differ from dashboard_subdomain and api_subdomain."
+    }
   }
 }
 
 locals {
   zone_name          = var.include_domain ? trimsuffix(data.aws_route53_zone.blue[0].name, ".") : ""
   dashboard_hostname = var.include_domain ? (var.dashboard_subdomain == "" ? local.zone_name : "${var.dashboard_subdomain}.${local.zone_name}") : null
   api_hostname       = var.include_domain ? (var.api_subdomain == "" ? local.zone_name : "${var.api_subdomain}.${local.zone_name}") : null
+  # Optional third name for gateway mode. Reserving it costs nothing, so a
+  # deployment can add the inference proxy later without reissuing the certificate.
+  inference_proxy_hostname = var.include_domain && var.inference_proxy_subdomain != "" ? "${var.inference_proxy_subdomain}.${local.zone_name}" : null
+  # Every hostname the load balancer answers for, keyed for the alias records.
+  hostnames = merge(
+    var.include_domain ? { dashboard = local.dashboard_hostname, api = local.api_hostname } : {},
+    local.inference_proxy_hostname != null ? { inference_proxy = local.inference_proxy_hostname } : {},
+  )
 }
 
 resource "aws_acm_certificate" "blue" {
   count                     = var.include_domain ? 1 : 0
   domain_name               = local.dashboard_hostname
-  subject_alternative_names = [local.api_hostname]
+  subject_alternative_names = compact([local.api_hostname, local.inference_proxy_hostname])
   validation_method         = "DNS"
 
   lifecycle { create_before_destroy = true }
@@ -65,10 +77,7 @@ data "aws_elb_hosted_zone_id" "alb" {
 
 resource "aws_route53_record" "blue" {
   #checkov:skip=CKV2_AWS_23:the alias target is var.alb_hostname, an ALB created outside this module by the AWS Load Balancer Controller; checkov renders the variable to its "" default and so misses the check's own var. escape hatch
-  for_each = var.include_domain && var.alb_hostname != "" ? {
-    dashboard = local.dashboard_hostname
-    api       = local.api_hostname
-  } : {}
+  for_each = var.alb_hostname != "" ? local.hostnames : {}
 
   zone_id = var.route53_zone_id
   name    = each.value

deploy/tofu/aws/outputs.tf

@@ -11,6 +11,7 @@ output "kms_key_arn" { value = aws_kms_key.blue.arn }
 output "certificate_arn" { value = var.include_domain ? aws_acm_certificate_validation.blue[0].certificate_arn : null }
 output "dashboard_hostname" { value = local.dashboard_hostname }
 output "api_hostname" { value = local.api_hostname }
+output "inference_proxy_hostname" { value = local.inference_proxy_hostname }
 output "cluster_name" { value = local.cluster_name }
 output "cluster_endpoint" { value = local.create_cluster ? aws_eks_cluster.blue[0].endpoint : null }
 output "vpc_id" { value = local.vpc_id }

deploy/tofu/aws/terraform.tfvars.example

@@ -39,6 +39,7 @@ environment                        = "production"
 # route53_zone_id     = "Z0123456789EXAMPLE"
 # dashboard_subdomain = "app"
 # api_subdomain       = "api"
+# inference_proxy_subdomain = "iproxy"   # optional; gateway mode's third name
 
 kubernetes_namespace               = "blue"
 kubernetes_service_account         = "blue"

deploy/tofu/aws/variables.tf

@@ -58,6 +58,11 @@ variable "api_subdomain" {
   default     = "api"
   description = "Control API label relative to the zone. Empty means the zone apex; it must differ from dashboard_subdomain."
 }
+variable "inference_proxy_subdomain" {
+  type        = string
+  default     = ""
+  description = "Inference proxy label relative to the zone, used in gateway mode. Empty means no proxy hostname: it is left off the certificate and gets no record."
+}
 variable "alb_hostname" {
   type        = string
   default     = ""