Skip to content

Ingress evaluation

The chart can optionally render an Ingress, disabled by default. Ingress resources depend on a cluster's controller, class, hostname, authentication gateway, and certificate management policy. A default chart Ingress could expose the runtime or conflict with an existing routing layer.

Routing contract

Field Contract
Backend Chart-owned trussium Service
Backend port Service port name http (9000 by default)
Runtime paths / and the runtime's HTTP API paths, including /health/* and /metrics when enabled
Controller Operator-selected IngressClass and controller implementation
Hostnames Operator-owned DNS names and routing policy
TLS Existing Secret or organization-owned certificate automation

The runtime does not require an Ingress for in-cluster use. A ClusterIP Service and port-forward remain the default access paths. External exposure should be introduced only after authentication, rate limiting, request-size limits, timeouts, and observability requirements are defined.

Minimum contract for a future opt-in resource

The chart option is disabled by default and requires explicit:

  • ingressClassName, hostnames, and paths;
  • an existing TLS Secret reference, without rendering certificate material;
  • controller-specific annotations supplied by the operator;
  • whether health and metrics paths are exposed externally.

The option renders networking.k8s.io/v1 only, targets the named http Service port, and include tests for disabled, HTTP, and TLS configurations. It must not install an ingress controller, Certificate or Issuer resources, authentication gateway, DNS record, or public load balancer.

Current recommendation

Enable the chart option only when the approved controller and authentication layer are known. Keep /health/* and /metrics internal unless the platform explicitly needs external access. Teams with more complex routing can continue to use an organization-owned Ingress in their platform repository.