router, node, standalone: external HTTP ingress for a2a, mcp, and inference services

.github/k8s/agentmesh-control-plane-template.yaml

@@ -161,6 +161,26 @@ spec:
     kind: Service
     name: agentmesh-control-plane-${ENV_NAME}
 ---
+apiVersion: networking.gke.io/v1
+kind: HealthCheckPolicy
+metadata:
+  name: agentmesh-router-ingress-healthcheck-${ENV_NAME}
+  namespace: ${NAMESPACE}
+spec:
+  default:
+    checkIntervalSec: 15
+    timeoutSec: 5
+    healthyThreshold: 1
+    unhealthyThreshold: 2
+    config:
+      type: HTTP
+      httpHealthCheck:
+        requestPath: /ingress/healthz
+  targetRef:
+    group: ""
+    kind: Service
+    name: agentmesh-router-ingress-${ENV_NAME}
+---
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
@@ -274,3 +294,13 @@ spec:
     backendRefs:
     - name: agentmesh-console-${ENV_NAME}
       port: 8081
+  - matches:
+    - path:
+        type: Exact
+        value: /ingress
+    - path:
+        type: PathPrefix
+        value: /ingress/
+    backendRefs:
+    - name: agentmesh-router-ingress-${ENV_NAME}
+      port: 8080

.github/k8s/agentmesh-router-template.yaml

@@ -23,6 +23,20 @@ spec:
   selector:
     app: agentmesh-router-${ENV_NAME}
 ---
+apiVersion: v1
+kind: Service
+metadata:
+  name: agentmesh-router-ingress-${ENV_NAME}
+  namespace: ${NAMESPACE}
+spec:
+  ports:
+    - port: 8080
+      targetPort: 8080
+      protocol: TCP
+      name: http-ingress
+  selector:
+    app: agentmesh-router-${ENV_NAME}
+---
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
@@ -66,6 +80,10 @@ spec:
         - containerPort: 9090
           protocol: TCP
           name: metrics
+        # External HTTP ingress reached via the Gateway HTTPRoute (/ingress/*).
+        - containerPort: 8080
+          protocol: TCP
+          name: http-ingress
         args:
         - "--control-plane=http://agentmesh-control-plane-${ENV_NAME}.${NAMESPACE}.svc.cluster.local:8080"
         - "--insecure-control-plane"
@@ -75,6 +93,10 @@ spec:
         - "--jwt-path=/var/run/secrets/tokens/agentmesh-token"
         - "--keys-path=/data/router.key"
         - "--metrics-addr=0.0.0.0:9090"
+        - "--ingress-addr=0.0.0.0:8080"
+        - "--ingress-url=https://${ENV_NAME}.sam-mesh.dev/ingress"
+        - "--public-control-plane=https://${ENV_NAME}.sam-mesh.dev"
+        - "--allow-insecure-ingress-http"
         # Profiles on loopback only: `kubectl port-forward <pod> 6060` then
         # `go tool pprof http://127.0.0.1:6060/debug/pprof/heap`.
         - "--pprof-addr=127.0.0.1:6060"

.github/workflows/deploy.yaml

@@ -440,10 +440,10 @@ jobs:
             -H "Authorization: Bearer ${ADMIN_TOKEN}" \
             -d '{
               "roles": [
-                {"name": "agentmesh-canary", "allowed_services": ["*"], "allowed_publish": ["*"], "allowed_targets": ["*"]},
+                {"name": "agentmesh-canary", "allowed_services": ["*"], "allowed_publish": ["*"], "allowed_targets": ["*"], "allowed_ingress": [{"services": ["*"]}]},
                 {"name": "mesh:role:router", "allowed_services": ["*"], "allowed_targets": ["*"]},
                 {"name": "mesh:role:node"},
-                {"name": "public-mesh", "allowed_services": ["*"], "allowed_publish": ["*"], "allowed_targets": ["*"]}
+                {"name": "public-mesh", "allowed_services": ["*"], "allowed_publish": ["*"], "allowed_targets": ["*"], "allowed_ingress": [{"services": ["*"]}]}
               ],
               "bindings": [
                 {"role": "agentmesh-canary", "members": ["user:system:serviceaccount:agentmesh-canary-'"${ENV_NAME}"':agentmesh-node-sa"]},