Hanzo Ingress
The entry point of a Kubernetes cluster
It terminates TLS, matches the hostname, and forwards to the service behind it. It reads the Ingress resources you already write, so there is nothing new to declare and nothing to inject beside your pods.
Paste and ship
Paste this into any agent. It reads the skill manifest and calls Ingress from there.
What happens at the edge
One static binary in front of every hostname the cluster answers for.
It reads what you already wrote
Standard networking.k8s.io/v1 Ingress is the primary source, alongside IngressRoute for the things a plain Ingress can't say, Gateway API, and TOML or YAML from disk. It registers as the cluster's default IngressClass, so an Ingress that names none is still picked up.
Certificates it fetches itself
Let's Encrypt provisioning and renewal, wildcards included. A new hostname gets a certificate without anyone filing a ticket for one.
Middleware you compose by annotation
Rate limiting, retry with exponential backoff, circuit breaking, compression, header rewriting, IP allowlists, redirects, prefix stripping. Name one in an annotation, or chain several into a named pipeline and name that.
Routes change without a restart
Edit an Ingress and the routing table follows — no reload, no dropped connection. A backend that stops answering health checks is taken out of rotation and put back when it recovers.
It can serve the files itself
The static middleware serves a site export straight from disk or from object storage — pricing.html, docs/index.html, hashed asset chunks, a 404 page. A SPA or a docs bundle needs no pod of its own.
One binary, on the port
No runtime dependencies. It runs in host-network mode and binds 80 and 443 directly, with every Linux capability dropped except the one that lets it.