Repository navigation
feat(terraform): deploy optional AI Gateway across clouds - #7412
Merged
Merged
Conversation
Implement #7400 with a common off-by-default interface, HTTPS routing and existing database/encryption secret references. Keep den-gateway and managed installer defaults separate. Reuse the Helm deployment through first-class wrapper inputs, and normalize only the unused Cloud SQL socket hostname in serving-process memory. Add mocked native plan coverage, default/unchanged/disable and conflict checks, plus a credential-free test of the exact Cloud SQL entrypoint against the production parsers. No live apply or provisioning is part of this change. Signed-off-by: Benjamin Shafii <benjamin.shafii@gmail.com>
Use explicit AI Gateway backend resources and whole-resource overrides, avoiding OpenTofu-incompatible indexed override targets and cross-run assertion references. Retain the Helm wrapper's existing Terraform 1.5 floor by checking cross-input conflicts on release preconditions, including operator-managed ingress paths. Signed-off-by: Benjamin Shafii <benjamin.shafii@gmail.com>
Attach a separate hostname-stable managed AI certificate on Cloud Run instead of mutating the immutable domain set of an existing Den certificate. Preserve supplied certificate ownership and add mocked upgrade/routing assertions for both certificate modes. Signed-off-by: Benjamin Shafii <benjamin.shafii@gmail.com>
Do not attach Den's Key Vault or unrelated user-assigned identities to the new AI Gateway. Hash its actual registry-only identity configuration for write-only secret updates, preserving the existing API/web identity paths and rotation counters. Add an offline identity-isolation plan assertion. Signed-off-by: Benjamin Shafii <benjamin.shafii@gmail.com>
Document common optional inputs, precise cloud networking/certificate prerequisites, stable secret ownership, naming and unchanged managed installer defaults for #7400. Record both CLI suites, observed plan values and explicit live NotRun gates without presenting mock plans as cloud qualification. Signed-off-by: Benjamin Shafii <benjamin.shafii@gmail.com>
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub. 4 Skipped Deployments
|
Contributor
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Automations to automatically generate PRs for you. |
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What is this about?
Implement #7400: optional AI Gateway deployment for AWS ECS, Google Cloud Run and Azure Container Apps, plus first-class Helm wrapper inputs.
What problem does it solve?
Setting Gateway environment variables alone could expose administration pages without deploying an inference service or a desktop-reachable endpoint.
What was the situation before?
Helm already deployed the AI Gateway. Native Terraform modules did not; AWS's existing den-gateway was the separate OpenWork Web proxy.
How is this implemented?
ai_gateway_enabled, hostname, digest-pinned image and HTTPS URL output; native service, routing and shared environment wiring.What else changed?
Release note
Terraform operators can opt into an AI Gateway service with a dedicated HTTPS hostname while keeping existing secrets.
Evidence
infra/terraform/modules/*/tests/ai_gateway.tftest.hcl: default 0 services → enabled 1 → disabled 0; routing, secret preservation, unchanged plans and conflicts. No UI changes or desktop specs. Cloud providers are mocked; live cloud/managed-install conformance is NotRun. Details:infra/terraform/AI_GATEWAY_VERIFICATION.md.