From 30f12de45b793a44abb2bb8f0e090bbb70f182ee Mon Sep 17 00:00:00 2001
From: sam <sam@samdeMacBook-Air.local>
Date: Sat, 3 Oct 2026 14:41:36 +0800
Subject: [PATCH] Configure Core HTTPS routing on TKE

---
 deploy/kubernetes/README.md             | 12 +++++++
 deploy/kubernetes/prod/core.yaml.tpl    |  2 +-
 deploy/kubernetes/prod/ingress.yaml.tpl | 47 +++++++++++++++++++++++++
 deploy/kubernetes/prod/web.yaml.tpl     |  2 +-
 4 files changed, 61 insertions(+), 2 deletions(-)
 create mode 100644 deploy/kubernetes/prod/ingress.yaml.tpl

diff --git a/deploy/kubernetes/README.md b/deploy/kubernetes/README.md
index e75a929e7..419e0f877 100644
--- a/deploy/kubernetes/README.md
+++ b/deploy/kubernetes/README.md
@@ -85,3 +85,15 @@ Keep the existing claim's class and size. This cluster's `cbs` StorageClass does
 - **No domain setup in Web.** There is no installer socket, so the public origin comes from `OAC_PUBLIC_URL` and your external ingress, not from the console.
 - **No `oac` command.** The maintenance commands ship in the Core image: `kubectl exec deploy/oac-core -- oac-core-device …`. [Operations](../../docs/getting-started/operations.md) covers keys and backup.
 - **A rollout signs operators out** of the console, because Web holds its sessions in memory.
+
+## Public routing on TKE
+
+The Services use NodePort for the existing qcloud CLB controller. Keep DNS, certificates and ingress separate from the image rollout workflow. `prod/ingress.yaml.tpl` adds one host to an existing CLB and routes `/v1` and `/api/v1` to Core and other paths to Web. It preserves the original request paths.
+
+Prepare an Opaque Secret in the deployment namespace with `qcloud_cert_id` referencing a Tencent Cloud certificate covering the hostname. Set `OAC_CLB_ID`, `OAC_PUBLIC_HOST` and `OAC_TLS_SECRET`, then apply the template:
+
+```sh
+envsubst '$OAC_CLB_ID $OAC_PUBLIC_HOST $OAC_TLS_SECRET' < deploy/kubernetes/prod/ingress.yaml.tpl | kubectl --context sandbase-prod -n openagentcore apply -f -
+```
+
+For this installation, the host is `agentcore.sandbase.ai`, the shared CLB is `lb-9cr62q4u` and the certificate reference Secret is `oac-tls-cert`. After the controller reports Ready, verify HTTPS `/healthz`, the Web home page, unauthenticated `/v1/agents` returning 401 and a Runtime WebSocket upgrade on `/api/v1/agent-daemon/ws`.
diff --git a/deploy/kubernetes/prod/core.yaml.tpl b/deploy/kubernetes/prod/core.yaml.tpl
index 5b766fce8..d846823a4 100644
--- a/deploy/kubernetes/prod/core.yaml.tpl
+++ b/deploy/kubernetes/prod/core.yaml.tpl
@@ -187,7 +187,7 @@ metadata:
     app.kubernetes.io/name: oac-core
     app.kubernetes.io/part-of: openagentcore
 spec:
-  type: ClusterIP
+  type: NodePort
   selector:
     app: oac-core
   ports:
diff --git a/deploy/kubernetes/prod/ingress.yaml.tpl b/deploy/kubernetes/prod/ingress.yaml.tpl
new file mode 100644
index 000000000..389d1b186
--- /dev/null
+++ b/deploy/kubernetes/prod/ingress.yaml.tpl
@@ -0,0 +1,47 @@
+# Applied separately after DNS and the qcloud certificate reference are ready.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: oac
+  labels:
+    app.kubernetes.io/part-of: openagentcore
+  annotations:
+    kubernetes.io/ingress.class: qcloud
+    kubernetes.io/ingress.existLbId: "${OAC_CLB_ID}"
+    ingress.cloud.tencent.com/enable-group: "true"
+    ingress.cloud.tencent.com/auto-rewrite: "true"
+    ingress.cloud.tencent.com/rewrite-support: "true"
+    kubernetes.io/ingress.rule-mix: "true"
+    kubernetes.io/ingress.extensiveParameters: '{"ConnectTimeout":300000,"SendTimeout":900000,"ReadTimeout":900000}'
+    kubernetes.io/ingress.http-rules: "null"
+    kubernetes.io/ingress.https-rules: |
+      [{"host":"${OAC_PUBLIC_HOST}","path":"/v1","backend":{"serviceName":"oac-core","servicePort":"8091"}},
+       {"host":"${OAC_PUBLIC_HOST}","path":"/api/v1","backend":{"serviceName":"oac-core","servicePort":"8091"}},
+       {"host":"${OAC_PUBLIC_HOST}","path":"/","backend":{"serviceName":"oac-web","servicePort":"8080"}}]
+spec:
+  ingressClassName: qcloud
+  tls:
+    - hosts: ["${OAC_PUBLIC_HOST}"]
+      secretName: "${OAC_TLS_SECRET}"
+  rules:
+    - host: "${OAC_PUBLIC_HOST}"
+      http:
+        paths:
+          - path: /v1
+            pathType: Prefix
+            backend:
+              service:
+                name: oac-core
+                port: {number: 8091}
+          - path: /api/v1
+            pathType: Prefix
+            backend:
+              service:
+                name: oac-core
+                port: {number: 8091}
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: oac-web
+                port: {number: 8080}
diff --git a/deploy/kubernetes/prod/web.yaml.tpl b/deploy/kubernetes/prod/web.yaml.tpl
index 286110eb6..df3015e36 100644
--- a/deploy/kubernetes/prod/web.yaml.tpl
+++ b/deploy/kubernetes/prod/web.yaml.tpl
@@ -155,7 +155,7 @@ metadata:
     app.kubernetes.io/name: oac-web
     app.kubernetes.io/part-of: openagentcore
 spec:
-  type: ClusterIP
+  type: NodePort
   selector:
     app: oac-web
   ports: