@telorun/k8s-runner 0.14.0 → 0.15.1

package/src/server.ts

@@ -16,6 +16,7 @@ import { kubernetesRunnerCapabilities } from "./capabilities.js";
 import { loadK8sRunnerConfig, RunnerConfigError, type K8sRunnerConfig } from "./config.js";
 import { createKubernetesBackend } from "./k8s/backend.js";
 import { createKubeClient } from "./k8s/client.js";
+import { createSessionRouter } from "./k8s/routing/index.js";
 import { sweepWorkspaceConfigMaps } from "./k8s/workspace-configmap.js";
 
 const VERSION: string = packageJson.version;
@@ -84,7 +85,22 @@ async function main(): Promise<void> {
 
   const kube = createKubeClient();
   const bundleStore = new BundleStore(config.selfUrl);
-  const backend = createKubernetesBackend({ kube, config, bundleStore });
+
+  // Resolve the routing layer ONCE, here: an unroutable configuration must fail
+  // the runner rather than every session it would otherwise accept, publish
+  // routes for, and leave 404-ing with nothing reported.
+  let routing: Awaited<ReturnType<typeof createSessionRouter>>;
+  try {
+    routing = await createSessionRouter(kube, config);
+  } catch (err) {
+    if (err instanceof RunnerConfigError) {
+      process.stderr.write(`${err.message}\n`);
+      process.exit(2);
+    }
+    throw err;
+  }
+
+  const backend = createKubernetesBackend({ kube, config, bundleStore, router: routing.router });
 
   const catalog = config.baseImageCatalog.enabled
     ? new BaseImageCatalog({
@@ -98,6 +114,27 @@ async function main(): Promise<void> {
 
   const { app, registry } = await buildServer({ backend, config, bundleStore, catalog });
 
+  // Say which layer carries session traffic. An operator reading "logs-only" here
+  // is the difference between a misconfiguration found at boot and one found as a
+  // 404 on a URL the editor handed a user.
+  if (routing.resolved.layer === "none") {
+    app.log.warn({ reason: routing.resolved.reason }, "session routing disabled (logs-only)");
+  } else {
+    app.log.info(
+      {
+        layer: routing.resolved.layer,
+        ...(routing.resolved.layer === "gateway"
+          ? {
+              apiVersion: routing.resolved.apiVersion,
+              gateway: `${config.sessionRouting.gateway?.namespace}/${config.sessionRouting.gateway?.name}`,
+            }
+          : { ingressClass: config.sessionRouting.ingressClassName ?? "(cluster default)" }),
+        baseDomain: config.sessionRouting.baseDomain,
+      },
+      "session routing resolved",
+    );
+  }
+
   // Populate the catalog before serving so the first /v1/capabilities carries the
   // full menu; a fetch failure degrades to the default image (surfaced, not
   // swallowed) and the periodic refresh retries.

package/dist/k8s/ingress.d.ts

@@ -1,15 +0,0 @@
-import type { V1Ingress, V1Service } from "@kubernetes/client-node";
-import type { K8sRunnerConfig } from "../config.js";
-import type { PortMapping, RunnerEndpoint } from "@telorun/runner-core";
-export declare function buildSessionService(config: K8sRunnerConfig, sessionId: string, podName: string, podUid: string, ports: PortMapping[]): V1Service;
-export declare function buildSessionIngress(config: K8sRunnerConfig, sessionId: string, serviceName: string, podName: string, podUid: string, ports: PortMapping[]): {
-    ingress: V1Ingress;
-    hosts: string[];
-};
-/** Endpoints announced on the `running` status. Every tcp port is fronted by its
- *  own per-session Ingress host (`<port>-<sessionId>.<domain>`, served on 443) and
- *  carries an external `url`. udp ports aren't HTTP-routable, so they keep the
- *  host-less form. Without an ingress base domain, host is left blank for the
- *  client adapter to fill (parity with docker). */
-export declare function endpointsFor(config: K8sRunnerConfig, sessionId: string, ports: PortMapping[]): RunnerEndpoint[];
-//# sourceMappingURL=ingress.d.ts.map

package/dist/k8s/ingress.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ingress.d.ts","sourceRoot":"","sources":["../../src/k8s/ingress.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAoB,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEtF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAgBxE,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,eAAe,EACvB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,WAAW,EAAE,GACnB,SAAS,CAoBX;AAUD,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,eAAe,EACvB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,WAAW,EAAE,GACnB;IAAE,OAAO,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CA0CzC;AAED;;;;mDAImD;AACnD,wBAAgB,YAAY,CAC1B,MAAM,EAAE,eAAe,EACvB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,WAAW,EAAE,GACnB,cAAc,EAAE,CAWlB"}

package/dist/k8s/ingress.js

@@ -1,102 +0,0 @@
-/** OwnerReference to the session Pod so the Service + Ingress are garbage
- *  collected automatically when the Pod dies — essential for sub-minute
- *  sessions that would otherwise leak ingress objects. */
-function podOwnerRef(podName, podUid) {
-    return {
-        apiVersion: "v1",
-        kind: "Pod",
-        name: podName,
-        uid: podUid,
-        controller: true,
-        blockOwnerDeletion: true,
-    };
-}
-export function buildSessionService(config, sessionId, podName, podUid, ports) {
-    return {
-        apiVersion: "v1",
-        kind: "Service",
-        metadata: {
-            name: `telo-run-${sessionId}`,
-            namespace: config.sessionNamespace,
-            labels: { "app.kubernetes.io/managed-by": config.managedByLabel },
-            ownerReferences: [podOwnerRef(podName, podUid)],
-        },
-        spec: {
-            selector: { "telo.run/session-id": sessionId },
-            ports: ports.map((p) => ({
-                name: `p${p.port}`,
-                port: p.port,
-                targetPort: p.port,
-                protocol: p.protocol.toUpperCase(),
-            })),
-        },
-    };
-}
-/** Host fronting a single tcp port: `<port>-<sessionId>.<domain>`. The port
- *  rides as a leading label (no dots), so it stays a single label under the base
- *  domain — matching the docker runner's proxy scheme and compatible with a
- *  single-label wildcard cert (`*.<domain>`). */
-function hostForPort(config, sessionId, port) {
-    return `${port}-${sessionId}.${config.sessionIngressBaseDomain}`;
-}
-export function buildSessionIngress(config, sessionId, serviceName, podName, podUid, ports) {
-    // Only tcp ports are HTTP-routable; one host rule per port to the matching
-    // service port, mirroring the docker runner's per-port URLs.
-    const rules = ports
-        .filter((p) => p.protocol === "tcp")
-        .map((p) => ({
-        host: hostForPort(config, sessionId, p.port),
-        http: {
-            paths: [
-                {
-                    path: "/",
-                    pathType: "Prefix",
-                    backend: { service: { name: serviceName, port: { number: p.port } } },
-                },
-            ],
-        },
-    }));
-    const ingress = {
-        apiVersion: "networking.k8s.io/v1",
-        kind: "Ingress",
-        metadata: {
-            name: `telo-run-${sessionId}`,
-            namespace: config.sessionNamespace,
-            labels: { "app.kubernetes.io/managed-by": config.managedByLabel },
-            ownerReferences: [podOwnerRef(podName, podUid)],
-        },
-        spec: {
-            ...(config.sessionIngressClassName
-                ? { ingressClassName: config.sessionIngressClassName }
-                : {}),
-            // Present the predefined cert (e.g. a Cloudflare Origin cert) so an upstream
-            // in Full (Strict) mode can validate the origin. Only meaningful with routable
-            // hosts; a single wildcard `*.<domain>` Secret covers every session host.
-            ...(config.sessionIngressTlsSecretName && rules.length > 0
-                ? {
-                    tls: [{ hosts: rules.map((r) => r.host), secretName: config.sessionIngressTlsSecretName }],
-                }
-                : {}),
-            rules,
-        },
-    };
-    return { ingress, hosts: rules.map((r) => r.host) };
-}
-/** Endpoints announced on the `running` status. Every tcp port is fronted by its
- *  own per-session Ingress host (`<port>-<sessionId>.<domain>`, served on 443) and
- *  carries an external `url`. udp ports aren't HTTP-routable, so they keep the
- *  host-less form. Without an ingress base domain, host is left blank for the
- *  client adapter to fill (parity with docker). */
-export function endpointsFor(config, sessionId, ports) {
-    if (!config.sessionIngressBaseDomain || ports.length === 0) {
-        return ports.map((p) => ({ host: "", port: p.port, protocol: p.protocol }));
-    }
-    return ports.map((p) => {
-        if (p.protocol !== "tcp") {
-            return { host: "", port: p.port, protocol: p.protocol };
-        }
-        const host = hostForPort(config, sessionId, p.port);
-        return { host, port: p.port, protocol: p.protocol, url: `https://${host}` };
-    });
-}
-//# sourceMappingURL=ingress.js.map

package/dist/k8s/ingress.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ingress.js","sourceRoot":"","sources":["../../src/k8s/ingress.ts"],"names":[],"mappings":"AAKA;;0DAE0D;AAC1D,SAAS,WAAW,CAAC,OAAe,EAAE,MAAc;IAClD,OAAO;QACL,UAAU,EAAE,IAAI;QAChB,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,OAAO;QACb,GAAG,EAAE,MAAM;QACX,UAAU,EAAE,IAAI;QAChB,kBAAkB,EAAE,IAAI;KACzB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,MAAuB,EACvB,SAAiB,EACjB,OAAe,EACf,MAAc,EACd,KAAoB;IAEpB,OAAO;QACL,UAAU,EAAE,IAAI;QAChB,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE;YACR,IAAI,EAAE,YAAY,SAAS,EAAE;YAC7B,SAAS,EAAE,MAAM,CAAC,gBAAgB;YAClC,MAAM,EAAE,EAAE,8BAA8B,EAAE,MAAM,CAAC,cAAc,EAAE;YACjE,eAAe,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;SAChD;QACD,IAAI,EAAE;YACJ,QAAQ,EAAE,EAAE,qBAAqB,EAAE,SAAS,EAAE;YAC9C,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACvB,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE;gBAClB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,UAAU,EAAE,CAAC,CAAC,IAAI;gBAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE;aACnC,CAAC,CAAC;SACJ;KACF,CAAC;AACJ,CAAC;AAED;;;iDAGiD;AACjD,SAAS,WAAW,CAAC,MAAuB,EAAE,SAAiB,EAAE,IAAY;IAC3E,OAAO,GAAG,IAAI,IAAI,SAAS,IAAI,MAAM,CAAC,wBAAwB,EAAE,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,MAAuB,EACvB,SAAiB,EACjB,WAAmB,EACnB,OAAe,EACf,MAAc,EACd,KAAoB;IAEpB,2EAA2E;IAC3E,6DAA6D;IAC7D,MAAM,KAAK,GAAG,KAAK;SAChB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC;SACnC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC;QAC5C,IAAI,EAAE;YACJ,KAAK,EAAE;gBACL;oBACE,IAAI,EAAE,GAAG;oBACT,QAAQ,EAAE,QAAiB;oBAC3B,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE;iBACtE;aACF;SACF;KACF,CAAC,CAAC,CAAC;IACN,MAAM,OAAO,GAAc;QACzB,UAAU,EAAE,sBAAsB;QAClC,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE;YACR,IAAI,EAAE,YAAY,SAAS,EAAE;YAC7B,SAAS,EAAE,MAAM,CAAC,gBAAgB;YAClC,MAAM,EAAE,EAAE,8BAA8B,EAAE,MAAM,CAAC,cAAc,EAAE;YACjE,eAAe,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;SAChD;QACD,IAAI,EAAE;YACJ,GAAG,CAAC,MAAM,CAAC,uBAAuB;gBAChC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,uBAAuB,EAAE;gBACtD,CAAC,CAAC,EAAE,CAAC;YACP,6EAA6E;YAC7E,+EAA+E;YAC/E,0EAA0E;YAC1E,GAAG,CAAC,MAAM,CAAC,2BAA2B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBACxD,CAAC,CAAC;oBACE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,2BAA2B,EAAE,CAAC;iBAC3F;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,KAAK;SACN;KACF,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AACtD,CAAC;AAED;;;;mDAImD;AACnD,MAAM,UAAU,YAAY,CAC1B,MAAuB,EACvB,SAAiB,EACjB,KAAoB;IAEpB,IAAI,CAAC,MAAM,CAAC,wBAAwB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACrB,IAAI,CAAC,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YACzB,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC1D,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACpD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,WAAW,IAAI,EAAE,EAAE,CAAC;IAC9E,CAAC,CAAC,CAAC;AACL,CAAC"}

package/src/k8s/ingress.test.ts

@@ -1,146 +0,0 @@
-import { describe, expect, it } from "vitest";
-
-import type { PortMapping } from "@telorun/runner-core";
-
-import type { K8sRunnerConfig } from "../config.js";
-import { buildSessionIngress, endpointsFor } from "./ingress.js";
-
-const config = {
-  sessionNamespace: "telo-sessions",
-  sessionIngressBaseDomain: "telo.run",
-  sessionIngressClassName: "nginx",
-  managedByLabel: "telo-k8s-runner",
-} as K8sRunnerConfig;
-
-const sessionId = "hzyayvabgyvz";
-const ports: PortMapping[] = [
-  { port: 8080, protocol: "tcp" },
-  { port: 9090, protocol: "tcp" },
-  { port: 5000, protocol: "udp" },
-];
-
-describe("endpointsFor", () => {
-  it("gives every tcp port a <port>-<id>.<domain> host + url, udp host-less", () => {
-    expect(endpointsFor(config, sessionId, ports)).toEqual([
-      {
-        host: `8080-${sessionId}.telo.run`,
-        port: 8080,
-        protocol: "tcp",
-        url: `https://8080-${sessionId}.telo.run`,
-      },
-      {
-        host: `9090-${sessionId}.telo.run`,
-        port: 9090,
-        protocol: "tcp",
-        url: `https://9090-${sessionId}.telo.run`,
-      },
-      { host: "", port: 5000, protocol: "udp" },
-    ]);
-  });
-
-  it("leaves hosts blank when no ingress base domain is configured", () => {
-    const logsOnly = { ...config, sessionIngressBaseDomain: undefined } as K8sRunnerConfig;
-    expect(endpointsFor(logsOnly, sessionId, ports)).toEqual([
-      { host: "", port: 8080, protocol: "tcp" },
-      { host: "", port: 9090, protocol: "tcp" },
-      { host: "", port: 5000, protocol: "udp" },
-    ]);
-  });
-});
-
-describe("buildSessionIngress", () => {
-  it("emits one rule per tcp port to the matching service port", () => {
-    const { ingress, hosts } = buildSessionIngress(
-      config,
-      sessionId,
-      `telo-run-${sessionId}`,
-      "pod",
-      "uid",
-      ports,
-    );
-    expect(hosts).toEqual([`8080-${sessionId}.telo.run`, `9090-${sessionId}.telo.run`]);
-    expect(ingress.spec?.ingressClassName).toBe("nginx");
-    expect(ingress.spec?.rules).toEqual([
-      {
-        host: `8080-${sessionId}.telo.run`,
-        http: {
-          paths: [
-            {
-              path: "/",
-              pathType: "Prefix",
-              backend: { service: { name: `telo-run-${sessionId}`, port: { number: 8080 } } },
-            },
-          ],
-        },
-      },
-      {
-        host: `9090-${sessionId}.telo.run`,
-        http: {
-          paths: [
-            {
-              path: "/",
-              pathType: "Prefix",
-              backend: { service: { name: `telo-run-${sessionId}`, port: { number: 9090 } } },
-            },
-          ],
-        },
-      },
-    ]);
-  });
-
-  it("produces no rules when there are no tcp ports", () => {
-    const { ingress, hosts } = buildSessionIngress(
-      config,
-      sessionId,
-      `telo-run-${sessionId}`,
-      "pod",
-      "uid",
-      [{ port: 5000, protocol: "udp" }],
-    );
-    expect(hosts).toEqual([]);
-    expect(ingress.spec?.rules).toEqual([]);
-  });
-
-  it("omits the tls block when no tls secret is configured", () => {
-    const { ingress } = buildSessionIngress(
-      config,
-      sessionId,
-      `telo-run-${sessionId}`,
-      "pod",
-      "uid",
-      ports,
-    );
-    expect(ingress.spec?.tls).toBeUndefined();
-  });
-
-  it("presents the configured tls secret for every tcp host", () => {
-    const tlsConfig = { ...config, sessionIngressTlsSecretName: "telo-origin-tls" } as K8sRunnerConfig;
-    const { ingress } = buildSessionIngress(
-      tlsConfig,
-      sessionId,
-      `telo-run-${sessionId}`,
-      "pod",
-      "uid",
-      ports,
-    );
-    expect(ingress.spec?.tls).toEqual([
-      {
-        hosts: [`8080-${sessionId}.telo.run`, `9090-${sessionId}.telo.run`],
-        secretName: "telo-origin-tls",
-      },
-    ]);
-  });
-
-  it("omits the tls block when there are no tcp hosts to secure", () => {
-    const tlsConfig = { ...config, sessionIngressTlsSecretName: "telo-origin-tls" } as K8sRunnerConfig;
-    const { ingress } = buildSessionIngress(
-      tlsConfig,
-      sessionId,
-      `telo-run-${sessionId}`,
-      "pod",
-      "uid",
-      [{ port: 5000, protocol: "udp" }],
-    );
-    expect(ingress.spec?.tls).toBeUndefined();
-  });
-});

package/src/k8s/ingress.ts

@@ -1,127 +0,0 @@
-import type { V1Ingress, V1OwnerReference, V1Service } from "@kubernetes/client-node";
-
-import type { K8sRunnerConfig } from "../config.js";
-import type { PortMapping, RunnerEndpoint } from "@telorun/runner-core";
-
-/** OwnerReference to the session Pod so the Service + Ingress are garbage
- *  collected automatically when the Pod dies — essential for sub-minute
- *  sessions that would otherwise leak ingress objects. */
-function podOwnerRef(podName: string, podUid: string): V1OwnerReference {
-  return {
-    apiVersion: "v1",
-    kind: "Pod",
-    name: podName,
-    uid: podUid,
-    controller: true,
-    blockOwnerDeletion: true,
-  };
-}
-
-export function buildSessionService(
-  config: K8sRunnerConfig,
-  sessionId: string,
-  podName: string,
-  podUid: string,
-  ports: PortMapping[],
-): V1Service {
-  return {
-    apiVersion: "v1",
-    kind: "Service",
-    metadata: {
-      name: `telo-run-${sessionId}`,
-      namespace: config.sessionNamespace,
-      labels: { "app.kubernetes.io/managed-by": config.managedByLabel },
-      ownerReferences: [podOwnerRef(podName, podUid)],
-    },
-    spec: {
-      selector: { "telo.run/session-id": sessionId },
-      ports: ports.map((p) => ({
-        name: `p${p.port}`,
-        port: p.port,
-        targetPort: p.port,
-        protocol: p.protocol.toUpperCase(),
-      })),
-    },
-  };
-}
-
-/** Host fronting a single tcp port: `<port>-<sessionId>.<domain>`. The port
- *  rides as a leading label (no dots), so it stays a single label under the base
- *  domain — matching the docker runner's proxy scheme and compatible with a
- *  single-label wildcard cert (`*.<domain>`). */
-function hostForPort(config: K8sRunnerConfig, sessionId: string, port: number): string {
-  return `${port}-${sessionId}.${config.sessionIngressBaseDomain}`;
-}
-
-export function buildSessionIngress(
-  config: K8sRunnerConfig,
-  sessionId: string,
-  serviceName: string,
-  podName: string,
-  podUid: string,
-  ports: PortMapping[],
-): { ingress: V1Ingress; hosts: string[] } {
-  // Only tcp ports are HTTP-routable; one host rule per port to the matching
-  // service port, mirroring the docker runner's per-port URLs.
-  const rules = ports
-    .filter((p) => p.protocol === "tcp")
-    .map((p) => ({
-      host: hostForPort(config, sessionId, p.port),
-      http: {
-        paths: [
-          {
-            path: "/",
-            pathType: "Prefix" as const,
-            backend: { service: { name: serviceName, port: { number: p.port } } },
-          },
-        ],
-      },
-    }));
-  const ingress: V1Ingress = {
-    apiVersion: "networking.k8s.io/v1",
-    kind: "Ingress",
-    metadata: {
-      name: `telo-run-${sessionId}`,
-      namespace: config.sessionNamespace,
-      labels: { "app.kubernetes.io/managed-by": config.managedByLabel },
-      ownerReferences: [podOwnerRef(podName, podUid)],
-    },
-    spec: {
-      ...(config.sessionIngressClassName
-        ? { ingressClassName: config.sessionIngressClassName }
-        : {}),
-      // Present the predefined cert (e.g. a Cloudflare Origin cert) so an upstream
-      // in Full (Strict) mode can validate the origin. Only meaningful with routable
-      // hosts; a single wildcard `*.<domain>` Secret covers every session host.
-      ...(config.sessionIngressTlsSecretName && rules.length > 0
-        ? {
-            tls: [{ hosts: rules.map((r) => r.host), secretName: config.sessionIngressTlsSecretName }],
-          }
-        : {}),
-      rules,
-    },
-  };
-  return { ingress, hosts: rules.map((r) => r.host) };
-}
-
-/** Endpoints announced on the `running` status. Every tcp port is fronted by its
- *  own per-session Ingress host (`<port>-<sessionId>.<domain>`, served on 443) and
- *  carries an external `url`. udp ports aren't HTTP-routable, so they keep the
- *  host-less form. Without an ingress base domain, host is left blank for the
- *  client adapter to fill (parity with docker). */
-export function endpointsFor(
-  config: K8sRunnerConfig,
-  sessionId: string,
-  ports: PortMapping[],
-): RunnerEndpoint[] {
-  if (!config.sessionIngressBaseDomain || ports.length === 0) {
-    return ports.map((p) => ({ host: "", port: p.port, protocol: p.protocol }));
-  }
-  return ports.map((p) => {
-    if (p.protocol !== "tcp") {
-      return { host: "", port: p.port, protocol: p.protocol };
-    }
-    const host = hostForPort(config, sessionId, p.port);
-    return { host, port: p.port, protocol: p.protocol, url: `https://${host}` };
-  });
-}