agentteams-higress
| Version | 2026.223.1500 |
| Repo | box/github.com/opencharly/pod-agentteams-higress:v2026.237.454 |
The Higress AI gateway for AgentTeams — the apiserver, controller, pilot, envoy gateway, and console binaries extracted from the higress/all-in-one:2.2.1 image, re-declared as five supervisord services matching the upstream priorities (200/300/400/500/600) and env. Rootless: every service runs as the image user (uid 1000); the privileged paths the upstream scripts write at runtime (/etc/certs, /etc/istio/config, /etc/istio/proxy, /var/lib/istio, /var/log/proxy) are pre-created uid-1000-writable at build time, and the start scripts are charly-owned (written by this candy) — no sudo, no upstream install scripts. The console runs the extracted higress-console.jar on Java (jre-openjdk).
Services
Section titled “Services”higress-apiserverhigress-controllerhigress-pilothigress-gatewayhigress-console
Acceptance plan
Section titled “Acceptance plan”This candy’s plan: — the runnable spec charly check executes against a live deployment. check: steps are idempotent probes; run: steps change state.
| Intent | Step |
|---|---|
run |
create the higress volume directory under the image user’s home (venue-agnostic: ${HOME} resolves to the container home on a pod, the guest home on a VM) |
run |
pre-create the privileged paths the upstream scripts write at runtime, uid-1000-writable (rootless: no sudo at runtime) |
run |
chown the pre-created privileged paths to the image user so the rootless services can write them (logrotate only READS /etc/logrotate.d — the config is written at build time, so that dir stays root-owned) |
run |
set the Arch default JVM so /usr/bin/java resolves (the jre-openjdk package installs to /usr/lib/jvm/java-26-openjdk but leaves the archlinux-java default-runtime symlink pointing at /dev/null until a default is selected — the console runs on Java) |
run |
write the logrotate config for the gateway access log (replicating the upstream container-init output, rootless) |
run |
write the supercronic cron file for the gateway log rotation |
run |
write the gateway pod labels the istio-agent folds into envoy node-metadata LABELS (the pilot matches the proxy to the Gateway resource by the higress=higress-system-higress-gateway selector — without this file no gateway listeners are generated and the 8080 port never serves; the upstream image bakes /etc/istio/pod/labels at build time, ours is charly-owned) |
run |
write the rootless higress apiserver start script |
run |
write the rootless higress controller start script |
run |
write the rootless higress pilot start script |
run |
write the rootless higress gateway start script |
run |
write the rootless higress console start script |
check |
the higress apiserver binary is extracted |
check |
the higress controller binary is extracted |
check |
the higress pilot-discovery binary is extracted |
check |
the higress envoy gateway binary is extracted |
check |
the higress console jar is extracted |
check |
the higress defaultConfig seed resources are extracted |
check |
the privileged paths are pre-created uid-1000-writable |
check |
the higress apiserver answers on its internal port |
check |
the higress gateway is healthy (pilot-agent + envoy answer the status port; bounded probe — envoy’s V8 WASM engine segfaults once at startup under the upstream –concurrency default and the init’s restart policy covers the ~15s down window on both substrates) |
check |
the higress gateway serves the console on its ingress port (the 8080 listener only materializes when the proxy node LABELS match the Gateway selector — fails without the baked /etc/istio/pod/labels; bounded probe for the same startup/restart window) |
check |
the higress console answers on its port |
check |
the higress-apiserver service is running |
check |
the higress-controller service is running |
check |
the higress-pilot service is running |
check |
the higress-gateway service is running |
check |
the higress-console service is running |