fix(ingress): wildcard gets its own Ingress + Traefik router.priority (root cause now measured)

[izzywdev]

Makes the tenant-subdomain wildcard safe to re-enable. It stays disabled in prod — this ships the mechanism, not the rollout.

The root cause is no longer inferred

#431 shipped the wildcard as a second rule on the main Ingress and took FuzePlan down. #437 reverted it, and recorded the cause as inferred — the prod Traefik API was unreachable, so the router priorities were never read.

I reproduced it in isolation on rancher/mirrored-library-traefik:3.6.13, the exact prod image, using the file provider with two routers and no declared priority:

Host: plan.fuzefront.com     ->  wildcard-fuzefront@file  ->  :9002    WRONG

The exact-host router lost to the wildcard. Traefik orders routers by rule length, and the generated HostRegexp is longer than Host(`plan.fuzefront.com`).

With priority: 1 on the wildcard router only:

Host: plan.fuzefront.com     ->  exact-plan@file          ->  :9001    correct
Host: corpabc.fuzefront.com  ->  wildcard-fuzefront@file  ->  :9002    correct

Why a separate Ingress object

traefik.ingress.kubernetes.io/router.priority is a per-Ingress-object annotation. The wildcard cannot be de-prioritised while it shares an object with the canonical host — so it moves to fuzefront-tenant-wildcard. The template says so inline, with the measurement, so nobody merges it back.

On ingress-nginx (local) the annotation is inert: nginx follows the Kubernetes spec and prefers exact hosts on its own.

The YAML anchor had to go

An anchor cannot be referenced across YAML documents, so *fanout could not survive the split. Both call sites now include the same helper. The guarantee the anchor existed for — the two fan-outs cannot drift — is preserved, because there is still exactly one definition. The render asserts it rather than trusting it.

Renders

Scenario	Result
prod (wildcard off)	tenant-wildcard not rendered; main = 1 rule, 8 paths
local (nginx)	tenant-wildcard rendered, no priority annotation (inert on nginx)
prod dry-run (wildcard on)	router.priority=1, no tls: block, fan-out identical to canonical (8 paths), main still a single rule
helm lint	0 charts failed

Prod re-enablement is still a deploy-window decision

Deliberately not flipped here. The wildcard CNAME already exists at Cloudflare, so setting wildcardHost puts every *.fuzefront.com host live immediately — there is no DNS gate to stage behind. That assumption is what made #431 an outage rather than a no-op.

When you do enable it, verify plan.fuzefront.com straight after the sync, not the rendered YAML. helm template | kubeconform -strict and a parsed fan-out-identity check both passed on #431 and neither could see cross-namespace router precedence.

Refs #431, #437, FFRNT-91.

🤖 Generated with Claude Code

[github-actions]

Automated code review (gate-code-review)

Credit balance is too low

Report-only — this check never blocks merge.