refactor: split browser and auth-proxy ingresses.

[pantierra]

Closes #568.

[claude]

Claude finished @pantierra's task in 3m 46s —— View job

---

Claude's PR Review

• Gather context (diff, changed files)
• Review templates (networking.tpl, ingress/middleware yaml)
• Review tests
• Ponytail pass for over-engineering
• Post final review

---

✅ No blocking issues — safe to merge.

Traced the full flow: eoapi.ingressFlags gating → eoapi.ingressManifest rendering for the three ingress variants (main/auth-proxy/browser) → the nginx vs. traefik branches for rewrite/strip-prefix/redirect middleware. The nginx/traefik split (separate rewrite-free auth-proxy-ingress only for nginx, auth-proxy kept on the main ingress for traefik with /stac excluded from strip-prefix) is internally consistent, and the accompanying test changes (ingress_test.yaml, stac-auth-proxy-ingress_test.yaml, browser_redirect_test.yaml, traefik_middleware_test.yaml, stac_browser_tests.yaml) exercise the new branches (nginx-only auth-proxy ingress, traefik main-ingress passthrough, browser-only rendering, SB_pathPrefix env var, annotation stripping). Dropping the old semverCompare fallbacks for apiVersion/ingressClassName is fine since Chart.yaml already pins kubeVersion: '>=1.32.0-0', so that code was already dead.

Note: I could not execute helm unittest/helm template/helm lint in this sandboxed environment (commands required interactive approval that isn't available here), so this review is based on static reading of the templates and diffs, not a live render. Recommend confirming CI (View job run link below) passes the chart's unit test suite before merging.

No correctness, security, or best-practice issues found in the diff.

Simplify (ponytail)

• charts/eoapi/templates/_helpers/networking.tpl:239-242 — eoapi.browserPathPrefix has a single call site (services/browser/deployment.yaml); could inline the trailing-slash check there and drop the named template.
• charts/eoapi/templates/_helpers/networking.tpl:71-84 — eoapi.ingressCommonAnnotations merges $owned then unsets $omit keys; for the auth-proxy/browser variants it'd be simpler to just never merge the nginx-rewrite keys into $owned in the first place instead of merge-then-unset.

Both are minor style nits, not blocking.

---

💰 Estimated review cost: $1.27 · 3m46s · 32 turns

[lhoupert]

It seems that these notContains assertions can never fail without any: true
The assertion seems to pass even when the path is present, and fails correctly once any: true is added.

[lhoupert]

SAme issue as above

[lhoupert]

Suggested change

	- notContains:
	path: spec.rules[0].http.paths
	content:
	pathType: Prefix
	path: /stac
	backend:
	service:
	name: RELEASE-NAME-stac-auth-proxy
	port:
	number: 8080
	- contains:
	- notContains:
	path: spec.rules[0].http.paths
	content:
	pathType: ImplementationSpecific
	path: /browser(/|$)(.*)
	backend:
	service:
	name: RELEASE-NAME-browser
	port:
	number: 8080
	path: /browser
	- notContains:
	path: spec.rules[0].http.paths
	content:
	path: /stac
	any: true
	- notContains:
	path: spec.rules[0].http.paths
	content:
	path: /browser
	any: true
	- notContains:
	path: spec.rules[0].http.paths
	content:
	path: /browser(/|$)(.*)
	any: true

[lhoupert]

Sane issue than https://github.com/developmentseed/eoapi-k8s/pull/586/changes#r3675257745

Suggested change

	- notContains:
	path: spec.rules[0].http.paths
	content:
	path: "/browser"
	- notContains:
	path: spec.rules[0].http.paths
	content:
	path: "/browser"
	any: true
	- notContains:
	path: spec.rules[0].http.paths
	content:
	path: "/browser(/|$)(.*)"
	any: true

[lhoupert]

Suggested change

	- notContains:
	path: spec.rules[0].http.paths
	content:
	path: /stac
	- notContains:
	path: spec.rules[0].http.paths
	content:
	path: /stac
	any: true
	- notContains:
	path: spec.rules[0].http.paths
	content:
	path: /stac(/|$)(.*)
	any: true