Release v0.47.0

agent/cmd/agent/main.go

@@ -25,6 +25,7 @@ import (
 	"techulus/cloud-agent/internal/network"
 	"techulus/cloud-agent/internal/paths"
 	"techulus/cloud-agent/internal/reconcile"
+	"techulus/cloud-agent/internal/routeowners"
 	"techulus/cloud-agent/internal/traefik"
 	"techulus/cloud-agent/internal/wireguard"
 )
@@ -289,13 +290,14 @@ func main() {
 	var logsSender *logs.VictoriaLogsSender
 	var agentLogWriter *logs.AgentLogWriter
 	var metricsSender agent.MetricsSender
+	routeOwners := routeowners.NewRegistry()
 
 	if logsEndpoint != "" {
 		log.Println("[logs] log collection enabled, endpoint:", sanitizedEndpoint(logsEndpoint))
 		logsSender = logs.NewVictoriaLogsSender(logsEndpoint, config.ServerID)
 		logCollector = logs.NewCollector(logsSender, dataDir)
 		if isProxy {
-			traefikLogCollector = logs.NewTraefikCollector(logsSender)
+			traefikLogCollector = logs.NewTraefikCollector(logsSender, routeOwners)
 			log.Println("[traefik-logs] Traefik HTTP log collection enabled")
 		}
 		agentLogWriter = logs.NewAgentLogWriter(config.ServerID, logsSender)
@@ -337,7 +339,7 @@ func main() {
 	privateIP := network.PrivateIP()
 	log.Printf("Agent v%s started. Public IP: %s, Private IP: %s. Tick interval: %v", agent.Version, publicIP, privateIP, agent.TickInterval)
 
-	agentInstance := agent.NewAgent(client, reconciler, config, publicIP, privateIP, dataDir, logCollector, traefikLogCollector, metricsSender, builder, config.IsProxy, disableDNS)
+	agentInstance := agent.NewAgent(client, reconciler, config, publicIP, privateIP, dataDir, logCollector, traefikLogCollector, metricsSender, routeOwners, builder, config.IsProxy, disableDNS)
 	agentInstance.Run(ctx)
 
 	if agentLogFlusherDone != nil {

agent/go.mod

@@ -9,6 +9,8 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.71.1
 	github.com/hashicorp/go-sockaddr v1.0.7
 	github.com/miekg/dns v1.1.62
+	github.com/prometheus/client_model v0.6.2
+	github.com/prometheus/common v0.66.1
 	github.com/shirou/gopsutil/v3 v3.24.5
 	gopkg.in/yaml.v3 v3.0.1
 )
@@ -29,15 +31,19 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/sts v1.33.3 // indirect
 	github.com/aws/smithy-go v1.22.1 // indirect
 	github.com/go-ole/go-ole v1.2.6 // indirect
+	github.com/kr/pretty v0.3.1 // indirect
 	github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect
 	github.com/shoenig/go-m1cpu v0.1.6 // indirect
 	github.com/tklauser/go-sysconf v0.3.12 // indirect
 	github.com/tklauser/numcpus v0.6.1 // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
+	go.yaml.in/yaml/v2 v2.4.2 // indirect
 	golang.org/x/mod v0.18.0 // indirect
-	golang.org/x/net v0.27.0 // indirect
+	golang.org/x/net v0.43.0 // indirect
 	golang.org/x/sync v0.7.0 // indirect
-	golang.org/x/sys v0.31.0 // indirect
+	golang.org/x/sys v0.35.0 // indirect
 	golang.org/x/tools v0.22.0 // indirect
+	google.golang.org/protobuf v1.36.8 // indirect
 )

agent/go.sum

@@ -34,53 +34,73 @@ github.com/aws/aws-sdk-go-v2/service/sts v1.33.3 h1:Xgv/hyNgvLda/M9l9qxXc4UFSgpp
 github.com/aws/aws-sdk-go-v2/service/sts v1.33.3/go.mod h1:5Gn+d+VaaRgsjewpMvGazt0WfcFO+Md4wLOuBfGR9Bc=
 github.com/aws/smithy-go v1.22.1 h1:/HPHZQ0g7f4eUeK6HKglFz8uwVfZKgoI25rb/J+dnro=
 github.com/aws/smithy-go v1.22.1/go.mod h1:irrKGvNn1InZwb2d7fkIRNucdfwR8R+Ts3wxYa/cJHg=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY=
 github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
-github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/hashicorp/go-sockaddr v1.0.7 h1:G+pTkSO01HpR5qCxg7lxfsFEZaG+C0VssTy/9dbT+Fw=
 github.com/hashicorp/go-sockaddr v1.0.7/go.mod h1:FZQbEYa1pxkQ7WLpyXJ6cbjpT8q0YgQaK/JakXqGyWw=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 h1:6E+4a0GO5zZEnZ81pIr0yLvtUWk2if982qA3F3QD6H4=
 github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0/go.mod h1:zJYVVT2jmtg6P3p1VtQj7WsuWi/y4VnjVBn7F8KPB3I=
 github.com/miekg/dns v1.1.62 h1:cN8OuEF1/x5Rq6Np+h1epln8OiyPWV+lROx9LxcGgIQ=
 github.com/miekg/dns v1.1.62/go.mod h1:mvDlcItzm+br7MToIKqkglaGhlFMHJ9DTNNWONWXbNQ=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c h1:ncq/mPwQF4JjgDlrVEn3C11VoGHZN7m8qihwgMEtzYw=
 github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
+github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
+github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
+github.com/prometheus/common v0.66.1 h1:h5E0h5/Y8niHc5DlaLlWLArTQI7tMrsfQjHV+d9ZoGs=
+github.com/prometheus/common v0.66.1/go.mod h1:gcaUsgf3KfRSwHY4dIMXLPV0K/Wg1oZ8+SbZk/HH/dA=
+github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
+github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
+github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
 github.com/shirou/gopsutil/v3 v3.24.5 h1:i0t8kL+kQTvpAYToeuiVk3TgDeKOFioZO3Ztz/iZ9pI=
 github.com/shirou/gopsutil/v3 v3.24.5/go.mod h1:bsoOS1aStSs9ErQ1WWfxllSeS1K5D+U30r2NfcubMVk=
 github.com/shoenig/go-m1cpu v0.1.6 h1:nxdKQNcEB6vzgA2E2bvzKIYRuNj7XNJ4S/aRSwKzFtM=
 github.com/shoenig/go-m1cpu v0.1.6/go.mod h1:1JJMcUBvfNwpq05QDQVAnx3gUHr9IYF7GNg9SUEw2VQ=
 github.com/shoenig/test v0.6.4 h1:kVTaSd7WLz5WZ2IaoM0RSzRsUD+m8wRR+5qvntpn4LU=
 github.com/shoenig/test v0.6.4/go.mod h1:byHiCGXqrVaflBLAMq/srcZIHynQPQgeyvkvXnjqq0k=
-github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
-github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/tklauser/go-sysconf v0.3.12 h1:0QaGUFOdQaIVdPgfITYzaTegZvdCjmYO52cSFAEVmqU=
 github.com/tklauser/go-sysconf v0.3.12/go.mod h1:Ho14jnntGE1fpdOqQEEaiKRpvIavV0hSfmBq8nJbHYI=
 github.com/tklauser/numcpus v0.6.1 h1:ng9scYS7az0Bk4OZLvrNXNSAO2Pxr1XXRAPyjhIx+Fk=
 github.com/tklauser/numcpus v0.6.1/go.mod h1:1XfjsgE2zo8GVw7POkMbHENHzVg3GzmoZ9fESEdAacY=
 github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
 github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
+go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
+go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
 golang.org/x/mod v0.18.0 h1:5+9lSbEzPSdWkH32vYPBwEpX8KwDbM52Ud9xBUvNlb0=
 golang.org/x/mod v0.18.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/net v0.27.0 h1:5K3Njcw06/l2y9vpGCSdcxWOYHOUk3dVNGDXN+FvAys=
-golang.org/x/net v0.27.0/go.mod h1:dDi0PyhWNoiUOrAS8uXv/vnScO4wnHQO4mj9fn/RytE=
+golang.org/x/net v0.43.0 h1:lat02VYK2j4aLzMzecihNvTlJNQUq316m2Mr9rnM6YE=
+golang.org/x/net v0.43.0/go.mod h1:vhO1fvI4dGsIjh73sWfUVjj3N7CA9WkKJNQm2svM6Jg=
 golang.org/x/sync v0.7.0 h1:YsImfSBoP9QPYL0xyKJPq0gcaJdG3rInoqxTWbfQu9M=
 golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
-golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
+golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/tools v0.22.0 h1:gqSGLZqv+AI9lIQzniJ0nZDRG5GBPsSi+DRNHWNz6yA=
 golang.org/x/tools v0.22.0/go.mod h1:aCwcsjqvq7Yqt6TNyX7QMU2enbQ/Gt0bo6krSeEri+c=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
+google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc=
+google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

agent/internal/agent/agent.go

@@ -11,6 +11,7 @@ import (
 	agenthttp "techulus/cloud-agent/internal/http"
 	"techulus/cloud-agent/internal/logs"
 	"techulus/cloud-agent/internal/reconcile"
+	"techulus/cloud-agent/internal/routeowners"
 )
 
 const (
@@ -44,7 +45,6 @@ type ActualState struct {
 	Containers            []container.Container
 	DnsConfigHash         string
 	TraefikConfigHash     string
-	L4ConfigHash          string
 	CertificatesHash      string
 	TraefikReloaded       bool
 	ChallengeRouteWritten bool
@@ -87,6 +87,7 @@ type Agent struct {
 	LogCollector                 *logs.Collector
 	TraefikLogCollector          *logs.TraefikCollector
 	MetricsSender                MetricsSender
+	RouteOwners                  *routeowners.Registry
 	Builder                      *build.Builder
 	isBuilding                   bool
 	buildMutex                   sync.Mutex
@@ -104,6 +105,7 @@ func NewAgent(
 	logCollector *logs.Collector,
 	traefikLogCollector *logs.TraefikCollector,
 	metricsSender MetricsSender,
+	routeOwners *routeowners.Registry,
 	builder *build.Builder,
 	isProxy bool,
 	disableDNS bool,
@@ -122,6 +124,7 @@ func NewAgent(
 		LogCollector:           logCollector,
 		TraefikLogCollector:    traefikLogCollector,
 		MetricsSender:          metricsSender,
+		RouteOwners:            routeOwners,
 		Builder:                builder,
 		IsProxy:                isProxy,
 		DisableDNS:             disableDNS,

agent/internal/agent/drift.go

@@ -208,7 +208,6 @@ func (a *Agent) getActualState() (*ActualState, error) {
 	}
 	if a.IsProxy {
 		state.TraefikConfigHash = traefik.GetCurrentConfigHash()
-		state.L4ConfigHash = traefik.GetCurrentL4ConfigHash()
 		state.CertificatesHash = traefik.GetCurrentCertificatesHash()
 		state.TraefikReloaded, err = traefik.DynamicConfigReloaded(a.DataDir)
 		if err != nil {
@@ -354,8 +353,8 @@ func (a *Agent) planReconcile(expected *agenthttp.ExpectedState, actual *ActualS
 
 	if a.IsProxy {
 		compiled := a.compiledTraefikState(expected)
-		if compiled.HTTPHash != actual.TraefikConfigHash ||
-			compiled.L4Hash != actual.L4ConfigHash ||
+		if compiled.CompileErr != nil ||
+			compiled.RoutesHash != actual.TraefikConfigHash ||
 			compiled.CertHash != actual.CertificatesHash ||
 			!actual.TraefikReloaded {
 			actions = append(actions, reconcileAction{
@@ -562,6 +561,9 @@ func (a *Agent) applyReconcileAction(action reconcileAction) error {
 
 func (a *Agent) updateTraefik() error {
 	compiled := a.compiledTraefikState(a.expectedState)
+	if compiled.CompileErr != nil {
+		return fmt.Errorf("failed to compile Traefik routes: %w", compiled.CompileErr)
+	}
 
 	needsRestart := false
 	metricsRestart, err := traefik.EnsureMetricsConfig()
@@ -585,8 +587,7 @@ func (a *Agent) updateTraefik() error {
 		}
 	}
 
-	routesChanged := compiled.HTTPHash != traefik.GetCurrentConfigHash() ||
-		compiled.L4Hash != traefik.GetCurrentL4ConfigHash()
+	routesChanged := compiled.RoutesHash != traefik.GetCurrentConfigHash()
 	certificatesChanged := compiled.CertHash != traefik.GetCurrentCertificatesHash()
 	if !routesChanged && !certificatesChanged {
 		if err := traefik.EnsureDynamicConfigReloaded(a.DataDir, 15*time.Second); err != nil {
@@ -610,7 +611,7 @@ func (a *Agent) updateTraefik() error {
 	}
 	if routesChanged {
 		log.Printf("[reconcile] updating Traefik routes (HTTP: %d, TCP: %d, UDP: %d)", len(compiled.HTTP), len(compiled.TCP), len(compiled.UDP))
-		if err := traefik.UpdateHttpRoutesWithL4(compiled.HTTP, compiled.TCP, compiled.UDP, a.expectedState.ServerName); err != nil {
+		if err := traefik.WriteRoutesConfig(compiled.Routes); err != nil {
 			return fmt.Errorf("failed to update Traefik: %w", err)
 		}
 	}

agent/internal/agent/helpers.go

@@ -59,9 +59,10 @@ type compiledTraefikState struct {
 	TCPPorts     []int
 	UDPPorts     []int
 
-	HTTPHash string
-	L4Hash   string
-	CertHash string
+	Routes     *traefik.RoutesConfig
+	RoutesHash string
+	CompileErr error
+	CertHash   string
 }
 
 func compileTraefikState(expected *agenthttp.ExpectedState) *compiledTraefikState {
@@ -86,15 +87,17 @@ func compileTraefikState(expected *agenthttp.ExpectedState) *compiledTraefikStat
 		udpPorts = append(udpPorts, r.ExternalPort)
 	}
 
+	routesConfig, compileErr := traefik.CompileRoutes(httpRoutes, tcpRoutes, udpRoutes, expected.ServerName)
 	return &compiledTraefikState{
 		HTTP:         httpRoutes,
 		TCP:          tcpRoutes,
 		UDP:          udpRoutes,
 		Certificates: certificates,
 		TCPPorts:     tcpPorts,
 		UDPPorts:     udpPorts,
-		HTTPHash:     traefik.HashRoutesWithServerName(httpRoutes, expected.ServerName),
-		L4Hash:       traefik.HashTCPRoutes(tcpRoutes) + traefik.HashUDPRoutes(udpRoutes),
+		Routes:       routesConfig,
+		RoutesHash:   traefik.HashRoutesConfig(routesConfig),
+		CompileErr:   compileErr,
 		CertHash:     traefik.HashCertificates(certificates),
 	}
 }

agent/internal/agent/reporting.go

@@ -164,10 +164,7 @@ func (a *Agent) routingSyncedRolloutIds() []string {
 
 func (a *Agent) proxyRoutingStateConverged(expected *agenthttp.ExpectedState) bool {
 	compiled := a.compiledTraefikState(expected)
-	if compiled.HTTPHash != traefik.GetCurrentConfigHash() {
-		return false
-	}
-	if compiled.L4Hash != traefik.GetCurrentL4ConfigHash() {
+	if compiled.CompileErr != nil || compiled.RoutesHash != traefik.GetCurrentConfigHash() {
 		return false
 	}
 	if compiled.CertHash != traefik.GetCurrentCertificatesHash() {

agent/internal/agent/run.go

@@ -11,7 +11,9 @@ import (
 
 	"techulus/cloud-agent/internal/container"
 	agenthttp "techulus/cloud-agent/internal/http"
+	"techulus/cloud-agent/internal/metrics"
 	"techulus/cloud-agent/internal/serverless"
+	"techulus/cloud-agent/internal/traefik"
 )
 
 const (
@@ -23,6 +25,13 @@ const (
 )
 
 func (a *Agent) Run(ctx context.Context) {
+	if a.IsProxy {
+		if cached, err := a.Client.LoadCachedExpectedState(); err == nil {
+			a.RouteOwners.Merge(traefik.HTTPRouteOwners(ConvertToHttpRoutes(cached.Traefik.HttpRoutes)))
+		} else {
+			log.Printf("[cache] expected state unavailable for initial Traefik attribution: %v", err)
+		}
+	}
 	if a.Config.RegistryURL != "" && a.Config.RegistryUsername != "" && a.Config.RegistryPassword != "" {
 		if err := container.Login(a.Config.RegistryURL, a.Config.RegistryUsername, a.Config.RegistryPassword, a.Config.RegistryInsecure); err != nil {
 			log.Printf("[registry] login failed: %v", err)
@@ -147,6 +156,10 @@ func (a *Agent) ForwardTraefikMetrics(ctx context.Context) error {
 		return err
 	}
 
+	body, err = metrics.EnrichTraefik(body, a.RouteOwners)
+	if err != nil {
+		return err
+	}
 	return a.MetricsSender.SendPrometheusMetrics(body, map[string]string{
 		"job":       "traefik",
 		"server_id": a.Config.ServerID,

agent/internal/agent/serverless.go

@@ -11,6 +11,7 @@ import (
 
 	"techulus/cloud-agent/internal/container"
 	agenthttp "techulus/cloud-agent/internal/http"
+	"techulus/cloud-agent/internal/traefik"
 )
 
 var serverlessTransitionCounter atomic.Uint64
@@ -22,6 +23,9 @@ type serverlessTransitionGuard struct {
 }
 
 func (a *Agent) SetLatestExpectedState(state *agenthttp.ExpectedState) {
+	if state != nil {
+		a.RouteOwners.Merge(traefik.HTTPRouteOwners(ConvertToHttpRoutes(state.Traefik.HttpRoutes)))
+	}
 	a.expectedStateMutex.Lock()
 	defer a.expectedStateMutex.Unlock()
 	a.latestExpectedState = state

agent/internal/http/client.go

@@ -204,10 +204,30 @@ func (c *Client) cacheExpectedState(state *ExpectedState) error {
 		return err
 	}
 	path := filepath.Join(c.dataDir, expectedStateCacheFile)
-	return os.WriteFile(path, data, 0600)
+	if err := os.MkdirAll(c.dataDir, 0700); err != nil {
+		return err
+	}
+	tmp, err := os.CreateTemp(c.dataDir, expectedStateCacheFile+".tmp-")
+	if err != nil {
+		return err
+	}
+	tmpPath := tmp.Name()
+	defer os.Remove(tmpPath)
+	if err := tmp.Chmod(0600); err != nil {
+		tmp.Close()
+		return err
+	}
+	if _, err := tmp.Write(data); err != nil {
+		tmp.Close()
+		return err
+	}
+	if err := tmp.Close(); err != nil {
+		return err
+	}
+	return os.Rename(tmpPath, path)
 }
 
-func (c *Client) loadCachedExpectedState() (*ExpectedState, error) {
+func (c *Client) LoadCachedExpectedState() (*ExpectedState, error) {
 	if c.dataDir == "" {
 		return nil, fmt.Errorf("data dir not configured")
 	}
@@ -261,7 +281,7 @@ func (c *Client) GetExpectedStateWithFallback() (*ExpectedState, bool, error) {
 	}
 
 	log.Printf("[state] CP unreachable, attempting to use cached state: %v", err)
-	cachedState, cacheErr := c.loadCachedExpectedState()
+	cachedState, cacheErr := c.LoadCachedExpectedState()
 	if cacheErr != nil {
 		return nil, false, fmt.Errorf("CP unreachable and no cached state available: %w (cache error: %v)", err, cacheErr)
 	}