---
name: "contour-envoy-ingress-gateway"
description: "Deploy enterprise Ingress with Project Contour, Envoy proxy, and HTTPProxy multi-team delegation."
metadata:
  author: "Project Contour"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "create contour httpproxy"
  - "contour multi-team delegation"
  - "setup envoy ingress contour"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# Project Contour & Envoy Ingress Controller Architecture

Configures Project Contour and Envoy: authoring HTTPProxy CRDs, root and child proxy delegation across namespaces, header-based routing, external authentication, and zero-downtime Envoy upgrades.

## When to Invoke
Invoke this skill whenever you need to:
- create contour httpproxy
- contour multi-team delegation
- setup envoy ingress contour

## Execution SOP & Rules
1. Install Contour and Envoy via official operator or Helm chart.
2. Define root HTTPProxy in cluster ingress namespace with includes: [{ name: 'child-proxy', namespace: 'team-a' }].
3. Define child HTTPProxy in developer namespace with specific service routing rules.
4. Inspect HTTPProxy health: kubectl get httpproxy to verify status Valid.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.