aSkills.dev logo
aSkills.devRegistry
Submit Skill
Verified SOP & TutorialAudited Score 98/100

The Complete Production SOP: How to Deploy and Run Project Contour & Envoy Ingress Controller Architecture in Autonomous AI Agents

Deploy Project Contour and Envoy Ingress Gateway via autonomous AI agents in Codex, Claude Code, & Cursor. Includes HTTPProxy SOPs, prompts, and debugging.

View 1-Click Spec
Target Runtimes:codexclaude-codecursorwindsurf
5 min read • Updated for 2026

Technical Overview & Architectural Context

Autonomous coding agents frequently fail when configuring Kubernetes Ingress gateways because standard Kubernetes Ingress manifests lack cross-namespace isolation, granular routing policies, and multi-tenant safety controls. Without rigid procedural guardrails, LLMs default to emitting legacy Ingress resources or improperly configured Project Contour HTTPProxy manifests with invalid prefix matching, broken cross-namespace includes, or cyclic delegation loops that lead to degraded cluster states. The `contour-envoy-ingress-gateway` skill eliminates these failure patterns by enforcing an authoritative schema and verification lifecycle for Project Contour and Envoy. It instructs coding agents (such as Codex, Claude Code, Cursor, and Windsurf) to enforce deterministic root-and-child HTTPProxy delegation hierarchies, validate TLS secret boundary permissions, and inspect proxy statuses using schema-level status checks (`Valid`, `Invalid`, or `Orphaned`). By defining operational boundaries upfront, the agent consistently generates production-grade, multi-tenant Kubernetes networking infrastructure without hallucinated CRD attributes.

Prerequisites & Environment Requirements

Codex Desktop, Claude Code CLI, Cursor, or Windsurf installed with active workspace permissions
kubectl v1.28+ configured with access to an active Kubernetes cluster
Project Contour CRDs (projectcontour.io/v1) installed in the target cluster
Git 2.40+ initialized in your infrastructure-as-code repository

Verified Search Intents & Long-Tail Queries Solved

SEO Audit Score: 98/100

This operational tutorial is engineered to provide deterministic solutions for these developer search queries:

#install contour-envoy-ingress-gateway in cursor ide#claude code contour-envoy-ingress-gateway rules#codex desktop contour-envoy-ingress-gateway setup tutorial#how to fix contour-envoy-ingress-gateway agent execution error#deterministic devops agent SOP#contour-envoy-ingress-gateway sandbox permissions and security score#contour-envoy-ingress-gateway prompt examples and triggers#kubernetes contour httpproxy multi-team delegation SOP

Step-by-Step Execution Playbook

1

Local Environment Setup & SKILL.md Mounting

Mount the skill manifest into your agent runtime's global skill directory to enable instant triggers.

Autonomous runtimes discover capabilities through standardized directory paths. For Claude Code CLI, Cursor, Windsurf, or Codex, mount the verified SKILL.md file into your agent context path. The runtime registers triggers like 'create contour httpproxy' and 'contour multi-team delegation' directly into its tool routing loop.

Terminal Command
mkdir -p ~/.agents/skills/contour-envoy-ingress-gateway && cat <<'EOF' > ~/.agents/skills/contour-envoy-ingress-gateway/SKILL.md --- name: "contour-envoy-ingress-gateway" description: "Deploy enterprise Ingress with Project Contour, Envoy proxy, and HTTPProxy multi-team delegation." metadata: author: "Project Contour" version: "1.0.0" runtime_compatibility: - "codex" - "claude-code" - "cursor" - "windsurf" triggers: - "create contour httpproxy" - "contour multi-team delegation" - "setup envoy ingress contour" permissions: fs_read: true fs_write: "workspace" shell_exec: false net_access: false --- # Project Contour & Envoy Ingress Controller Architecture Configures Project Contour and Envoy: authoring HTTPProxy CRDs, root and child proxy delegation across namespaces, header-based routing, external authentication, and zero-downtime Envoy upgrades. EOF
SKILL.md
---
name: "contour-envoy-ingress-gateway"
description: "Deploy enterprise Ingress with Project Contour, Envoy proxy, and HTTPProxy multi-team delegation."
metadata:
  author: "Project Contour"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "create contour httpproxy"
  - "contour multi-team delegation"
  - "setup envoy ingress contour"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---
Production Pro-Tip

Setting `shell_exec: false` and `net_access: false` inside SKILL.md forces the agent to output validated declarative Kubernetes manifests to disk rather than executing untested `kubectl apply` commands directly on your cluster.

Sandbox Gotcha

In Cursor and Windsurf, ensure your workspace rules (`.cursorrules` or `.windsurfrules`) do not ignore the `.agents/skills` path, otherwise trigger activation will fail to index.

2

Environment Secrets & Dependency Validation

Verify target cluster API access and validate Contour CRD versions safely without hardcoding tokens.

Before delegating manifest authoring, verify that `projectcontour.io/v1` CustomResourceDefinitions are deployed. Store credentials in local environment contexts and instruct the agent to run static validation against current Kubernetes schemas rather than embedding secrets in plain prompts.

Terminal Command
kubectl get crd httpproxies.projectcontour.io >/dev/null 2>&1 && echo 'Contour CRD: Ready' || echo 'Contour CRD: Missing'
Production Pro-Tip

Instruct Claude Code or Codex to read schema specifications directly using `kubectl explain httpproxy.spec --recursive` to prevent hallucinating non-existent YAML properties.

Sandbox Gotcha

Ensure `.kube/config` and any `.env` files are added to `.gitignore`. Never pass kubeconfig raw bearer tokens into LLM prompts.

3

Intent Matching & Trigger Invocation

Invoke the agent using calibrated natural language triggers for root-child proxy delegation.

Execute targeted requests that hit trigger hooks defined in frontmatter (`create contour httpproxy`, `contour multi-team delegation`). The agent switches into the deterministic SOP mode, generating split root manifests for platform ops and child manifests for application teams.

Production Pro-Tip

Explicitly mention root vs child proxy separation in the user prompt to trigger multi-tenant validation routines.

Sandbox Gotcha

If you query simply 'configure ingress', the agent might produce an obsolete `networking.k8s.io/v1` Ingress manifest instead of the requested Project Contour `HTTPProxy` CRD.

4

Verification, Linting & Output Quality Gate

Execute kubeconform schema verification and HTTPProxy validation before acceptance.

Mandate that the agent perform automated schema validation using tools like `kubeconform` or dry-run validation against the Kubernetes API. The agent must verify that the root proxy explicitly delegates conditions (`prefix: /api`) without path conflicts.

Terminal Command
kubectl apply --dry-run=client -f ./ingress/root-proxy.yaml -f ./ingress/child-proxy.yaml
Production Pro-Tip

Instruct the agent to inspect `status.currentStatus` in live clusters to confirm `Valid` state and catch `Orphaned` proxies immediately.

Sandbox Gotcha

A child HTTPProxy that defines a `virtualhost` block will be rejected by Contour if it is referenced in an `includes` block by a root proxy.

Real-World Scenario: Multi-Tenant API Gateway Delegation with TLS Termination

Tested Trigger Prompt (Feed directly into Codex, Claude, or Cursor):

“Using the contour-envoy-ingress-gateway skill, setup envoy ingress contour for a multi-team delegation architecture. The platform team manages root domain 'api.internal.corp' in namespace 'projectcontour' with TLS secret 'wildcard-cert'. Delegate prefix path '/payments' to child proxy 'payments-proxy' in namespace 'team-payments'.”

Deterministic Agent Verification Pipeline:
Agent references the contour-envoy-ingress-gateway SOP and recognizes the multi-team delegation pattern.
Agent writes 'ingress/root-httpproxy.yaml' defining the root VirtualHost for 'api.internal.corp' with TLS termination in 'projectcontour' and an 'includes' directive pointing to namespace 'team-payments'.
Agent writes 'ingress/payments-child-httpproxy.yaml' containing the child HTTPProxy with no 'virtualhost' field, routing '/payments' to service 'payments-service:8080'.
Agent outputs a validation script running 'kubectl apply --dry-run=client' and checks for cross-namespace delegation constraints.

Runtime Troubleshooting & Failure Modes

Error: HTTPProxy.projectcontour.io "root-proxy" is invalid: spec.virtualhost: Duplicate virtualhost domain "api.internal.corp"

Root Cause: Both root and child HTTPProxy manifests defined the same virtualhost FQDN. In Project Contour delegation, only root proxies are permitted to define `spec.virtualhost`.

Resolution Command / Fix:
# Remove 'virtualhost' block from the child HTTPProxy file:
sed -i '/virtualhost:/,/tls:/d' ingress/payments-child-httpproxy.yaml
Error: status: currentStatus: Invalid, description: "root proxy includes child proxy team-payments/payments-proxy, but child proxy defines path prefix outside parent constraint"

Root Cause: The child proxy defines a route prefix that does not match or nest inside the root proxy delegation conditions.

Resolution Command / Fix:
# Ensure child proxy route matches root delegation include prefix:
yq eval '.spec.routes[0].conditions[0].prefix = "/payments"' -i ingress/payments-child-httpproxy.yaml

Frequently Asked Questions (Project Contour & Envoy Ingress Controller Architecture SOP)

Q:Can I use Project Contour & Envoy Ingress Controller Architecture across Codex, Claude Code, and Cursor simultaneously?

Yes. This skill adheres strictly to the universal SKILL.md specification. Once installed under `~/.agents/skills/contour-envoy-ingress-gateway`, any runtime (Codex, Claude Code CLI, Cursor, or Windsurf) will parse the metadata triggers and follow the same execution SOP.

Q:How does Project Contour & Envoy Ingress Controller Architecture prevent context window overflow during long agent sessions?

The skill loads lean, declarative SOP constraints instead of bloated documentation dumps. It instructs the agent to rely on local schema dry-runs (`kubectl --dry-run=client`) rather than generating dozens of exploratory iterations, preserving context tokens for your core codebase.

Q:Does this skill require escalated root or container permissions?

No. The skill is audited with a security score of 98/100. It requires only standard workspace file read/write access to produce and modify YAML manifests, with shell execution kept strictly local or disabled unless user-approved.

Ready to equip your autonomous agent with Project Contour & Envoy Ingress Controller Architecture?

Copy the complete audited SKILL.md specification or download the 1-click zip bundle directly from our verified registry.

Get 1-Click Install Spec