[jopemachine]

Resolves #15540 (BA-8444)

Summary

• With enable_traefik, the coordinator /v2/ingress API sends every authority's ingresses to TraefikWorkerClient, which writes them to Traefik etcd, instead of pushing to workers. Without it, the push path from feat(BA-8443): push ingresses from the coordinator to api-delivery workers #15833 is unchanged.
• TraefikWorkerClient and AppProxyWorkerClient share BaseWorkerClient, so IngressService picks an authority's clients in one place and waits for every client before reporting the failed ones in IngressPushFailedError (renamed from ApiDeliveryWorkerPushFailedError).
• Each ingress is one set of subtrees under worker_{authority}/{http|tcp}/: routers/bai_ingress_{frontend_key}_router, services/..._service, and for HTTP middlewares/..._ipallowlist and ..._auth.
  • Every prefix of the ingress, including the other protocol's, is replaced in one transaction, so a protocol or allowlist it no longer has is cleared.
  • The revision is kept at ingress_revisions/worker_{authority}/{frontend_key}/revision, outside every Traefik root key. The replacement commits only if that key still holds the revision read before it (compare_and_replace_prefixes, feat(BA-8643): add compare_and_replace_prefixes to AbstractKVStore #15988).
  • As an api-delivery worker does, an upsert writes nothing when any of its ingresses is older than the held revision (409 TraefikIngressRevisionConflictError), and rewrites one of the same revision.
  • When another write to the same frontend commits between the revision check and the write, the write fails with 409 TraefikIngressConcurrentWriteError instead of retrying; resending the ingress applies it or reports a newer revision. An api-delivery worker serializes the check and the write under a lock, so it never fails this way.
  • Each ingress is written in its own transaction to stay within etcd's per-transaction operation limit.
  • Remove clears the set and its revision.
• The appproxy-traefik-plugin middleware receives the ingress JSON as ingress in place of circuit.
• TraefikWorkerClient takes TraefikRoutingConfigFactory (merged in refactor(BA-8675): add TraefikRoutingConfigFactory for ingresses #16018) through TraefikWorkerClientArgs, clears every key from all_routing_config_etcd_keys in the same transaction as writing the configs from routing_configs_by_etcd_key (or on remove), and keeps only the etcd transactions.
• The worker values a router needs (hostname, wildcard_domain, tls_listen) come from service discovery: a worker now registers them as hostname, wildcard-domain and tls-listen labels next to authority, so the Traefik export does not read the coordinator DB. An authority with no worker registered with them is reported as 404 WorkerNotFound.
• The coordinator builds the api-delivery worker ClientPool and the Traefik worker client in a new components stage (dependencies/components/, ComponentsComposer with WorkerClientPoolProvider and TraefikWorkerClientProvider). The server enters it in components_ctx, which replaces worker_client_pool_ctx, and ingress_service_ctx only assembles IngressService.
• The circuit path and its reconcile are untouched. The reconcile only collects bai_service_{uuid} keys, so it never deletes ingress keys.

Not in this PR

• The plugin repository reading ingress instead of circuit.
• The usage-marker plugin (appproxy-traefik-plugin-go) for ingresses; it takes session ids, which an ingress does not carry (BA-8321 records usage by target id).
• Target group weights: every target of a group with weight above 0 is served equally.
• A removal drops the revision, so an upsert older than the removal that arrives later writes the ingress again.

Test plan

• pants check / pants test on tests/unit/appproxy::
• clients/worker/traefik/test_client.py: writes when the held revision is absent, older or the same; rejects a newer one; writes none of a batch holding an older ingress
• services/test_ingress.py: a failed Traefik write is reported after every write finishes

🤖 Generated with Claude Code