add additional ingress-routes

manifest/overlays/production/dev-safe-vmcp-ingress.yaml

@@ -4,7 +4,7 @@ metadata:
   name: vmcp-dev-safe-ingress
   namespace: toolhive-system
   labels:
-    app.kubernetes.io/name: vmcp-dev-safe-ingress
+    app.kubernetes.io/name: dev-safe-vmcp
 spec:
   entryPoints:
     - websecure

manifest/overlays/production/full-vmcp-ingress.yaml

@@ -0,0 +1,21 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: full-vmcp-ingress
+  namespace: toolhive-system
+  labels:
+    app.kubernetes.io/name: full-vmcp
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - kind: Rule
+      match: Host(`full-vmcp.olb42.com`)
+      services:
+        - name: vmcp-full-vmcp
+          namespace: toolhive-system
+          port: 4483
+  # No default TLSStore in this cluster, so reference the wildcard cert
+  # explicitly. olb42-wildcard-tls is auto-reflected into every namespace.
+  tls:
+    secretName: olb42-wildcard-tls

manifest/overlays/production/kustomization.yaml

@@ -18,6 +18,8 @@ resources:
   - mcp-tool-config-dev.yaml
   - embedding-server.yaml
   - full-vmcp.yaml
+  - full-vmcp-ingress.yaml
   - dev-safe-vmcp.yaml
+  - dev-safe-vmcp-ingress.yaml
   - ops-safe-vmcp.yaml
-  - ingress.yaml
+  - ops-safe-vmcp-ingress.yaml

manifest/overlays/production/ops-safe-vmcp-ingress.yaml

@@ -0,0 +1,21 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: vmcp-ops-safe-ingress
+  namespace: toolhive-system
+  labels:
+    app.kubernetes.io/name: ops-safe-vmcp
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - kind: Rule
+      match: Host(`ops-safe.olb42.com`)
+      services:
+        - name: vmcp-ops-safe-vmcp
+          namespace: toolhive-system
+          port: 4483
+  # No default TLSStore in this cluster, so reference the wildcard cert
+  # explicitly. olb42-wildcard-tls is auto-reflected into every namespace.
+  tls:
+    secretName: olb42-wildcard-tls