Decision: GATE does not need platform multi-port for the multi-tenant deployment of iam-auth today

GATE (IAM) serves iam-auth HTTP traffic to the internet and gRPC traffic to GitLab Rails. The two are exposed and scaled separately, so each needs its own deployment and port. This raised the question of whether platform multi-port support had to land — end to end, through Runway — on Auth’s deadlines. The Auth team has agreed it does not: GATE’s requirement is met today without platform multi-port.

The decision

• GATE proceeds on two single-listener charts. iam-auth ships as separate HTTP and gRPC deployments ( iam!515) — one image, the two protocols served and scaled independently. This meets the requirement with what the platform supports now.
• Multi-port comes off Auth’s critical path. No platform multi-port work is required for Auth’s deadlines, and the previously discussed end-to-end-by-September-30 need no longer applies.
• The convergence target is unchanged, without a deadline. One iam-auth chart declaring two listeners, serving two Runway deployments ( iam!599), remains the shape to converge on once runwayctl can select a listener per deployment ( runway/team#1000). Auth will evaluate its adoption when it lands; it is a roadmap item, not a blocker.

The headline: there is no outstanding work necessary in Theseus to facilitate GATE. Everything GATE runs on today — the split charts, the deployment path, the platform underneath — is already supported; the items below are roadmap direction, not prerequisites.

What this changes for the platform

• Fairway’s listener support stands. v3.5.0 shipped multiple listeners on a deployment (see the multi-port announcement); GATE simply is not blocked on consuming it.
• The Runway work is reprioritised, not cancelled. With Auth’s deadline pressure removed — and AutoFlow having already confirmed multi-port is not needed for its initial launch — runwayctl listener-per-deployment support is scheduled as normal roadmap work rather than an urgent commitment.
• Out of scope, as before: multiple kind: Deployments from a single Fairway chart ( fairway#33) is a separate, in-design item.

What happens next

Runway schedules the listener-per-deployment work on its roadmap; Auth continues on the split-chart shape and converges on one chart with two listeners when the support exists. If Auth’s constraints change — a new protocol, a hard date — this record is superseded by a new one rather than edited.