feat(config): add tokenUrl, clientId, clientSecret to auth config

Wire token exchange config for /auth/token and /auth/refresh endpoints. clientSecret loaded from AUTH_CLIENT_SECRET env var (never from YAML). Backward compatible — missing fields default to zero values. 3 new tests covering: full config, env-only secret, backward compat. Closes homelab#12 Co-authored-by: poimen <[email protected]>
2026-09-08 16:25:32 -07:00
parent 09318778fa
commit 136c85ad13
6 changed files with 125 additions and 0 deletions
@@ -17,6 +17,8 @@ data:
      audience: "api-gw"
      jwksUrl: "http://authentik-server.iam.svc.cluster.local/application/o/api-gw/jwks/"
      requiredCapability: "llm:inference"
+      tokenUrl: "http://authentik-server.iam.svc.cluster.local/application/o/token/"
+      clientId: "api-gw"
    
    # Routes: standard HTTP proxy routes (not LLM-specific)
    # These are for non-LLM services (agent-pod/console, etc.)
@@ -57,6 +57,12 @@ spec:
          value: "0.0.0.0:8080"
        - name: CONFIG_PATH
          value: "/etc/gateway/config.yaml"
+        - name: AUTH_CLIENT_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: api-gw-client-secret
+              key: client-secret
+              optional: true
        - name: SHUTDOWN_TIMEOUT
          value: "5m"
        - name: LOG_LEVEL
@@ -14,6 +14,8 @@ stringData:
      audience: "api-gw"
      jwksUrl: "http://authentik-server.iam.svc.cluster.local/application/o/api-gw/jwks/"
      requiredCapability: "llm:inference"
+      tokenUrl: "http://authentik-server.iam.svc.cluster.local/application/o/token/"
+      clientId: "api-gw"
    routes: []
    models:
    - name: "reasoning"