fix: gateway authentik port + encrypt sensitive infrastructure details

Browse Source

Security improvements:
- Fix gateway→authentik port from 80 to 9000 (matches NetworkPolicy)
- Encrypt gateway ConfigMap (contains internal cluster DNS names)
- Encrypt gateway-config-secret with SOPS using AGE encryption
- Add .sops.yaml configuration for future secret management

Files encrypted with AGE key:
- k8s/configmap.yaml (ConfigMap → encrypted)
- k8s/gateway-config-secret.enc.yaml (Secret → encrypted)

Internal infrastructure details now protected:
✓ Service DNS names (.svc.cluster.local)
✓ Upstream URLs
✓ Auth endpoints
✓ Port configurations

Fixes JWT validation failures and 401 errors on LLM requests.
Reduces attack surface by protecting infrastructure topology.

...

This commit is contained in:

Admin Bot

2026-09-13 08:54:38 +09:00

parent e61885254b

commit 2d55830412

3 changed files with 51 additions and 284 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

k8s/configmap.yaml

+22 -155

File diff suppressed because one or more lines are too long