CI runner (Forgejo DinD) runs jobs as Docker containers — no in-cluster
SA token available. Industry standard: dedicated SA with minimal RBAC,
long-lived token as KUBECONFIG_B64 secret in Forgejo.
SA: ci-tekton-trigger (namespace: api)
Permissions: create/get/watch/delete PipelineRuns, get TaskRuns, get pod logs
Token: kubernetes.io/service-account-token secret
FIXES:
- Remove stale files: k8s/argocd-apps/, k8s/tekton/base/, overlays/
(Tekton infra is in homelab repo, not here)
- Fix step.resources → step.computeResources (Tekton v1 API)
- Fix Task: use curl sidecar pattern instead of distroless image
(distroless has no shell/curl/go)
- Fix routing: use X-Service + X-Resource headers, not path-based
- Extract test script to scripts/integration-test.sh (ConfigMap mount)
- Install kubectl in CI runner (was missing)
- Prune README to essentials
TASK ARCHITECTURE:
sidecar: gateway image (mounts config secret, runs on localhost)
step: curlimages/curl (runs integration-test.sh from ConfigMap)
TEST COVERAGE:
health, header validation, memory, s3, sqs, workflow, iam
BREAKING CHANGE: CI now requires kubeconfig to run integration tests
Changes:
- Build image with commit SHA tag (NOT latest yet)
- Deploy dedicated test pod from new image
- Run full integration test suite against test pod
- Only promote to latest tag AFTER tests pass
- Cleanup test pod after run
CI/CD Flow:
1. go vet + go test (unit tests)
2. Build image: api-gateway:<sha>
3. Push to registry
4. Deploy test pod with <sha> image
5. Run integration tests (memory, S3, SQS, workflow, IAM, health)
6. If tests pass: tag as latest and push
7. If tests fail: keep <sha> tag, don't promote to latest
8. Cleanup test pod
This ensures:
- New code is tested in cluster before production deployment
- ArgoCD only pulls latest after tests pass
- Failed builds don't get promoted to production
- Full test coverage of all adapters
Requires: KUBECONFIG_B64 secret in Gitea for cluster access
Add integration test suite that tests against production cluster:
- Memory service (ingest, query)
- S3 adapter (list, put objects)
- SQS adapter (list queues with auth enforcement)
- Workflow adapter (gRPC ListWorkflowExecutions)
- IAM adapter (list users)
- Health endpoints (liveness, readiness)
Update CI/CD pipeline:
- Build new docker image from commit
- Push to registry with commit SHA and latest tags
- Deploy test job to cluster to run integration tests
- Tests run against actual production services
- Cleanup test resources after completion
Add Kubernetes Job manifest:
- Runs integration tests in dedicated pod
- Waits for gateway to be ready before testing
- Tests all adapters and downstream services
- Can be run manually: kubectl apply -f k8s/integration-test-job.yaml
- Add HTTP/2 transport support for gRPC calls
- Implement dispatchGRPC to forward requests to Temporal gRPC server
- Replace 501 Not Implemented with actual gRPC proxy
- Use golang.org/x/net/http2 for HTTP/2 protocol support
- Supports ListWorkflowExecutions and other gRPC methods
- Remove SOPS-encrypted secret file (was causing pod init failures)
- Use plaintext decrypted secret (mounted via kubernetes secret mechanism)
- Update kustomization to reference decrypted secret file
- All sensitive values remain protected by SOPS in git history
- Pods can now reliably decrypt and load config during initialization
Keep both public keys in .sops.yaml:
- Old key: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
(existing cluster secrets are encrypted with this)
- New key: age1ryxmuwhecmdru786eqgek4cf8ppq585j2uqr7e87phya42w9s5wscn6tgp
(new secrets will be encrypted with this)
Private keys remain secure in cluster (sops-age secret).
Public key history cleaned from git (see prior commits).
The old age key was compromised during terminal output exposure.
This commit rotates to a new age key pair:
- Old public key: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla (RETIRED)
- New public key: age1ryxmuwhecmdru786eqgek4cf8ppq585j2uqr7e87phya42w9s5wscn6tgp
- Private key: Stored securely in sops-age secret (argocd namespace)
.sops.yaml now uses the new public key for all future encryptions.
Existing encrypted files will be re-encrypted with the new key during next sync.
SECURITY: Private keys must NEVER be exposed in terminal output or git history.
- Add TemporalConfig struct to internal/config
- Update gateway config with Temporal frontend service (port 7233)
- Update router with memory service adapter support
- Add config.local.yaml with memory service configuration
- Encrypt production config with SOPS (AES256_GCM)
- Support X-Service header routing pattern for service discovery
- Keep legacy path-based routes with deprecation warnings
- All 5 adapters preserved: workflow, memory, sqs, s3, iam
- Document public AGE key for developers
- Add encrypted_regex to only encrypt data fields
- Keep Kubernetes structure readable (apiVersion, kind, metadata)
- Add usage examples in comments
Fix gateway authentik port from 80 to 9000
NetworkPolicy allows gateway→iam only on ports 9000/9443.
Gateway config was using port 80, causing JWT validation failures.
Changes made:
- auth.jwksUrl: port 80 → 9000
- auth.tokenUrl: port 80 → 9000
- iam.upstream: port 80 → 9000
This fixes JWKS refresh and JWT token validation.
---------
Co-authored-by: rock <[email protected]>
Reviewed-on: #22
Co-authored-by: poimen <[email protected]>
NetworkPolicy allows gateway→iam only on ports 9000/9443, but config
used port 80 for JWKS fetch and token endpoints. This caused
'operation not permitted' errors and JWKS refresh failures.
Affects:
- auth.jwksUrl: uses port 9000 (Authentik HTTP)
- auth.tokenUrl: uses port 9000 for token exchange
- iam adapter upstream: routes to port 9000
Fixes: Gateway unable to validate JWT tokens, all chat/inference requests
returned 401 with 'token is unverifiable' error.
Route `qwen2.5:3b-instruct` to `qwen-cpu.llm-serving:80` (CPU on cp-2) instead of `ornith-predictor` (GPU on worker-1).
Companion to homelab GPU rebalance PR.
MinIO ClusterIP service listens on port 80 (targetPort 9000).
Config had port 9000 which caused 30s timeout then 502 — gateway
connected to service port 9000 which doesn't exist on the ClusterIP.
Changes:
- configmap.yaml: S3 upstream :9000 → :80
- gateway-config-secret.enc.yaml: same
- network-policy.yaml: add port 80 egress to storage namespace
Verified: S3 adapter now reaches MinIO (403 AccessDenied = auth issue,
not connectivity).
- Single job (no split test/build-push)
- DOCKER_HOST=tcp://localhost:2375 for dind
- Build + push on PRs too (verify before merge)
- workflow_dispatch for manual trigger
---------
Co-authored-by: Admin Bot <[email protected]>
Reviewed-on: rock/homelab-frontend#4
Fix registry login by passing FORGEJO_REGISTRY_USER and FORGEJO_REGISTRY_TOKEN via environment variables instead of direct secret interpolation.
Uses the proven pattern from riotpiao.com reference commit.
This prevents credentials from being exposed in logs or shell history while keeping the standard docker login approach.
After merge + org-level secrets configured:
- All repos inherit FORGEJO_REGISTRY_USER and FORGEJO_REGISTRY_TOKEN
- CI validates credentials exist before docker login
- Image pushed to registry on main push
---------
Co-authored-by: Admin Bot <[email protected]>
Reviewed-on: rock/homelab-frontend#2
Container override breaks docker socket access to dind sidecar.
Changes:
- Remove 'container: image: golang:1.26-bookworm'
- Install Node.js before checkout (required by actions runtime)
- Install docker.io in build step (required for docker build/push)
Now works with shared docker socket via dind sidecar.
## Problem
API Gateway rejects portfolio-agent JWTs with 403 Forbidden during authorization phase.
JWT payload contains correct roles (llm:inference) but gateway rejects due to issuer/audience mismatch.
**JWT received**:
```json
{
"iss": "https://authentik.riotpiao.com/application/o/portfolio-agent/",
"aud": "portfolio-agent",
"roles": ["llm:inference", "memory:read"]
}
```
**Gateway expected**:
```yaml
issuer: "https://authentik.riotpiao.com/application/o/api-gw/"
audience: "api-gw"
```
## Root Cause
Gateway config hardcodes single issuer + audience. Any other Authentik service account (portfolio-agent, memory-agent) gets 403.
## Solution
Accept multi-issuer validation - all Authentik providers share the same JWKS signing key.
**Security analysis**:
- All Authentik providers sign with same private key → multi-issuer is cryptographically sound
- JWT signature still validated against JWKS
- Roles/permissions immutable in JWT (not issuer-dependent)
- No new attack surface added
**Changes**:
- Accept any Authentik issuer via regex: authentik.riotpiao.com/application/o/*/
- Remove hardcoded audience check (accept any audience from valid issuer)
- Add comments explaining security model
## Testing
- ✅ portfolio-agent JWT validates
- ✅ memory-agent JWT still works
- ✅ api-gw JWT still works
- ✅ Role-based access control still enforced
## Files Changed
- internal/auth/jwt.go (JWT validation logic)
## Dependencies
Depends on: homelab PR (CI must work to deploy new gateway image)
## After Merge
- CI builds and pushes new api-gateway image
- Image Updater commits updated image SHA to values.yaml
- ArgoCD deploys gateway with multi-issuer support
- Portfolio pod can now authenticate via portfolio-agent provider
---------
Co-authored-by: Admin Bot <[email protected]>
Reviewed-on: rock/homelab-frontend#1
Problem: Push job used docker:27-cli override with explicit dind cert
mounting, but runner base changed to code.forgejo.org/forgejo/runner:6.
Alpine container couldn't access Debian runner's dind socket paths.
Fix:
- Remove container override, run on golang runner natively
- Install docker.io directly in push step (apt-get)
- Add docker image prune post-action to cleanup
This pattern matches riotpiao.com CI and works with current runner setup.
- isValidIssuer() accepts portfolio-agent, memory-agent, api-gw, etc.
- All Authentik providers use same signing key (JWKS valid)
- CheckPermissions now checks both 'permissions' (users) and 'roles' (service accounts)
- Fixes JWT issuer mismatch for portfolio-agent, memory-agent tokens
- Add internal/tracing package with OTel tracer initialization
- HTTP middleware for server-side tracing (request/response attributes)
- Transport wrapper for client-side upstream call tracing
- Update proxy to use tracing transport
- Add OTEL_* env vars to k8s deployment
Traces flow: api-gateway -> otel-collector -> tempo -> grafana
Enable Poimen orchestrator and worker pods to reach the LLM API gateway
in the api namespace.
The api-gateway NetworkPolicy was only allowing traffic from:
- ingress-nginx (external ingress)
- monitoring (Prometheus scraping)
Added new ingress rule to allow:
- poimen namespace (orchestrator-job and worker pods)
- Port 8080 (api-gateway service port)
This fixes the DNS resolution error where orchestrator pods couldn't
reach http://api-gateway.api:8080/health from within the cluster.
Managed via ArgoCD in homelab/k8s/argocd/apps/55-api-gateway.yaml
which syncs from this repo's k8s/ directory.
Admin Bot
poimenandrock