fix: gateway authentik port from 80 to 9000

NetworkPolicy allows gateway→iam only on ports 9000/9443, but config used port 80 for JWKS fetch and token endpoints. This caused 'operation not permitted' errors and JWKS refresh failures. Affects: - auth.jwksUrl: uses port 9000 (Authentik HTTP) - auth.tokenUrl: uses port 9000 for token exchange - iam adapter upstream: routes to port 9000 Fixes: Gateway unable to validate JWT tokens, all chat/inference requests returned 401 with 'token is unverifiable' error.
2026-09-13 08:48:08 +09:00
3 changed files with 284 additions and 51 deletions
@@ -1,4 +0,0 @@
-creation_rules:
-  # Encrypt secrets, configs, and deployment files with infrastructure details
-  - path_regex: k8s/(.*secret.*|.*config.*|.*deployment.*\.ya?ml)
-    age: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
@@ -1,27 +1,131 @@
-apiVersion: ENC[AES256_GCM,data:zPM=,iv:31E0HyT/gIYuP7wJuv2PyZTUI8ZSxzsHoNwJBXtN3eQ=,tag:UiOz3gWeZpseTvijzoMO/g==,type:str]
-kind: ENC[AES256_GCM,data:fC9L4bgQ,iv:cTB5L5uOy/klV5ACJgHwY2voWGo1NcoINrrQyyZMBl8=,tag:v0/8OPMW/Yun7/JPJidUtA==,type:str]
+apiVersion: v1
+kind: Secret
 metadata:
-    name: ENC[AES256_GCM,data:35058TEeQUpJ7TT16XX4HsxN,iv:W/n1SdzwAGeOhwD7XE3dIoMnzttaxHV4fBqfW+1cut8=,tag:AOlK9sfDT5wzNq+91hxQtw==,type:str]
-    namespace: ENC[AES256_GCM,data:GTD3,iv:58j03KpGyiiEJCvSip9hdZA/scPtn31VkYxE9U3SCN8=,tag:q+RNx4PmENfNHgK5RRE3kw==,type:str]
-    labels:
-        app: ENC[AES256_GCM,data:2ZMbFp4alrD/qnM=,iv:p66pFUVHBYPnYE9icQhrphsLbF41if26EcxQ7x0uIV0=,tag:GjQJbzjrf5Bx6rKMMALXmw==,type:str]
-type: ENC[AES256_GCM,data:bKTOubPr,iv:jUOAj9p6BhrQGIXYNcp7aam5IkfGHzvmnja6Po8dHwc=,tag:mUKMVkGOGma4CF3OIAWHyg==,type:str]
+  name: api-gateway-config
+  namespace: api
+  labels:
+    app: api-gateway
+type: Opaque
 stringData:
-    config.yaml: ENC[AES256_GCM,data:sRkonCAvqqiOdyZLNUVvptbwB9Cf5QxBw5mo9vG7uEy3ySrI4MdpxoZ05zxGZbTbGmzOg7Nmh26AXqnizuICRiHknXQz9eOFPvbHuPCMOlezhMfbIRmcJ6HBUPVdKo4uAYbTfJVsqH0KXVsaSptEPydx4nPR1u8GB26NC1qqzIT7ax1bKzUEWvI9LZNZWfHfirp7O/CGTA0QvzfKp7dP7tkf84+SiJLlrl90q4mUTFF4D0LZLS4sxMi5LfwVls4epB13Jo83ezOojdO8lc2wj8PWRan2PE8pLwC6r36kiZ2upXQR2rU9h8rblgHL0lRM5vcgEy0Ey54s32sLLl3m8jW2f/npXYSUh/lSyjdT9JlTcknMa1FwMvm0AMyzZ2p0DeoGa+gnbXhxhq7cGa2tKTOby07eJxNs9k2wyr7ThvTMnpatpnV6qMvGj2P4SZKj5a3WKQpSacJ7jTyBa16FBmN+IMzlnP89/55zpx/WCG0xHxcr16h1bZFE+isTyrHPJ7TYtcailA/+sM7HJL7rnXBPzs2LjmJPY90wX6marle9Vg7+L69DwC4fswpjcMFZ1o8gd9na3jWHr4so4Y9nUok9qPnJIW3C9NUMN/mPNKVC7tt6p04jq9Q2GzGPK3sLx/vD36kkD4DgjOBe/DDnskTC6G0CSZfAjFOc+ec5ExVCpgPH8ysw7Xj8SvCYGhklcuR/D4xKldNUT5KfEExQLBbsjlW1PJGheIdjftmgultmDDsb86Yp0DOicxzWuh4ekA8hkqb1RSkyl2OiDgVvvANvBDQLuZBuFBlJoF0bLNLcyJXdl9EjnG0ClqYz5mzkId50afbh1p13tOkpIv66ONYznu5hKfLdtUrqnjTjtDt68msnsvUbQVvI6OOHUcqOzHZ4W/X8hOEzqRf9aAriEyIPj6Ac+SRvvuYOjzFPjCW/+RlyqZ8ec8MKZ43NeFI9Hg8Xnm9QoursiLRhbch20/FH3rEN7RGx2NGc2FU4HuCbV0spVPmItv7SsDKM88nXRa5C+g+cDl8YkPc1blDz3xX24jOD5oa7fVWhjmVLdKrTGGzykrmMDdj7phBviWiuFvOXt5b2A1l35ABDNjKC104bieuGM06p9T6xuB3eRPJLcJufKq4N8kk/LamvMYf9T1GAHhCxiy3iXwRhVCmMhea5e5N7OdnSWa8OipxRNcJBO7uWSrTlLYnFdkTXoYXM4syc8+j4P+1k45zOkwaUAR/WdaAQlHZgu6o9on7nFFd4QTSElJgh00y76Mb/wHdPdlAOi2lg9dA0DAWfGKi42ez4dOWjn9UDJdRLJUIh2vSJyu39wgsXHTNBQXcRc86jTBhhjh6iaAXoTmXmWvx9ZuBhOsW0clUePGbg+c8oRmWvIAYR21IPA46WSxPDQQve0JjrO73rEPQ2vmy5nqpDpywRPgbgYReDZ1FiBtZASnaEPCwunro1oKUJbjtaJBt3yx1+xilg/wTmeH9kP9sDWE47LJ3hBGEtmTNTTrDP11IP8rqU5tSHGNlRW6V9nxlAW73LJrahNWrl8tm2UP8SQG+hyrQmKvALzDQlnbjVEo9m+kPTbiewxN8gRCt8qfgk9jDcJASynQWButjyutQt84qdFQWYMRV1GNvZ7oU0OdEXfHgM7vwm+Qke1EohGkXqtqLUmXqF+NWMzWTeg1SCuH60MsOMHoKM8LId7IYl3NsmALhYOSn/FojR80ejt6AzJtezXKupeRjHHszLYP5xZDpu7swqQy4PoIybQXB9alWNhS7wTsqr8zIjKN8LFNKV4r4Nx2BdtbrWzvAGVDpGTZclTDTqm5IhcQRMOPsd3Hh3zOchpczeqdZsW0CE2EByJOqlQFRTUS7ebqU+nfNxra51hlehEGjwW2qjF/1JY+2kaaSqLerZpQkAhuyfOnFhVmN3QWXO7EvHpL4D658R2MwYAqcq1Lhlqo9kz0ebOib/YlazDEa6Wd/oenUcT9pTapRozZcOAo6bkZ4BBTxTd+dUYbJpqJfZFJt3rHJiutX9Go46mP+PQJ9MM8HeW2KicB33hPFBDiTKCySRprJCfc6Q/iP4UVk7n0AXkAzLLm8gIUByxF1yKwRyYNTS9Dko4mkiueKK96X9LrPy2s2o7hK+s1qcF7Hh+4HMJw9U/Ys2mZKecvRfcbAGXrPFORGSm59PRyMQycPPz/uOiFnEVL1xKrn/foq81iADpCSf/pTS+Rkb0EbH6MGN8b6CPKq2m5rxWgNKcRyOD85UPjyhMKF12CjAjRxEg8hlce7e5StEOgH01W9uT8MkXmBWag2FcwRU282jvcPJYHUKR6LlZRTMbJN+5onxlOkGco8//Cw48X+rASCS899+1AQkPNzdkUn49tqhHMlLBCOfFkXi3QJ/L3lloe/rPA2b4PQu0v80kgHVn+LaDUX8LcMbTA5fay85tiFlETSS1M9qZPQ+HY7QjJScDQsKU36NmgyMpdwKccuqSv+qd2E4mPRlE6mG+BrqvR6+Vrk9MGvrsnt/Dgjuc8z9rM1mgnrP9/uucseeTqYc5ibrp0X4Umn03a9QJa1wIvbLQkvOFq0BILwsCbOu4ls/EuGO2mUMjfoqD03UXFXbnH1GspX8nm8Dk9w3rugVeFD3ZVBKV5aRkx3cxVGgkpQv33Jd8e6O+s7+B7AcVpL+D+lIGWFkf6CjxTe+zZ1fjdNQrKEuXJ0koOn2r5SqbQC4PI+mWlIhgQ2ELYMHHRLYDi2DiC44UMNVwxbVNdtBnTf0EDdUIsprneS6kcjg4MuXJVdbtMYmMbeOSeP7Lk7mAM2gkEy8jZcoKhdG6kmojCi+T9D37hn7038rz+JOCJxBuH099yvI87IRp01PLOczASWBFgBe7Jxa6zEdOXR3PLb/oiTn9EB0oDxO5oSMM5jM8SxqspRP/5gAjQdkIFH9gE+y56PUbyAcbFqEqO1oODVUKv1u7tx43yosH0R5LK0JM+R5bcwJ3D0qBWPSjnU4aczRZ1XSenkLJXOE1+V3bWMNlpEqR4mtSUqe3msv8tryNWkQpdqPeTN4F89Wmhvx/d74RfZ+IDc674tJs40hK4kwm761RtXlItvcUtRokva9PDLRe50zcG9s6gkMkflrVcVKTepGGa7cNm9HxQeOeHSonBXWSRrisz5EISWwuWA6RteF5PMznApizZbCrmoIW0GDa1ibBnVZrVq87jRl0jkJelqp5kAVFajWPXW/XOwLfpOKBcQX9hKxUeFEaXSXaf6vY7SWle6EFb+3wk/Gy6piULDCkAM6LyOskxFLaqQP6PJ7Jg89MmHj2cK8wIvMNt8SdoxM/Ckrj3chSq/9yCy9UoVGDTYg6PNmzcRj9RFBKIXpldgC37rNWwshc6HXRLPmrNiJe0PjNOYPyUU0UtY87peS5C1HxABWGEjv+nIqlAgTmLieKlMLzCW+PDjvp7pYu324t4gLywgxem4mrHVTSCHmXY9UOODzZ3vzspx+RrsAmF01mLG6nxgMycf7t4U6d1yaOGn/78i947IUx/CkdKUbHlgl7qeGOOk/GPM01yz86xczviMjYLL5J9GlpQwOpAvr39ODjCKv9jmoq6XP9RVLdVLo+/JsjQnuDCqnC6razVUYiDQbFbR6Rj/2bY97UEJPeJu1RBkwUooQ8XTn3tf2g02bM9VjBFEnjBRw7zBTAwNA+vMp25a3NgFCDV/tBI93bddJd9P5BjXPW9a/44yHi36/CiFf0W8w/62DlmFLCBKP9aduZ3dYv7T6pn5fZILtF4TPGkZxXxPRakhtNnz49/DaGkxY8X2V5Gt4TVZg9aohQHJfAhmaCwb4DRnDZyd2lD8xI82V2XIUIUK0gMRT5aBrZdvLNSOnHjLZuyRjd/3iYxPjP2PaT9cDcpFxvsBSfXbGafDITqwWoDasPSWviBgJlKRbtkXUu0AlVKTL7uukM4DUcR60olyrjyJmbrKeRcueiHJ4aLjjKbI+2j8i9QC0rH+hgdFFer09b/ORAzbPDq+MknsYVux33wNTQ+7haXadjqMSIzdx0FgWBfMQOquj6gT80OQ3yiu2M+k=,iv:F+45ts5NR7auZMszEdZc6m1yqs5m90v+LSZinS0uo5M=,tag:3g351RmwiBMCtYyRGJAm+A==,type:str]
-#ENC[AES256_GCM,data:j2gPjs0hZwK/5c3fIRqnfMaRbxe0uoUTiUO7oSexIgOpbQGwZBME2BBZTf/BjlbnWGFgU43E9Y3LZm/Da3xR7w==,iv:BmUAWIEuzu+mz2Q2c3HNrS/gbdbXhaHaD/edcaVbSKs=,tag:ckp/2N8vGCoE/5i284LzSw==,type:comment]
-#ENC[AES256_GCM,data:sQaf5dfdmyJ0czeNstXaN38TGZMa3/nfD1jaV46MT4deBJFgWAikcnnJJGC8hGK8KKVXZ+W7mmxwskE=,iv:1JKnZFYzm5PrcsvGduSLk31saixMBrMqk/VwG1P3JQg=,tag:UWW/ngvsz6/GNYLrUUxLzQ==,type:comment]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZQTVNVXczc29yQ1JnTmJR
-            QnFJTVJvczROZU44cmNqZW5POHJEbnc4Rnl3ClhldTg2dkY2aGpVN2FBb1dGQ2tS
-            Y1M3TTQ2NjNvRm45YzlBODIweHcxZVUKLS0tIEZpZnJ1cncxUm04a2hWMkZVSHEv
-            cVFraWhTNzBNUHlPMGxPNVhkTmxubWsKYUkhnMX/1aXP7yh5z1JNUlSW9GKSU1QM
-            3DDporJvkUBx/PEUkRuCY0ntFqQKxsOPzfY1R3Xls2KdXHgQjPFkMA==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
-    lastmodified: "2026-09-12T23:54:28Z"
-    mac: ENC[AES256_GCM,data:BXGmTl7z+oh4+sAnWqzIpzGkoJ1ebzQJYZAYZHb2xrsrMK6LRtzZYW9OHTXuP1UCZtLnFvy5dsLFUMFXwOo8hxeBx4GpRJUFrTuA+phkkv3+RHXL+sDBvzDr/Z0vqgVE7evAxumnfAnLfpRvbAs5BaaFi3s2GWYO/pj1k9hRL4o=,iv:IeKfgXERKH7Vwd3mJLsufTvQ52EwoK4jCH538VW7Fxs=,tag:/HsSYetbscQ3CTm081I3QA==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.2
+  config.yaml: |
+    auth:
+      enabled: true
+      issuer: "https://authentik.riotpiao.com/application/o/api-gw/"
+      audience: "api-gw"
+      jwksUrl: "http://authentik-server.iam.svc.cluster.local/application/o/api-gw/jwks/"
+      requiredCapability: "llm:inference"
+      tokenUrl: "http://authentik-server.iam.svc.cluster.local/application/o/token/"
+      clientId: "api-gw"
+    routes: []
+    models:
+    - name: "reasoning"
+      address: "reasoning-predictor.llm-serving:80"
+      path: "/v1/chat/completions"
+    - name: "ornith:35b"
+      address: "ornith-predictor.llm-serving:80"
+      path: "/v1/chat/completions"
+    - name: "qwen2.5:3b-instruct"
+      address: "qwen-cpu.llm-serving:80"
+      path: "/v1/chat/completions"
+    - name: "nomic-ai/nomic-embed-text-v2-moe"
+      address: "embeddings-predictor.llm-serving:80"
+      path: "/v1/embeddings"
+    - name: "BAAI/bge-reranker-base"
+      address: "reranker-predictor.llm-serving:80"
+      path: "/v1/rerank"
+    adapters:
+    - serviceName: sqs
+      upstream:
+        url: http://management-service.sqs.svc.cluster.local:9090
+        timeoutSeconds: 30
+      auth:
+        required: true
+      resources:
+      - name: send-message
+        methods:
+        - verb: POST
+          upstreamPath: /sqs/send
+      - name: receive-message
+        methods:
+        - verb: POST
+          upstreamPath: /sqs/receive
+      - name: list-queues
+        methods:
+        - verb: GET
+          upstreamPath: /sqs/queues
+    - serviceName: workflow
+      upstream:
+        url: grpc://temporal-frontend.temporal.svc.cluster.local:7233
+        timeoutSeconds: 60
+      auth:
+        required: false
+      resources:
+      - name: execute
+        methods:
+        - verb: POST
+          upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/ExecuteWorkflow
+      - name: describe
+        methods:
+        - verb: GET
+          upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/DescribeWorkflowExecution
+      - name: list
+        methods:
+        - verb: GET
+          upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/ListWorkflowExecutions
+    - serviceName: memory
+      upstream:
+        url: http://poimen-memory.poimen.svc.cluster.local:8080
+        timeoutSeconds: 30
+      auth:
+        required: false
+      resources:
+      - name: query
+        methods:
+        - verb: POST
+          upstreamPath: /memory/query
+      - name: ingest
+        methods:
+        - verb: POST
+          upstreamPath: /memory/ingest
+      - name: skills
+        methods:
+        - verb: GET
+          upstreamPath: /memory/skills
+    - serviceName: s3
+      upstream:
+        url: http://minio.storage.svc.cluster.local:80
+        timeoutSeconds: 30
+      auth:
+        required: false
+      resources:
+      - name: list-objects
+        methods:
+        - verb: GET
+          upstreamPath: /
+      - name: get-object
+        methods:
+        - verb: GET
+          upstreamPath: /
+      - name: put-object
+        methods:
+        - verb: PUT
+          upstreamPath: /
+    - serviceName: iam
+      upstream:
+        url: http://authentik-server.iam.svc.cluster.local:80
+        timeoutSeconds: 30
+      auth:
+        required: false
+      resources:
+      - name: list-roles
+        methods:
+        - verb: GET
+          upstreamPath: /api/v3/roles
+      - name: list-users
+        methods:
+        - verb: GET
+          upstreamPath: /api/v3/users
+      - name: create-role
+        methods:
+        - verb: POST
+          upstreamPath: /api/v3/roles